fix(web): stamp the service worker with a per-build id so PWA updates surface

The SW is bundled by a custom esbuild step with no build manifest, so public/sw.js was byte-identical across builds unless sw.ts itself changed. The browser fetches /sw.js (no-store), byte-compares to the installed worker, finds it identical, and never installs a new one — so the 'waiting' event never fires, SwUpdateNotice never shows, and users stay frozen on their first-installed SW (stale app shell + style).

build:sw now runs scripts/build-sw.mjs, which injects a per-build id (SW_BUILD_ID env / git SHA / timestamp) via esbuild define; sw.ts weaves it into the app-shell cache name so the bytes change every deploy. CI passes the commit SHA as a build arg (Dockerfile ARG before the build busts the layer cache; turbo build task tracks SW_BUILD_ID). Verified: distinct ids produce distinct sw.js.

Author: Medformatik

.github/workflows/docker.yml

@@ -129,6 +129,10 @@ jobs:
           context: ${{ steps.ctx.outputs.context }}
           file: ${{ steps.ctx.outputs.dockerfile }}
           platforms: linux/amd64
+          # Stamp the web service worker with the commit SHA so each deploy
+          # produces a fresh sw.js and the PWA's update prompt fires. Ignored by
+          # the other images (their Dockerfiles declare no such ARG).
+          build-args: ${{ matrix.app == 'web' && format('SW_BUILD_ID={0}', github.sha) || '' }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

apps/web/Dockerfile

@@ -59,6 +59,12 @@ ENV NEXT_PUBLIC_API_URL=__NEXT_PUBLIC_API_URL__
 ENV NEXT_TELEMETRY_DISABLED=1
 
 WORKDIR /app/apps/web
+# Per-build service-worker id (CI passes the git SHA). Declared right before the
+# build so a new value busts this layer's cache and `build:sw` re-stamps sw.js,
+# letting the PWA detect the update. Defaults to empty for plain `docker build`,
+# in which case build-sw.mjs falls back to the git SHA / a timestamp.
+ARG SW_BUILD_ID=
+ENV SW_BUILD_ID=$SW_BUILD_ID
 RUN pnpm build
 
 # Production image

apps/web/package.json

@@ -8,7 +8,7 @@
     "build": "next build && pnpm build:sw && pnpm build:copy-assets",
     "build:runtime": "node scripts/build-runtime-modules.mjs",
     "build:licenses": "node --experimental-strip-types --no-warnings=ExperimentalWarning scripts/generate-license-notices.mjs",
-    "build:sw": "esbuild src/sw.ts --bundle --outfile=public/sw.js --format=iife --platform=browser --define:process.env.NODE_ENV='\"production\"'",
+    "build:sw": "node scripts/build-sw.mjs",
     "build:copy-assets": "mkdir -p .next/standalone/apps/web/public .next/standalone/apps/web/.next/static && cp -R public/. .next/standalone/apps/web/public/ && cp -R .next/static/. .next/standalone/apps/web/.next/static/",
     "start": "node .next/standalone/apps/web/server.js",
     "check-types": "pnpm build:licenses && tsc --noEmit && tsc --noEmit -p tsconfig.sw.json",

apps/web/scripts/build-sw.mjs

@@ -0,0 +1,43 @@
+// Bundles the service worker (src/sw.ts -> public/sw.js) and stamps it with a
+// per-build id via esbuild `define`. Without a build-varying value the output is
+// byte-identical across builds, so browsers never see a "new" service worker and
+// the in-app "update available" prompt (SwUpdateNotice) never fires. The id is
+// woven into the app-shell cache name in sw.ts, so it must change every deploy.
+//
+// Source of the id, in priority order:
+//   1. SW_BUILD_ID env var (CI passes the git SHA as a Docker build arg)
+//   2. the local git short SHA (dev builds)
+//   3. a timestamp fallback (no env, no git)
+import { execFileSync } from "node:child_process";
+import { build } from "esbuild";
+
+export function resolveSwBuildId(env = process.env) {
+  const fromEnv = (env.SW_BUILD_ID ?? "").trim();
+  if (fromEnv) return fromEnv;
+  try {
+    // Fixed argv, no shell — nothing interpolated.
+    return execFileSync("git", ["rev-parse", "--short", "HEAD"], {
+      stdio: ["ignore", "pipe", "ignore"],
+    })
+      .toString()
+      .trim();
+  } catch {
+    return `dev-${Date.now()}`;
+  }
+}
+
+if (process.argv[1]?.endsWith("build-sw.mjs")) {
+  const buildId = resolveSwBuildId();
+  await build({
+    entryPoints: ["src/sw.ts"],
+    bundle: true,
+    outfile: "public/sw.js",
+    format: "iife",
+    platform: "browser",
+    define: {
+      "process.env.NODE_ENV": '"production"',
+      __SW_BUILD_ID__: JSON.stringify(buildId),
+    },
+  });
+  console.log(`[build:sw] public/sw.js built (build id: ${buildId})`);
+}

apps/web/src/sw.ts

@@ -50,9 +50,16 @@ declare global {
   }
 }
 
+// Replaced at build time by scripts/build-sw.mjs (esbuild `define`) with a
+// per-build id. Weaving it into the app-shell cache name below makes sw.js's
+// bytes change every deploy, so the browser detects a new worker and
+// SwUpdateNotice can surface the "update available" prompt — without it the
+// custom esbuild output is identical across builds and updates never fire.
+declare const __SW_BUILD_ID__: string;
+
 const OFFLINE_URL = "/offline";
 const HOME_URL = "/";
-const APP_SHELL_CACHE = "app-shell-v1";
+const APP_SHELL_CACHE = `app-shell-${__SW_BUILD_ID__}`;
 // `/` is precached so a user with downloaded offline areas can still reach
 // the map after the runtime `pages` cache has expired (24h / 20 entries).
 // Without this, the nav handler would fall through to /offline and the

turbo.json

@@ -5,7 +5,8 @@
     "build": {
       "dependsOn": ["^build"],
       "inputs": ["$TURBO_DEFAULT$", ".env*"],
-      "outputs": [".next/**", "!.next/cache/**", "dist/**", "build/**"]
+      "outputs": [".next/**", "!.next/cache/**", "dist/**", "build/**"],
+      "env": ["SW_BUILD_ID"]
     },
     "lint": {
       "dependsOn": ["^lint"]