From 47d2071938e90d578e80961c379a4e7164db92ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 15 May 2026 20:53:23 +0200 Subject: [PATCH] fix(ci): wire MAXMIND_LICENSE_KEY into the build workflow and fail fast on missing secret Add a `Fetch GeoLite2 databases` step ahead of the buildx build-push so the offline GeoLite2-City + GeoLite2-ASN MMDB files land in `assets/geolite2/` before the Dockerfile COPY at line 78 reads the directory. The step exports `MAXMIND_LICENSE_KEY` from the repo secrets and fails the workflow with a clear error when the secret is unset, matching the Coolify auto-deploy gate shape from v1.4.26 P6-3 so the missing-secret state can no longer ship as a silent no-op offline tier. --- .github/workflows/docker-publish.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index c327d1d30..f4e6dcf1b 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -98,6 +98,26 @@ jobs: org.opencontainers.image.licenses=AGPL-3.0-only org.opencontainers.image.source=https://github.com/${{ github.repository }} + # v1.4.27 B3 — GeoLite2-City + GeoLite2-ASN databases are too large + # (~80 MB combined) to vendor in git. `scripts/fetch-geolite2.sh` + # downloads both editions into `assets/geolite2/` so the Dockerfile + # COPY at line 78 picks them up. Without the secret the script + # would silently exit 0, the COPY would land an empty directory, + # and the runtime resolver in `src/lib/geo.ts` would fall back to + # the online `ipwho.is` provider — i.e. the offline geo feature + # would ship dead. Fail fast instead so the missing-secret state + # is visible on the next release run, the same shape the Coolify + # auto-deploy step (line 246) adopted in v1.4.26 P6-3. + - name: Fetch GeoLite2 databases + env: + MAXMIND_LICENSE_KEY: ${{ secrets.MAXMIND_LICENSE_KEY }} + run: | + if [ -z "$MAXMIND_LICENSE_KEY" ]; then + echo "::error::MAXMIND_LICENSE_KEY secret is missing. Set it under repo Settings → Secrets and variables → Actions → Secrets so the offline GeoLite2 databases land in the image. Without it the runtime resolver falls back to the online ipwho.is provider and the offline geo feature ships dead." + exit 1 + fi + ./scripts/fetch-geolite2.sh + # Per-ref + per-platform gha cache scope. Tag builds warm-start # off main's last good layer set for the same platform; tag and # main builds at the same SHA do not contend on writes, and