From 8f6e1b738a1abe8e03ee09c962f12258aaf15da7 Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Fri, 18 Sep 2026 08:27:21 +0000 Subject: [PATCH 1/3] chore: switch the image to Python 3.14 on Debian 13 (trixie) The published image carried an outdated CA store and rejected certificates chaining to newer public roots. torch goes to 2.9.1, the release with Python 3.14 wheels that still uses CUDA 12.8 and ROCm 6.4, so host driver requirements stay the same. Signed-off-by: Oleksandr Piskun --- Dockerfile | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Dockerfile b/Dockerfile index c08afa6..b514785 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM docker.io/python:3.12-slim-bookworm AS builder +FROM docker.io/python:3.14-slim-trixie AS builder RUN apt-get update && apt-get install -y curl && \ apt-get clean && rm -rf /var/lib/apt/lists/* @@ -42,19 +42,19 @@ RUN --mount=type=cache,target=/root/.cache/pip \ ARCH=$(uname -m) && \ if [ "$ARCH" = "aarch64" ]; then \ echo "Installing PyTorch for ARM64"; \ - python3 -m pip install --root-user-action=ignore torch==2.8.0 torchvision; \ + python3 -m pip install --root-user-action=ignore torch==2.9.1 torchvision; \ elif [ "$BUILD_TYPE" = "rocm" ]; then \ - python3 -m pip install --root-user-action=ignore torch==2.8.0 torchvision --index-url https://download.pytorch.org/whl/rocm6.4; \ + python3 -m pip install --root-user-action=ignore torch==2.9.1 torchvision --index-url https://download.pytorch.org/whl/rocm6.4; \ elif [ "$BUILD_TYPE" = "cpu" ]; then \ - python3 -m pip install --root-user-action=ignore torch==2.8.0 torchvision --index-url https://download.pytorch.org/whl/cpu; \ + python3 -m pip install --root-user-action=ignore torch==2.9.1 torchvision --index-url https://download.pytorch.org/whl/cpu; \ else \ - python3 -m pip install --root-user-action=ignore torch==2.8.0 torchvision; \ + python3 -m pip install --root-user-action=ignore torch==2.9.1 torchvision; \ fi RUN --mount=type=cache,target=/root/.cache/pip \ python3 -m pip install --root-user-action=ignore -r requirements.txt && rm requirements.txt -FROM python:3.12-slim-bookworm +FROM python:3.14-slim-trixie COPY --from=builder /usr/local/ /usr/local/ From 6e34233cb58c4f4860aa3a87c886ac13b68f0f8f Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Fri, 18 Sep 2026 08:50:59 +0000 Subject: [PATCH 2/3] ci: test against AppAPI main instead of the app store release The workflow enabled app_api from the app store, which resolves to the old 3.2.3 release. That version calls DIContainer::query(), now protected on server master, so the init status request ended in a PHP fatal and the log check failed. Signed-off-by: Oleksandr Piskun --- .github/workflows/test-deploy.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index 20b23cd..edb49c8 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -43,6 +43,13 @@ jobs: repository: nextcloud/server ref: master + - name: Checkout AppAPI + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + with: + path: apps/app_api + repository: nextcloud/app_api + ref: main + - name: Checkout Test Deploy uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 with: From 1bab7d10b25bca197e45a88558af721c99b028b5 Mon Sep 17 00:00:00 2001 From: Oleksandr Piskun Date: Fri, 18 Sep 2026 08:53:06 +0000 Subject: [PATCH 3/3] ci: deploy the image built from the checkout The workflow deployed the published image, so Dockerfile changes were never exercised before a release. It now builds the CPU image and maps ghcr.io to local for the daemon, and the log check names the assertion that failed. Signed-off-by: Oleksandr Piskun --- .github/workflows/test-deploy.yml | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test-deploy.yml b/.github/workflows/test-deploy.yml index edb49c8..f24a22f 100644 --- a/.github/workflows/test-deploy.yml +++ b/.github/workflows/test-deploy.yml @@ -79,10 +79,18 @@ jobs: ./occ config:system:set debug --value=true --type=boolean ./occ app:enable --force app_api + - name: Build image + run: | + IMAGE="$(php -r '$d = simplexml_load_file($argv[1])->{"external-app"}->{"docker-install"}; echo $d->registry . "/" . $d->image . ":" . $d->{"image-tag"};' apps/${{ env.APP_NAME }}/appinfo/info.xml)" + echo "Building $IMAGE" + docker build --build-arg BUILD_TYPE=cpu -t "$IMAGE" apps/${{ env.APP_NAME }} + - name: Test deploy run: | PHP_CLI_SERVER_WORKERS=2 php -S 127.0.0.1:8080 & ./occ app_api:daemon:register docker_local_sock Docker docker-install http /var/run/docker.sock http://127.0.0.1:8080/index.php + # Deploy the image built above instead of pulling the published one + ./occ app_api:daemon:registry:add docker_local_sock --registry-from ghcr.io --registry-to local ./occ app_api:app:register ${{ env.APP_NAME }} docker_local_sock \ --info-xml apps/${{ env.APP_NAME }}/appinfo/info.xml ./occ app_api:app:enable ${{ env.APP_NAME }} @@ -96,11 +104,10 @@ jobs: - name: Check logs run: | - grep -q 'Started' container.log || error - grep -q 'Connect to Nextcloud was successful' container.log || error - grep -q 'enabled_handler: enabled=True' container.log || error - grep -q 'enabled_handler: enabled=False' container.log || error - grep -q 'Running on CPU' container.log || error + for expected in 'Started' 'Connect to Nextcloud was successful' \ + 'enabled_handler: enabled=True' 'enabled_handler: enabled=False' 'Running on CPU'; do + grep -q "$expected" container.log || { echo "::error::Not found in the container log: $expected"; exit 1; } + done - name: Unregister App & Daemon run: |