fix: bake APP_VERSION into image as build arg instead of runtime env

- Dockerfile: ARG/ENV APP_VERSION, copies VERSION file
- compose: passes build arg, removes runtime env var
- webui: reads VERSION file as fallback if env not set
- deploy: explicit build step with --build-arg

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -40,13 +40,13 @@ jobs:
           OUTLINE_URL=http://172.29.0.13:3000
           OUTLINE_TOKEN=${{ secrets.OUTLINE_TOKEN }}
           TS_AUTHKEY=${{ secrets.TS_AUTHKEY }}
-          APP_VERSION=${{ env.APP_VERSION }}
           EOF
 
       - name: Deploy with docker compose
         run: |
           echo "=== Deploying ${{ env.APP_VERSION }} (commit ${{ gitea.sha }}) to ${{ gitea.ref_name }} ==="
-          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up --build -d --remove-orphans
+          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" build --build-arg APP_VERSION=${{ env.APP_VERSION }}
+          docker compose -f "$COMPOSE_FILE" -p "$COMPOSE_PROJECT" up -d --remove-orphans
 
       - name: Prune dangling images
         run: docker image prune -f

Dockerfile

@@ -16,9 +16,12 @@ ENV GIT_AUTHOR_NAME=outline-sync \
 RUN git config --global user.email "sync@local" && \
     git config --global user.name "outline-sync"
 
+ARG APP_VERSION=dev
+ENV APP_VERSION=${APP_VERSION}
+
 WORKDIR /work
 
-COPY outline_sync.py webui.py entrypoint.sh ./
+COPY outline_sync.py webui.py entrypoint.sh VERSION ./
 RUN chmod +x entrypoint.sh
 
 # Initialise vault with both branches needed by outline_sync.py

docker-compose.yml

@@ -30,7 +30,10 @@ services:
       - "traefik.http.services.outline-sync.loadbalancer.server.port=8080"
 
   outline-sync-ui:
-    build: .
+    build:
+      context: .
+      args:
+        APP_VERSION: ${APP_VERSION:-dev}
     container_name: outline-sync-ui
     restart: unless-stopped
     depends_on:
@@ -39,7 +42,6 @@ services:
     environment:
       - OUTLINE_URL=${OUTLINE_URL:-http://172.29.0.13:3000}
       - OUTLINE_TOKEN=${OUTLINE_TOKEN}
-      - APP_VERSION=${APP_VERSION:-dev}
 
 volumes:
   tailscale-state:

webui.py

@@ -30,7 +30,14 @@ from pydantic import BaseModel, field_validator
 
 VAULT_DIR: Path = Path(os.environ.get("VAULT_DIR", "/vault"))
 SETTINGS_PATH: Path = Path(os.environ.get("SETTINGS_PATH", "/work/settings.json"))
-APP_VERSION: str = os.environ.get("APP_VERSION", "dev")
+def _read_version() -> str:
+    v = os.environ.get("APP_VERSION", "")
+    if v:
+        return v
+    vf = Path(__file__).parent / "VERSION"
+    return vf.read_text().strip() if vf.exists() else "dev"
+
+APP_VERSION: str = _read_version()
 
 # ---------------------------------------------------------------------------
 # App + job state