helpdesk's after_migrate hook downloads the tagger, punkt_tab and brown
corpora when they are missing from the container. The image now holds
them, so a boot runs migrate without a network download.
Co-authored-by: Hanzo Dev <[email protected]>
Frappe refuses the telemetry switch to guests, so a guest opening the
Help Center no longer sends a request that answers 403.
Co-authored-by: Hanzo Dev <[email protected]>
gunicorn runs frappe.app with /assets and /files served in process, two
gthread workers as frappe_docker runs it. The Werkzeug debugger and
reloader are no longer in the request path. Frappe resolves the site from
the Host header.
Co-authored-by: Hanzo Dev <[email protected]>
The Frappe core (hanzoai/frappe) and telephony are fetched by commit from
GitHub, and helpdesk comes from the build context, so the build needs no
credential and the image holds exactly the commit it is named for.
hanzo.yml declares the amd64 image for the shared ci workflow, which the
develop push lane now calls at its .github path; the docker-action lane and
its GitHub notice are gone.
Co-authored-by: Hanzo Dev <[email protected]>
The build ended at ghcr.io/hanzoai/helpdesk:sha-<sha7> and stopped. A sha cannot
be read, ordered, or rolled back to by a human, and nothing moved the universe
pin afterward, so every build since 1.26.6 published bytes production had no way
to reach.
The next patch now comes from the REGISTRY, not from `git tag`: what is
published is the only authority on what has been used, and the tag is proven
unused (a 404 manifest probe) before anything is pushed. After the image is
proven to resolve, the run reads UNIVERSE_PIN_TOKEN from KMS and calls
charts/app/pin.sh, which resolves the tag and digest in one registry read and
refuses a non-semver version, an unpullable image, a rollback, or a repository
the caller chose.
The service is `help` — pin.sh resolves values/*/<service>.yaml and reads
image.repository out of the file it finds. Tags here are bare x.y.z, no leading
v, so the match is anchored to keep `stable`, `main` and `sha-*` out of the
ordering.
Still one build per commit: /hanzo.yml declares no `images:` on purpose, and
bench keeps its forge credential for the Frappe core clone.
The desk SPA's titles, marks and install icons come from this repo's own
source, so they change here: the shell title and apple title, the PWA
manifest name, the sidebar and welcome-ticket copy, the fallback logo
component, the SPA favicon and the 180/192/512 install icons.
The login page, navbar, footer and favicon are rendered by the Frappe core,
which reads those marks from Website Settings / Navbar Settings / System
Settings at run time. helpdesk/brand.py writes them and the entrypoint runs
it per site on every boot, next to the SSO setup. Each field is set to a
constant and guarded on the field existing, so a boot against a site that
already exists restores the same values instead of failing.
The marks are served from this app's own public directory
(helpdesk/public -> /assets/helpdesk), so no page reaches a third-party host
for a logo.
