Skip to content

Run all tasks through docs-toolbox via build.sh - #55

Merged
dieterbaier merged 4 commits into
mainfrom
feature/docs-toolbox-task-runner
Jul 10, 2026
Merged

Run all tasks through docs-toolbox via build.sh#55
dieterbaier merged 4 commits into
mainfrom
feature/docs-toolbox-task-runner

Conversation

@dieterbaier

Copy link
Copy Markdown
Member

Summary

Makes build.sh the single entry point for every repository task and runs each task inside the docs-as-code-toolkit/docs-toolbox container image by default, with a documented local fallback. Local runs and CI now share one reproducible toolchain.

Why

Previously tasks were split across raw ruby/node invocations and a render-only build.sh, and CI installed Ruby and Node separately. The docs-toolbox image already had Ruby + Asciidoctor but lacked Node.js, so JS-based generators/tests could not run in it.

Changes

  • docs-toolbox image (separate repo, released as v1.3.1 + latest): add nodejs/npm so validators, generators, Ruby tests, JS tests, and doc builds all run in one image.
  • build.sh: dispatcher with tasks validate, generate, test, test-ruby, test-js, adapters, check-adapters, build, presentation, all, clean, help. Each task container-wraps into docs-toolbox (auto-detects Docker/Podman) and falls back to local execution otherwise. Default image → docs-toolbox:v1.3.1; override via DOCS_TOOLBOX_IMAGE.
  • CI (validate.yml, publish-docs.yml): drop setup-ruby/setup-node; run ./build.sh <task> so CI uses the same image as local.
  • Docs: new "Running tasks" section with a task table; Validation/Tests/generation instructions show ./build.sh first with the local command as fallback; architecture-core, honey-for-devs, the arc42 local-and-ci deployment doc, and the bdd-specification verification note updated.

Verification (via locally built v1.3.1 image)

Task Result
./build.sh validate Validation passed
./build.sh test Ruby 27, CLI 4, JS 4 — all green
./build.sh check-adapters adapters current
./build.sh generate fragments generated, tree clean
./build.sh build build/architecture/index.html rendered
local fallback (in-container marker) raw commands green

Out of scope

  • example/ bootstrap sample keeps its raw commands (no build.sh) — noted as a follow-up.

🤖 Generated with Claude Code

Dieter Baier and others added 2 commits July 10, 2026 12:31
Make build.sh the single entry point for every repository task and run
each task inside the docs-toolbox container image by default, with a
documented local fallback when no container engine is available.

- build.sh: dispatcher with validate, generate, test, test-ruby,
  test-js, adapters, check-adapters, build, presentation, all, clean,
  and help; container-wraps each task and falls back to local. Default
  image bumped to docs-toolbox v1.3.1 (which now ships Node.js).
- CI (validate.yml, publish-docs.yml): drop setup-ruby/setup-node and
  run ./build.sh tasks so CI uses the same image as local runs.
- Docs: add a "Running tasks" section with a task table; rewrite the
  Validation, Tests, and generation instructions to show ./build.sh
  first with the local command as fallback; update architecture-core,
  honey-for-devs, the arc42 local-and-ci deployment doc, and the
  bdd-specification verification note accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Run tasks against the docs-toolbox `latest` tag instead of a pinned
version, so the repository picks up toolbox updates without a manual
bump. Applies to both build.sh and scripts/render-presentation.sh.
Override with DOCS_TOOLBOX_IMAGE when a pinned image is required.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

Copy link
Copy Markdown
Member Author

Review

Die Grundidee ist richtig und die CI ist grün, aber ich würde den PR noch nicht mergen.

1. Blocking: latest statt der dokumentierten Version v1.3.1

Die PR-Beschreibung nennt docs-toolbox:v1.3.1 als Default, tatsächlich verwenden sowohl build.sh als auch scripts/render-presentation.sh weiterhin latest.

Damit ist die Toolchain nicht reproduzierbar: Derselbe Commit kann abhängig vom Zeitpunkt mit unterschiedlichen Werkzeugständen laufen, und eine spätere Änderung an latest kann CI oder lokale Builds ohne Änderung an diesem Repository brechen.

Bitte beide Defaults auf mindestens

DOCS_TOOLBOX_IMAGE="${DOCS_TOOLBOX_IMAGE:-ghcr.io/docs-as-code-toolkit/docs-toolbox:v1.3.1}"

setzen. Ein Digest wäre noch strikter, der semantische Tag ist hier aber pragmatisch ausreichend.

2. Blocking für native Linux-Docker-Nutzung: root-eigene Dateien

Der Container bind-mountet den Checkout, wird aber ohne User-Mapping gestartet. Da das Image standardmäßig als root läuft, können generate, adapters, build und presentation auf Linux Dateien erzeugen, die dem Benutzer anschließend nicht gehören.

Für Docker sollte mindestens --user "$(id -u):$(id -g)" plus ein beschreibbares HOME verwendet werden. Für rootless Podman ist --userns=keep-id meist die passendere Variante. Bitte engine-spezifisch behandeln und einmal verifizieren, wem erzeugte Dateien nach generate und build gehören.

3. Major: automatischer lokaler Fallback schwächt die Reproduzierbarkeitsgarantie

./build.sh test bedeutet derzeit je nach Maschine entweder Container-Ausführung oder irgendeine lokale Ruby-/Node-Installation. Auch ein nicht laufender Docker-Daemon führt stillschweigend zum lokalen Modus.

Ich würde den lokalen Modus explizit machen, z. B.:

./build.sh test
DOCS_TOOLBOX_LOCAL=1 ./build.sh test

Ohne Engine sollte der Standardmodus klar abbrechen. Falls der automatische Fallback bewusst gewollt ist, sollte die Dokumentation deutlich sagen, dass die Reproduzierbarkeitsgarantie nur im Container-Modus gilt.

4. Minor: all validiert mehrfach

all ruft zuerst validate und später build auf; build ruft wiederum generate und damit erneut die Validierung auf. Funktional korrekt, aber redundant.

Positiv

  • Ein einheitlicher Task Entry Point ist ein deutlicher Fortschritt.
  • validate und generate sind sauber getrennt.
  • Die Engine-Erkennung prüft sinnvoll, ob Docker/Podman tatsächlich läuft.
  • CI und lokale Dokumentation verwenden dieselben Task-Namen.
  • Die aktuelle CI läuft erfolgreich.

Fazit

Changes requested.

Vor dem Merge sollten mindestens das Image-Pinning und das UID/GID-Handling korrigiert werden. Den lokalen Fallback würde ich entweder explizit machen oder sprachlich klar von der reproduzierbaren Container-Ausführung abgrenzen.

Apply PR #55 review feedback:

- Reproducibility: pin the default image to docs-toolbox:v1.3.1 in both
  build.sh and scripts/render-presentation.sh instead of :latest, so the
  same commit always runs against the same toolchain. Override with
  DOCS_TOOLBOX_IMAGE (e.g. a digest) when needed.
- File ownership: run the container with user mapping so generated files
  are not root-owned on native Linux — `--user $(id -u):$(id -g)` plus a
  writable HOME on Docker, `--userns=keep-id` on rootless Podman. Applies
  to build.sh and render-presentation.sh.
- Explicit execution modes: container mode is the reproducible default;
  DOCS_TOOLBOX_LOCAL=1 opts into the host toolchain. Without a container
  engine and without that flag, tasks now abort instead of silently
  running locally.
- Remove the redundant validate pass from `all` (build already validates
  via generate); `all` now runs test, check-adapters, and build.
- Document the modes, pinning, ownership mapping, and abort behaviour in
  the README and the arc42 local-and-ci deployment doc.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
@dieterbaier

Copy link
Copy Markdown
Member Author

Danke für das Review — alle vier Punkte sind in 070152c umgesetzt (CI grün gegen das gepinnte Image).

1. Blocking — Pinning statt latest. build.sh und scripts/render-presentation.sh verwenden jetzt beide ghcr.io/docs-as-code-toolkit/docs-toolbox:v1.3.1 als Default. Über DOCS_TOOLBOX_IMAGE überschreibbar (z. B. auf einen Digest für einen noch strikteren Pin).

2. Blocking — Datei-Ownership. Der Container wird jetzt engine-spezifisch mit User-Mapping gestartet:

  • Docker: --user "$(id -u):$(id -g)" + schreibbares HOME=/tmp
  • rootless Podman: --userns=keep-id

Gilt für build.sh (generate/adapters/build) und render-presentation.sh. Verifiziert: nach ./build.sh generate gehört die erzeugte Datei dem aufrufenden User (uid 501), nicht root.

3. Major — expliziter Lokal-Modus. Container-Modus ist der reproduzierbare Default. DOCS_TOOLBOX_LOCAL=1 ./build.sh <task> opt-in für die Host-Toolchain (mit „not reproducible"-Hinweis). Ohne laufende Engine und ohne das Flag bricht der Task jetzt mit klarer Meldung ab (exit 1) statt still lokal zu laufen. README und arc42 local-and-ci-Doc grenzen die Reproduzierbarkeitsgarantie klar auf den Container-Modus ab.

4. Minor — all doppelte Validierung. all läuft jetzt test + check-adapters + build; da build über generate bereits validiert, entfällt der separate validate-Durchlauf.

Verifiziert lokal (Podman keep-id): validate/test grün, Ownership korrekt, Lokal-Modus und Abort-Pfad wie erwartet; CI grün gegen v1.3.1.

@dieterbaier dieterbaier left a comment

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-review completed: the previously raised issues are resolved.

  • The docs-toolbox image is now pinned to v1.3.1 in both build.sh and scripts/render-presentation.sh.
  • Docker and Podman now map file ownership appropriately and provide a writable HOME, avoiding root-owned generated files on native Linux.
  • Local execution through build.sh is now explicit via DOCS_TOOLBOX_LOCAL=1; without a running engine, the reproducible default mode fails clearly instead of silently falling back.
  • The redundant validation pass in all was removed.
  • CI is green for the current head.

One tiny non-blocking consistency note: scripts/render-presentation.sh still documents and performs an automatic local fallback when called directly. Since build.sh is now the declared single entry point and invokes the script from inside the container, this does not undermine the main workflow. It could be aligned later if direct script usage should follow the same explicit-local rule.

From my side this is mergeable. ✅

Make direct use of scripts/render-presentation.sh follow the same
execution-mode contract as build.sh: container is the reproducible
default, DOCS_TOOLBOX_LOCAL=1 opts into host rendering, and without a
container engine (and without that flag) it aborts instead of silently
rendering locally. Updates the usage text accordingly.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
@dieterbaier
dieterbaier merged commit 3136a15 into main Jul 10, 2026
1 check passed
dieterbaier pushed a commit that referenced this pull request Jul 10, 2026
Apply PR #55 review feedback:

- Reproducibility: pin the default image to docs-toolbox:v1.3.1 in both
  build.sh and scripts/render-presentation.sh instead of :latest, so the
  same commit always runs against the same toolchain. Override with
  DOCS_TOOLBOX_IMAGE (e.g. a digest) when needed.
- File ownership: run the container with user mapping so generated files
  are not root-owned on native Linux — `--user $(id -u):$(id -g)` plus a
  writable HOME on Docker, `--userns=keep-id` on rootless Podman. Applies
  to build.sh and render-presentation.sh.
- Explicit execution modes: container mode is the reproducible default;
  DOCS_TOOLBOX_LOCAL=1 opts into the host toolchain. Without a container
  engine and without that flag, tasks now abort instead of silently
  running locally.
- Remove the redundant validate pass from `all` (build already validates
  via generate); `all` now runs test, check-adapters, and build.
- Document the modes, pinning, ownership mapping, and abort behaviour in
  the README and the arc42 local-and-ci deployment doc.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
@dieterbaier
dieterbaier deleted the feature/docs-toolbox-task-runner branch July 10, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant