Repository navigation
build: release audited Canvas trim through same-schema host path - #239
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9a5cfda82a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| COPY server/package.json server/package-lock.json server/.npmrc ./ | ||
| COPY package.json /tmp/qualified-package.json | ||
| COPY scripts/prune-pdfjs-server-runtime.mjs /tmp/prune-pdfjs-server-runtime.mjs | ||
| COPY scripts/prune-glibc-canvas-runtime.mjs /tmp/prune-glibc-canvas-runtime.mjs |
There was a problem hiding this comment.
When a later commit changes only this newly copied script, the path filters in .github/workflows/ci.yml match neither server_source nor server_docker, so computeScope schedules no server image build or publication and the pruning logic can diverge from the deployed image without its owning check. Add scripts/prune-glibc-canvas-runtime.mjs to the server image/source filter and cover that scope mapping in the CI-scope tests.
AGENTS.md reference: AGENTS.md:L27-L27
Useful? React with 👍 / 👎.
The Debian/glibc server image shipped an unused 30,315,608-byte musl Canvas binding. This integrates PR237's reviewed removal with a guarded same-schema Komodo host-file release path. Runtime remains the formally published 3.5.8; native schema13/protocol11/product48 and all48 migration checksums are unchanged.
Candidate
9a5cfda82ad105d666bf0452df1d615daf6c6a28passed exact CI 39444057773 and immutable image publication 39443966923. Independent image reconciliation passed22layers,521source paths,474runtime and379PDF files; the sole removed entry is the unused musl binary, with18retained Canvas entries unchanged. Compressed image bytes decreased205,959,232→192,937,300 (−13,021,932;−6.3226%); expanded tar decreased30,314,496bytes.Production accepted at2026-10-20T15:45:47.705Z:16/16 checks plus independent recomputation and11crosschecks. Both hosts run the exact audited image index
sha256:9c6753001d1561db46c45a00e6cbdfa2fceae304454f7da3c84c4e981ffb1b08; all4Web/Worker services are healthy with0restarts/noOOM. All36native preparation/release updates have matching terminal Complete/success receipts. Public API4/4 and HTML/JS/CSS3/3 passed. Both hosts' native Canvas/real PDF probes passed before oldWorkers stopped.359sampled readyz requests had0failures; explicit Worker drain/recovery timestamps are retained and sampling is not continuous availability proof.Application Compose source is
f70f6d46b39d65ad3c9aad2284db9c85a0cf3600, with immutable image9a5 and cache-only--no-deps --pull never; Core/environment/security/volumes remain unchanged. Contributor history is preserved. The legacy ordinary rollout remains blocked; persistent ResourceSync/ordinary-dispatch integration is not claimed complete.Full production acceptance, receipts and independent reviews.
#229 remains open for controlled cold/warm build and peak-disk measurements and broader deletion scope. Authenticated production smoke, full fault-isolation matrix and long-duration soak are not claimed; fixed3.5.3 soak was untouched. #216 content maintenance is a separately tracked operation, not implied by schema acceptance.