From a1ec0e482bd80bbd8b6447b043595b299c7cff4d Mon Sep 17 00:00:00 2001
From: Claude <claude@local>
Date: Sun, 8 Mar 2026 11:58:14 +0100
Subject: [PATCH] fix: bake APP_VERSION into image as build arg instead of
 runtime env

- Dockerfile: ARG/ENV APP_VERSION, copies VERSION file
- compose: passes build arg, removes runtime env var
- webui: reads VERSION file as fallback if env not set
- deploy: explicit build step with --build-arg

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .gitea/workflows/deploy.yml | 4 ++--
 Dockerfile                  | 5 ++++-
 docker-compose.yml          | 6 ++++--
 webui.py                    | 9 ++++++++-
 4 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index 1927280..98f124e 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -40,13 +40,13 @@ jobs:
           OUTLINE_URL=http://172.29.0.13:3000
           OUTLINE_TOKEN=${{ secrets.OUTLINE_TOKEN }}
           TS_AUTHKEY=${{ secrets.TS_AUTHKEY }}
-          APP_VERSION=${{ env.APP_VERSION }}
           EOF
 
       - name: Deploy with docker compose
         run: |
           echo "=== Deploying ${{ env.APP_VERSION }} (commit ${{ gitea.sha }}) to ${{ gitea.ref_name }} ==="
-          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up --build -d --remove-orphans
+          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" build --build-arg APP_VERSION=${{ env.APP_VERSION }}
+          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up -d --remove-orphans
 
       - name: Prune dangling images
         run: docker image prune -f
diff --git a/Dockerfile b/Dockerfile
index c02fdc4..c9cb2f2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,9 +16,12 @@ ENV GIT_AUTHOR_NAME=outline-sync \
 RUN git config --global user.email "sync@local" && \
     git config --global user.name "outline-sync"
 
+ARG APP_VERSION=dev
+ENV APP_VERSION=${APP_VERSION}
+
 WORKDIR /work
 
-COPY outline_sync.py webui.py entrypoint.sh ./
+COPY outline_sync.py webui.py entrypoint.sh VERSION ./
 RUN chmod +x entrypoint.sh
 
 # Initialise vault with both branches needed by outline_sync.py
diff --git a/docker-compose.yml b/docker-compose.yml
index 110b3bd..ab0de72 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -30,7 +30,10 @@ services:
       - "traefik.http.services.outline-sync.loadbalancer.server.port=8080"
 
   outline-sync-ui:
-    build: .
+    build:
+      context: .
+      args:
+        APP_VERSION: ${APP_VERSION:-dev}
     container_name: outline-sync-ui
     restart: unless-stopped
     depends_on:
@@ -39,7 +42,6 @@ services:
     environment:
       - OUTLINE_URL=${OUTLINE_URL:-http://172.29.0.13:3000}
       - OUTLINE_TOKEN=${OUTLINE_TOKEN}
-      - APP_VERSION=${APP_VERSION:-dev}
 
 volumes:
   tailscale-state:
diff --git a/webui.py b/webui.py
index d5662f6..caf30fe 100644
--- a/webui.py
+++ b/webui.py
@@ -30,7 +30,14 @@ from pydantic import BaseModel, field_validator
 
 VAULT_DIR: Path = Path(os.environ.get("VAULT_DIR", "/vault"))
 SETTINGS_PATH: Path = Path(os.environ.get("SETTINGS_PATH", "/work/settings.json"))
-APP_VERSION: str = os.environ.get("APP_VERSION", "dev")
+def _read_version() -> str:
+    v = os.environ.get("APP_VERSION", "")
+    if v:
+        return v
+    vf = Path(__file__).parent / "VERSION"
+    return vf.read_text().strip() if vf.exists() else "dev"
+
+APP_VERSION: str = _read_version()
 
 # ---------------------------------------------------------------------------
 # App + job state