fix(embed,auth): add request timeouts to GeminiEmbedder and JwksCache… #181
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: publish-image | |
| # Build the escurel-server container and publish it to the org GHCR registry | |
| # so the DataZoo Kamal substrate can deploy it (ADR-0013: "apps push their | |
| # images to the central registry"; the substrate pulls ghcr.io/datazoode/escurel | |
| # with a read token and `kamal deploy --skip-push`). Tags pushed: :main (moving) | |
| # and :<12-char-sha> (immutable, what a substrate PR pins). | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| # Only rebuild the image when something that affects the binary changes. | |
| paths: | |
| - "crates/**" | |
| - "Cargo.toml" | |
| - "Cargo.lock" | |
| - "rust-toolchain.toml" | |
| - "Dockerfile" | |
| - ".github/workflows/publish-image.yml" | |
| permissions: | |
| contents: read | |
| packages: write | |
| concurrency: | |
| group: publish-image-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| publish: | |
| name: build + push escurel-server → ghcr | |
| runs-on: ubuntu-latest | |
| # Cold bundled-DuckDB compile + thin-LTO release link is slow (~15-25 min); | |
| # give generous headroom. | |
| timeout-minutes: 75 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Log in to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Image tags (:main + :<sha>) | |
| id: tags | |
| run: | | |
| set -euo pipefail | |
| SHA="$(echo "${{ github.sha }}" | cut -c1-12)" | |
| echo "tags=ghcr.io/datazoode/escurel:main,ghcr.io/datazoode/escurel:${SHA}" >> "$GITHUB_OUTPUT" | |
| echo "::notice title=Publish::ghcr.io/datazoode/escurel :main + :${SHA}" | |
| - name: Build + push | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.tags.outputs.tags }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| provenance: false |