fix(docker): let the bun digest artifact be absent, not fatal

Follow-up to #11724. That PR made the bun image non-blocking and taught the manifest step to skip its tags when no digest exists — but stopped one step short: the upload still carried `if-no-files-found: error`, so an absent digest (now the *expected* outcome of a skipped bun build) failed the job anyway. Run 33030348950 shows it precisely: both arches died at `Upload bun-base digests`, after the decoupling had already done its part. The blocker had simply moved from the manifest to the upload. - bun digest uploads: `if-no-files-found: ignore` - bun digest downloads: `continue-on-error`, since the artifact may not exist base/web keep `error` on both sides — a supported image producing no digest is still a real failure that must stop the publish.
fix(docker): decouple the best-effort Bun image from the release manifest (#11724 )
2026-08-27 09:32:11 +03:00 · 2026-08-26 23:38:52 -03:00 · 2026-08-26 22:30:19 -03:00 · 2026-08-26 22:30:11 -03:00 · 2026-08-26 22:30:02 -03:00
4 changed files with 176 additions and 10 deletions
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -185,6 +185,13 @@ jobs:

      - name: Build and push BUN base platform image by digest
        id: build-bun-base
+        # Bun is a best-effort compatibility target, not a supported runtime
+        # (AGENTS.md -> Environment). Its `bun run build` has been OOM-killing on
+        # both arches; letting that sink the whole publish means the SUPPORTED
+        # runner-base / runner-web images never reach the registry either. The
+        # image is still built and pushed whenever it succeeds — only its power to
+        # block the release is removed.
+        continue-on-error: true
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
@@ -203,6 +210,13 @@ jobs:

      - name: Build and push BUN web platform image by digest
        id: build-bun-web
+        # Bun is a best-effort compatibility target, not a supported runtime
+        # (AGENTS.md -> Environment). Its `bun run build` has been OOM-killing on
+        # both arches; letting that sink the whole publish means the SUPPORTED
+        # runner-base / runner-web images never reach the registry either. The
+        # image is still built and pushed whenever it succeeds — only its power to
+        # block the release is removed.
+        continue-on-error: true
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
        with:
          context: .
@@ -230,8 +244,15 @@ jobs:
          mkdir -p /tmp/digests/base /tmp/digests/web /tmp/digests/bun-base /tmp/digests/bun-web
          touch "/tmp/digests/base/${DIGEST_BASE#sha256:}"
          touch "/tmp/digests/web/${DIGEST_WEB#sha256:}"
-          touch "/tmp/digests/bun-base/${DIGEST_BUN_BASE#sha256:}"
-          touch "/tmp/digests/bun-web/${DIGEST_BUN_WEB#sha256:}"
+          # Empty when the (non-blocking) bun build produced no image. `if` blocks,
+          # not `[ -n ] && touch`: under `set -e` a failing AND-list aborts the step,
+          # which is precisely the case being handled here.
+          if [ -n "$DIGEST_BUN_BASE" ]; then
+            touch "/tmp/digests/bun-base/${DIGEST_BUN_BASE#sha256:}"
+          fi
+          if [ -n "$DIGEST_BUN_WEB" ]; then
+            touch "/tmp/digests/bun-web/${DIGEST_BUN_WEB#sha256:}"
+          fi

      - name: Upload base digests
        uses: actions/upload-artifact@v7
@@ -254,7 +275,11 @@ jobs:
        with:
          name: digests-bun-base-${{ matrix.arch }}
          path: /tmp/digests/bun-base/*
-          if-no-files-found: error
+          # `ignore`, not `error`: the bun build is non-blocking, so an absent
+          # digest is the expected outcome of a failed/skipped bun image — the
+          # manifest step already treats these tags as optional. Leaving `error`
+          # here just relocates the blocker from the manifest to the upload.
+          if-no-files-found: ignore
          retention-days: 1

      - name: Upload bun-web digests
@@ -262,7 +287,11 @@ jobs:
        with:
          name: digests-bun-web-${{ matrix.arch }}
          path: /tmp/digests/bun-web/*
-          if-no-files-found: error
+          # `ignore`, not `error`: the bun build is non-blocking, so an absent
+          # digest is the expected outcome of a failed/skipped bun image — the
+          # manifest step already treats these tags as optional. Leaving `error`
+          # here just relocates the blocker from the manifest to the upload.
+          if-no-files-found: ignore
          retention-days: 1

  merge:
@@ -320,6 +349,9 @@ jobs:
          merge-multiple: true

      - name: Download bun-base digests
+        # Non-blocking: the bun image is best-effort, so its artifact may not
+        # exist at all. The manifest step treats these tags as optional.
+        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: digests-bun-base-*
@@ -327,6 +359,9 @@ jobs:
          merge-multiple: true

      - name: Download bun-web digests
+        # Non-blocking: the bun image is best-effort, so its artifact may not
+        # exist at all. The manifest step treats these tags as optional.
+        continue-on-error: true
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
        with:
          pattern: digests-bun-web-*
@@ -338,7 +373,7 @@ jobs:
          set -euo pipefail

          create_manifest() {
-            local image="$1" suffix="$2" dir="$3"
+            local image="$1" suffix="$2" dir="$3" optional="${4:-}"
            local tags=(-t "${image}:${VERSION}${suffix}")
            if [ "$PROMOTE_LATEST" = "true" ]; then
              tags+=(-t "${image}:latest${suffix}")
@@ -348,6 +383,10 @@ jobs:
              refs+=("${image}@sha256:$(basename "$digest_file")")
            done < <(find "$dir" -type f | sort)
            if [ "${#refs[@]}" -eq 0 ]; then
+              if [ -n "$optional" ]; then
+                echo "::warning::No image digests in $dir — skipping optional tag ${image}:${VERSION}${suffix}" >&2
+                return 0
+              fi
              echo "No image digests in $dir" >&2
              exit 1
            fi
@@ -356,15 +395,15 @@ jobs:

          create_manifest "${IMAGE_NAME}" "" /tmp/digests/base
          create_manifest "${IMAGE_NAME}" "-web" /tmp/digests/web
-          create_manifest "${IMAGE_NAME}" "-bun" /tmp/digests/bun-base
-          create_manifest "${IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web
+          create_manifest "${IMAGE_NAME}" "-bun" /tmp/digests/bun-base optional
+          create_manifest "${IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web optional

      - name: Create GHCR manifest
        run: |
          set -euo pipefail

          create_manifest() {
-            local image="$1" suffix="$2" dir="$3"
+            local image="$1" suffix="$2" dir="$3" optional="${4:-}"
            local tags=(-t "${image}:${VERSION}${suffix}")
            if [ "$PROMOTE_LATEST" = "true" ]; then
              tags+=(-t "${image}:latest${suffix}")
@@ -374,6 +413,10 @@ jobs:
              refs+=("${image}@sha256:$(basename "$digest_file")")
            done < <(find "$dir" -type f | sort)
            if [ "${#refs[@]}" -eq 0 ]; then
+              if [ -n "$optional" ]; then
+                echo "::warning::No image digests in $dir — skipping optional tag ${image}:${VERSION}${suffix}" >&2
+                return 0
+              fi
              echo "No image digests in $dir" >&2
              exit 1
            fi
@@ -382,8 +425,8 @@ jobs:

          create_manifest "${GHCR_IMAGE_NAME}" "" /tmp/digests/base
          create_manifest "${GHCR_IMAGE_NAME}" "-web" /tmp/digests/web
-          create_manifest "${GHCR_IMAGE_NAME}" "-bun" /tmp/digests/bun-base
-          create_manifest "${GHCR_IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web
+          create_manifest "${GHCR_IMAGE_NAME}" "-bun" /tmp/digests/bun-base optional
+          create_manifest "${GHCR_IMAGE_NAME}" "-web-bun" /tmp/digests/bun-web optional

      - name: Inspect image
        if: needs.prepare.outputs.version != 'main'
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -226,6 +226,28 @@ jobs:
          JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
        run: npm run build:cli

+      # `build:cli` assembles dist/ but does NOT write dist/BUILD_SHA — only
+      # `build:release` does, by calling write-build-sha.mjs. The #10427 provenance
+      # guard inside check:pack-artifact rejects an artifact with no SHA (and rejects
+      # it even under OMNIROUTE_ALLOW_CANARY_BUILD=1: what cannot be identified cannot
+      # be vouched for). Without this step the build+validate pair in this job is
+      # structurally incompatible and fails 100% of the time — the same gap that was
+      # fixed in ci.yml's Package Artifact job.
+      - name: Stamp dist/BUILD_SHA for the provenance guard (#10427)
+        if: steps.resolve.outputs.skip != 'true'
+        env:
+          OMNIROUTE_BUILD_SHA: ${{ github.sha }}
+        run: |
+          export OMNIROUTE_BUILD_SHA="${OMNIROUTE_BUILD_SHA:0:7}"
+          node scripts/build/write-build-sha.mjs
+
+      # The guard checks ancestry against origin/main by default, which is correct
+      # here (a release tag is cut from main), but the ref has to exist locally for
+      # `git merge-base` to resolve it.
+      - name: Fetch main for the provenance probe
+        if: steps.resolve.outputs.skip != 'true'
+        run: git fetch --no-tags --depth=50 origin +refs/heads/main:refs/remotes/origin/main
+
      - name: Validate npm package artifact
        if: steps.resolve.outputs.skip != 'true'
        run: npm run check:pack-artifact
--- a/.mailmap
+++ b/.mailmap
@@ -0,0 +1,40 @@
+# .mailmap — canonical author identities for git log/shortlog/blame.
+#
+# Why this file exists: between 2026-08-13 and 2026-08-26 this checkout carried a
+# `git config --local` whose user.name was one contributor's ("Xiangzhe" / @xz-dev)
+# and whose user.email was ANOTHER contributor's (@backryun). Every commit produced
+# on this machine in that window was therefore signed with @backryun's address —
+# 237 commits, all in the -0300 timezone, while @backryun's own work commits from
+# +0900 and continued normally throughout. The local override was removed on
+# 2026-08-26; this file repairs the RECORD without rewriting published history
+# (those commits live on release/v3.8.50 and release/v3.8.51, which other sessions
+# and open PRs build on — a rewrite would force-push both and orphan the v3.8.50 tag).
+#
+# Format: Canonical Name <canonical@email> Commit Name <commit@email>
+
+# --- Maintainer: several addresses used over the project's life ---
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> <diegosouza.pw@gmail.com>
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> <diegosouza.pw@outlook.com>
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> <diegosouzapw@users.noreply.github.com>
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com>
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Diego Souza <8016841+diegosouzapw@users.noreply.github.com>
+
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> <diego.souza.pw@gmail.com>
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> <souzamiriamrodrigues790@gmail.com>
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> <diego.souza@cdwasolutions.com.br>
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> <diegosouzapw@devbox.local>
+
+# --- The misattribution window: name Xiangzhe + @backryun's email, from -0300.
+# These are maintainer/session commits, NOT @backryun's contributions.
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Xiangzhe <bakryun0718@proton.me>
+diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Xiangzhe <diegosouza.pw@gmail.com>
+
+# --- Xiangzhe (@xz-dev) — a distinct contributor; keep their own work intact ---
+Xiangzhe <32761048+xz-dev@users.noreply.github.com> <xz-dev@users.noreply.github.com>
+Xiangzhe <32761048+xz-dev@users.noreply.github.com> <xiangzhedev@gmail.com>
+
+# --- @backryun's own alternate addresses (their real work, kept intact) ---
+backryun <24198422+backryun@users.noreply.github.com> <bakryun0718@proton.me>
+backryun <24198422+backryun@users.noreply.github.com> <backryun@daonlab.local>
+backryun <24198422+backryun@users.noreply.github.com> <busan011@ormbiz.co.kr>
+backryun <24198422+backryun@users.noreply.github.com> <backryun@users.noreply.github.com>
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -93,6 +93,67 @@

 _Living section — regenerated 2026-08-12 from all cycle commits (cycle open `ed2db6cb19` → tip). Bullets carry the merged PR and its author; direct pushes listed separately._

+### 📊 Release by the numbers
+
+| | |
+| --- | ---: |
+| 👥 People who contributed | **248** |
+| 📝 Commits in the cycle | **1,714** |
+| 🔀 Pull requests referenced | **1,666** |
+| 📋 Changelog entries | **1,182** |
+| 🙌 Contributors credited in entries | **256** |
+| 🤖 Automated dependency commits | 22 |
+
+**Entries by type**
+
+| Type | Count |
+| --- | ---: |
+| 🐛 Fixes | 779 |
+| ✨ Features | 169 |
+| 📚 Docs | 29 |
+| 🧹 Chore | 27 |
+| 🧪 Tests | 15 |
+| ♻️ Refactor | 5 |
+| ⚡ Performance | 3 |
+| providers | 2 |
+| 🔒 Security | 2 |
+| ⚙️ CI | 2 |
+| deps | 2 |
+| maint | 2 |
+
+### 🏆 Top 25 contributors this cycle
+
+_By commits in `ed2db6cb19..v3.8.50`, author identities consolidated via `.mailmap`. Bots excluded._
+
+| # | Contributor | Commits |
+| ---: | --- | ---: |
+| 🥇 | diegosouzapw | 738 |
+| 🥈 | backryun | 88 |
+| 🥉 | Dizzle | 66 |
+| 4 | Ravi Tharuma | 52 |
+| 5 | Markus Hartung | 48 |
+| 6 | Bob.Hou | 42 |
+| 7 | Rouzbeh† | 38 |
+| 8 | Xiangzhe | 31 |
+| 9 | Paco Cartones | 28 |
+| 10 | Nguyen Thanh Dat | 23 |
+| 11 | Aman | 22 |
+| 12 | Will Gordon | 19 |
+| 13 | 小妍儿 ✨ | 17 |
+| 14 | adevwithpurpose | 16 |
+| 15 | Andrew B. | 10 |
+| 16 | NOXX - Commiter | 10 |
+| 17 | ignamiranda | 10 |
+| 18 | Jonathan Bailey | 9 |
+| 19 | Ke Jin | 9 |
+| 20 | Austin Liu | 8 |
+| 21 | Chewji | 8 |
+| 22 | Prudhvi Vuda | 7 |
+| 23 | benzntech | 7 |
+| 24 | rinseaid | 7 |
+| 25 | stanley | 7 |
+
+
 ### ✨ New Features
 - **feat(search):** first-class X Search provider (`x-search`) on `POST /v1/search` and MCP `omniroute_x_search` using SuperGrok / xAI server-side `x_search`. Explicit provider or `search_type: "x"` only — never auto-selected for web. Reuses `xai-oauth` / `xao` / `xai` credentials. Not the X Developer Platform MCP. ([#10985](https://github.com/diegosouzapw/OmniRoute/issues/10985))
 - **feat(core):** add Layer A capability filter at router (#5696)
Author	SHA1	Message	Date
diegosouzapw	745b4c9924	fix(docker): let the bun digest artifact be absent, not fatal Follow-up to #11724. That PR made the bun image non-blocking and taught the manifest step to skip its tags when no digest exists — but stopped one step short: the upload still carried `if-no-files-found: error`, so an absent digest (now the expected outcome of a skipped bun build) failed the job anyway. Run 33030348950 shows it precisely: both arches died at `Upload bun-base digests`, after the decoupling had already done its part. The blocker had simply moved from the manifest to the upload. - bun digest uploads: `if-no-files-found: ignore` - bun digest downloads: `continue-on-error`, since the artifact may not exist base/web keep `error` on both sides — a supported image producing no digest is still a real failure that must stop the publish.	2026-08-26 23:38:52 -03:00
Diego Rodrigues de Sa e Souza	aa52351113	fix(docker): decouple the best-effort Bun image from the release manifest (#11724 ) The v3.8.50 Docker publish failed on both arches with: process "/bin/sh -c bun run --quiet build" ... cannot allocate memory Only Dockerfile.bun failed. The SUPPORTED images built fine — runner-base in 16m03 (amd64) / 14m13 (arm64), runner-web in 3m15 / 1m31 — yet none of them reached the registry, because one best-effort target sank the whole workflow. AGENTS.md is explicit that Bun is a compatibility path and NOT a supported runtime. Giving it the power to block the release inverts that: the runtime users actually run stayed unpublished so an experimental one could fail loudly. The Bun image is still built and still pushed on every run — it only stops being a release blocker: - both Bun build steps are `continue-on-error` - the digest files are only created when a digest actually exists - `create_manifest` takes an `optional` flag: an empty digest dir now warns and skips that tag instead of exiting 1. base/web stay hard-fail, so a real regression in a supported image still stops the publish. Applied to both the Docker Hub and GHCR manifest steps. One trap worth naming: the digest guard uses `if` blocks rather than `[ -n "$X" ] && touch ...`. Under `set -euo pipefail` a failing AND-list aborts the step — which is exactly the empty-digest case this is meant to handle, so the terse form would have swapped one blocker for another.	2026-08-26 22:30:19 -03:00
Diego Rodrigues de Sa e Souza	8778ea7d18	fix(ci): stamp dist/BUILD_SHA before the npm publish provenance gate (#11721 ) The publish job builds with `build:cli`, which assembles dist/ but does not write dist/BUILD_SHA — only `build:release` does, via write-build-sha.mjs. The #10427 provenance guard inside check:pack-artifact then rejects the artifact for having no SHA, so the build+validate pair in this job could never pass: [provenance] dist/BUILD_SHA is missing — the artifact cannot be traced to a commit. This is the same structural gap that was fixed in ci.yml's Package Artifact job earlier in the v3.8.50 cycle; npm-publish.yml carried it too and it only became visible now that the job finally got past the runner's disk exhaustion. Stamp from github.sha (on a release event that is the tag commit, which is on main) and fetch origin/main so the ancestry probe can resolve the ref that the guard checks against by default.	2026-08-26 22:30:11 -03:00
Diego Rodrigues de Sa e Souza	c44c0a29e8	docs(changelog): add consolidated v3.8.50 stats, top-25 ranking and a .mailmap (#11715 ) Two things, and the second is the reason the first is trustworthy. .mailmap: between 2026-08-13 and 2026-08-26 this checkout carried a `git config --local` pairing one contributor's name (Xiangzhe / @xz-dev) with ANOTHER contributor's email (@backryun). 237 commits made here were therefore signed with @backryun's address. The timezone split is unambiguous: @backryun's own work commits from +0900 throughout the window and never stopped, while all 237 came from -0300, this machine. No repository file sets that address, so it was a local config mix-up, not anything in the codebase. The local override is now removed; the global identity was correct all along. History is NOT rewritten: those commits live on release/v3.8.50 and release/v3.8.51, which open PRs and other sessions build on, and the v3.8.50 tag was cut from that line. .mailmap repairs the record for log/shortlog/blame — the git-native answer for exactly this — without a force-push. main is unaffected: releases squash-merge, so it carries none of the 237. Stats: counts measured, not estimated — 1,714 commits and 248 people over ed2db6cb19..v3.8.50, 1,666 distinct PR refs, and the 1,182 changelog entries broken down by type. The top-25 ranking uses the consolidated identities, so @backryun keeps their 88 real cycle commits and the misattributed 68 return to the maintainer.	2026-08-26 22:30:02 -03:00