Repository navigation
Making the feed GA variant the main release - #23
Merged
Merged
Conversation
Add a runtime template patch that loads the VFB Google Analytics 4 property (G-K7DDZVVXM7) into CATMAID's catmaid/index.html and catmaid/base.html. The matching tracker on virtualflybrain.org is a direct gtag.js install, not a GTM container, so this image emits the gtag.js snippet to feed hits into the same GA4 stream. Injection is done at container start by /opt/VFB/inject_gtm.py, gated on GA_TAG_ID. The default G-K7DDZVVXM7 means VFB-hosted CATMAID instances feed the live property out of the box. Set GA_TAG_ID="" to disable, or GA_TAG_ID=G-XXXXXXXXXX to point at a staging stream. Idempotent across restarts via a VFB-GA-INJECTED marker, and refuses non-G- IDs as a defensive XSS guard. Consent gating is not applied here. The live VFB site itself currently fires gtag with anonymize_ip false and no CMP, so this image inherits that posture. Compliance is the wider Klaro rollout, not this image.
Build the image on push, PR and release events. Smoke-test it (run with the existing CM_CLIENT_SETTINGS env, sleep, curl, assert the VFB-GA-INJECTED marker is in the served HTML and the configured GA_TAG_ID appears). On push and release events, log in to Docker Hub with the VFB org-level secrets DOCKER_USERNAME and DOCKER_PASSWORD and push. Tags derived via docker/metadata-action: branch refs become :feedGA, :master, etc.; semver-shaped git tags become :1.2.3 and :1.2; PRs get their own :pr-N tag for testability without polluting :feedGA. Action versions pinned to the SHAs used by the rest of VFB (docker-vfb-neo4j-productiondb pattern). The legacy .travis.yml is left in place pending confirmation that GHA is wired up correctly.
aria2 was used for build-time dataset downloads; the feed image now restores from /backup volume in init.sh and no longer needs it. r-base kept for now (CATMAID R/NBLAST bridge, can be revisited). Also unblocks the GHA build: aria2 was likely the package failing to resolve in catmaid/catmaid-standalone:latest's aged apt sources.
Upstream catmaid/catmaid-standalone bakes the apt.postgresql.org PGDG repo. PGDG retired focal-pgdg when Ubuntu 20.04 hit standard EOL, so the Release file is gone and apt-get update aborts with 'does not have a Release file', failing the whole build. Postgres is already installed in the base image, so we don't need PGDG to be reachable at build time. Delete the PGDG source file before running update. r-base resolves fine from focal main once PGDG is out of the way.
Add DEBIAN_FRONTEND=noninteractive apt-get upgrade -y between the PGDG source removal and the r-base install so the image picks up whatever patches are still flowing into focal-updates and focal-security. Tidy the layer with apt-get clean and rm -rf /var/lib/apt/lists/*. ESM-only CVEs are not covered (no Pro token inside the build). The longer-term fix is to rebase catmaid/catmaid-standalone on jammy or noble; see the Trivy scan report for what we're inheriting from focal in the meantime.
Run aquasecurity/trivy-action against the locally loaded image between smoke test and push. CRITICAL and HIGH severities only, OS plus library packages, ignore-unfixed so the report focuses on actionable findings (CVEs that have a patch available). Exit-code 0 for now so we get the report into the build log without blocking the push. Flip to 1 once we've cleared the baseline and want to gate on regressions. Refactor: hoist the primary image tag from steps.meta.outputs.tags into GITHUB_ENV in its own step, so the smoke test and the scan step share it cleanly.
aquasecurity/trivy-action@0.28.0 turned out not to be a valid release tag (the action's release line didn't match my guess), and pinning trivy-action to a moving ref like master defeats the point of pinning. Swap to docker run aquasec/trivy:latest image instead. Aqua publishes stable versioned tags on Docker Hub; latest is fine for a report-only step. Mount the GitHub runner's user cache into trivy's so subsequent runs don't re-download the vuln DB each time. Same severity, scope and exit-code semantics as before.
Previous rm -f targeted pgdg.list and postgresql.list explicitly, but the catmaid/catmaid-standalone image stores the PGDG source under a different filename (build log still shows apt querying focal-pgdg). Switch to a find + sed -i that scans every .list and .sources file under /etc/apt and strips any line referencing apt.postgresql.org or pgdg. Filename-agnostic, idempotent, and also handles deb822 .sources files for future upstream rebases.
This image's whole purpose is to load a *.pgsql dump piped in via the /backup volume before the service comes up. CI has no such fixture and we don't want to bypass DB_FIXTURE=true (which would test a code path we never use in production). Replace the live HTTP smoke test with an entrypoint-override that runs /opt/VFB/inject_gtm.py inside the image and greps the resulting Django templates for the VFB-GA-INJECTED marker plus the configured GA_TAG_ID. Runs inject_gtm.py a second time to assert idempotency (marker count stays at one). Tests exactly the moving part this branch adds: the runtime template patch. Doesn't depend on Postgres, /backup, or any of the production DB-load behaviour, and finishes in seconds rather than the prior 120-second sleep.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.