Document frontend maintenance release

2026-08-22 10:41:17 +03:00
parent ef6489549b
commit d7a7db0710
4 changed files with 32 additions and 11 deletions
@@ -7,7 +7,7 @@ This document tracks proposed WeatherTool improvements. Work should be delivered
 - **Windows development:** source editing and Git workflow only; Docker runtime testing is performed on Rocky.
 - **Rocky staging:** production-like Docker deployment at `http://192.168.1.101:9190`.
 - **Git over SSH:** Windows pushes reviewed commits to a private bare repository on Rocky; the Rocky staging checkout pulls those commits and rebuilds.
- **Temporary VPS staging:** release `16a8c68` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset.
+- **Temporary VPS staging:** release `ef64895` is publicly operational behind Cloudflare strict TLS, Nginx, and Authelia with a limited 14-day synthetic dataset.
 - **Workplace production:** remains separate until changes are reviewed, tested, and explicitly approved for workplace use.

 Do not synchronize `.env`, database directories, generated dependencies, build output, or provider credentials between machines.
@@ -73,7 +73,8 @@ The first observed frontend install reported 15 vulnerabilities: 1 critical, 10
 - [x] Replace or remove obsolete frontend packages where appropriate.
 - [x] Add a committed TypeScript typecheck command and validate the updated frontend with a clean `npm ci`, typecheck, and production build.
 - [x] Resolve the remaining transitive build-tool advisories after reviewing the proposed `npm audit fix` changes; verify full and production-only audits at zero.
- [ ] Rebuild, deploy, and visually compare every page in a commit-addressed VPS release containing `de6f279` or later. (Rocky clean-install build verification is complete.)
+- [x] Build, smoke-test, checksum, transfer, and deploy a commit-addressed VPS release containing `de6f279` or later without restarting PostgreSQL or Authelia. (`ef64895` deployed 2026-08-22.)
+- [ ] Visually compare every page and representative exported PNG in the deployed dependency-maintenance release.
 - [ ] Update Scala within the supported 2.13 line before considering larger migration.
 - [ ] Update http4s, Doobie, Circe, Cats Effect, Logback, and test libraries in compatible groups.
 - [ ] Replace release-candidate dependencies with stable releases where possible.
@@ -154,13 +155,13 @@ Status: in progress
 - [x] Provision a dedicated `/srv/weathertool` tree, Compose project, private network, database storage, and loopback-only application and Authelia ports.
 - [x] Configure Authelia with one temporary shared account, Argon2id password storage, rate limiting, and temporary IP bans.
 - [x] Add an exact-host Cloudflare origin certificate and Nginx authorization routing without disrupting the existing HOP site.
- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update the application-only service to `weathertool:16a8c68` without restarting PostgreSQL or Authelia.
+- [x] Build and verify commit-addressed images on Rocky, transfer and checksum-verify them on the VPS, and update only the application service. Current full-SHA image: `weathertool:ef6489549b990864c59a720f2ba5b25f5caaa4f1`; PostgreSQL and Authelia were not restarted.
 - [ ] Complete UAT verification: public authentication and application health pass; direct-origin blocking, logout, throttling, PNG downloads, backups, logs, and rollback remain.
 - [ ] Run the month-long user test with manual releases and record feedback before any workplace-production decision.

 ## Known current limitations

- The fixed production PNG bases and browser/social metadata are deployed in UAT release `16a8c68`; newsroom workflow validation begins with the first tester handoff on 2026-08-21.
+- The fixed production PNG bases, browser/social metadata, and reviewed frontend dependency updates are deployed in UAT release `ef64895`; newsroom workflow validation is in progress.
 - Link-preview crawlers cannot authenticate through Authelia; the final Nginx policy must deliberately expose only the minimum preview metadata/assets if WhatsApp previews are required.

 - Staging uses synthetic PostgreSQL station data.
@@ -191,3 +192,4 @@ Record completed work here by date and commit after the Git workflow is establis
 | 2026-08-20 | `754415a` | Match editable title/source overlays to production-safe right margins | Yes |
 | 2026-08-20 | `16a8c68` | Deploy approved production map bases, normalized branding assets, favicon, Apple icon, and social metadata to public UAT | Yes — Rocky build and VPS/browser smoke checks |
 | 2026-08-21 | `5007517`–`de6f279` | Update Solid runtime and frontend build tooling, add type checking, remove obsolete packages, prune the lockfile, and resolve all npm advisories | Yes — clean `npm ci`, typecheck, production build, full audit, and production-only audit |
+| 2026-08-22 | `ef64895` | Deploy the reviewed zero-advisory frontend dependency state as an immutable full-SHA VPS release while leaving PostgreSQL, Authelia, and HOP uninterrupted | Yes — isolated Rocky smoke test, dual-host checksum, matching image ID, container health, loopback, authentication-gate, and HOP checks |