release: prepare v1.0.4

.github/workflows/proxy-ci.yml

@@ -134,15 +134,6 @@ jobs:
         with:
           files: dist/*.tar.gz
           generate_release_notes: true
-          body: |
-            GeoDock ${{ github.ref_name }}
-
-            - First stable public release package.
-            - Unified package: proxy, local runtime, bootstrap, status, and QA scripts.
-            - Modes: proxy, local, hybrid, failback.
-            - Public CI: YAML, shell, Python, Compose, proxy smoke, and release package checks.
-            - GHCR images: geodock-proxy and geodock-runtime.
-            - Long prod-like gate remains documented as an operator-run qualification.
 
   publish-ghcr:
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## [1.0.4] - 2026-07-09
+
+### Changed
+
+- Update the proxy base image from nginx 1.31.0 to 1.31.2.
+- Update the GitHub Actions checkout action from v6 to v7.
+- Pin the upstream `gpf-geocodeur` runtime source to an immutable commit for reproducible GHCR builds.
+- Generate release notes without repeating the first-release announcement.
+
+[1.0.4]: https://github.com/jbjardine/GeoDock/compare/v1.0.3...v1.0.4

runtime/Dockerfile.gpf-geocodeur

@@ -4,7 +4,7 @@ FROM redis:8.4-bookworm AS redis
 FROM python:3.11-slim-bookworm
 
 ARG GEOCODER_GIT_URL=https://github.com/Geoplateforme/gpf-geocodeur.git
-ARG GEOCODER_GIT_REF=main
+ARG GEOCODER_GIT_REF=da0f365d4a0bcac5371b4962769abc17bfcd8cef
 
 ENV PYTHONUNBUFFERED=1 \
     DEBIAN_FRONTEND=noninteractive \
@@ -46,7 +46,10 @@ RUN python -m ensurepip --upgrade \
 
 WORKDIR /opt
 
-RUN git clone --depth 1 --branch "${GEOCODER_GIT_REF}" "${GEOCODER_GIT_URL}" geocodeur
+RUN git init geocodeur \
+    && git -C geocodeur remote add origin "${GEOCODER_GIT_URL}" \
+    && git -C geocodeur fetch --depth 1 origin "${GEOCODER_GIT_REF}" \
+    && git -C geocodeur checkout --detach FETCH_HEAD
 
 WORKDIR /opt/geocodeur
 

scripts/release_v2.sh

@@ -15,7 +15,7 @@ rm -rf "$PKG_DIR"
 mkdir -p "$PKG_DIR" "$OUT_DIR"
 
 cp -a docker-compose.yml docker-compose.git.yml docker-compose.proxy.yml "$PKG_DIR/"
-cp -a README.md LICENSE .env.example .env.proxy.example "$PKG_DIR/"
+cp -a README.md CHANGELOG.md LICENSE .env.example .env.proxy.example "$PKG_DIR/"
 
 mkdir -p "$PKG_DIR/proxy" "$PKG_DIR/runtime" "$PKG_DIR/builder" "$PKG_DIR/scripts" "$PKG_DIR/docs/install" "$PKG_DIR/docs/ops" "$PKG_DIR/var/meta" "$PKG_DIR/var/artifacts"
 cp -a proxy/Dockerfile proxy/default.conf.template "$PKG_DIR/proxy/"

tests/test_public_release_regressions.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 from __future__ import annotations
 
+import re
 import sys
 from pathlib import Path
 
@@ -53,8 +54,40 @@ def test_manifest_error_blocks_rebuild() -> None:
     assert_true(source_error is not None and "poi/bdtopo/92" in source_error, "source-level manifest errors must fail fast")
 
 
+def test_runtime_upstream_ref_is_immutable() -> None:
+    dockerfile = (ROOT / "runtime" / "Dockerfile.gpf-geocodeur").read_text()
+    match = re.search(r"^ARG GEOCODER_GIT_REF=([0-9a-f]{40})$", dockerfile, re.MULTILINE)
+
+    assert_true(match is not None, "release images must pin the upstream geocoder to an immutable commit")
+    assert_true(
+        'fetch --depth 1 origin "${GEOCODER_GIT_REF}"' in dockerfile,
+        "the runtime checkout must support the pinned upstream commit",
+    )
+
+
+def test_release_notes_do_not_repeat_first_release_copy() -> None:
+    workflow = (ROOT / ".github" / "workflows" / "proxy-ci.yml").read_text()
+
+    assert_true(
+        "First stable public release" not in workflow,
+        "later releases must not be mislabeled as the first stable release",
+    )
+
+
+def test_release_package_contains_changelog() -> None:
+    release_script = (ROOT / "scripts" / "release_v2.sh").read_text()
+
+    assert_true(
+        "README.md CHANGELOG.md LICENSE" in release_script,
+        "the published release archive must include its changelog",
+    )
+
+
 if __name__ == "__main__":
     test_status_keeps_refresh_state_after_local_ready()
     test_status_reaches_ready_after_initial_local_start()
     test_manifest_error_blocks_rebuild()
+    test_runtime_upstream_ref_is_immutable()
+    test_release_notes_do_not_repeat_first_release_copy()
+    test_release_package_contains_changelog()
     print("ok - public release regression contracts")