diff --git a/Dockerfile b/Dockerfile index 4455c65..e84b0b1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,6 +7,8 @@ # verified and cached in the zot pull-through mirror, so this layer costs nothing # extra. Only bash/sed/find/install are used here — node itself is incidental. FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build +ARG BUILD_REV=dev +ENV BUILD_REV=$BUILD_REV WORKDIR /app COPY . . RUN bash build.sh diff --git a/assets/dist/delivery-flow.svg b/assets/dist/delivery-flow.svg index 26906ff..358cf02 100644 --- a/assets/dist/delivery-flow.svg +++ b/assets/dist/delivery-flow.svg @@ -1,4 +1,4 @@ - + @@ -32,7 +32,7 @@ GitHub repo - ArgoCD: render + diff + sync + Argo CD: render + diff + sync diff --git a/nginx/default.conf b/nginx/default.conf index 179f0b3..7c44933 100644 --- a/nginx/default.conf +++ b/nginx/default.conf @@ -18,14 +18,17 @@ server { include /etc/nginx/security-headers.conf; # ---- Caching ------------------------------------------------------------- - # Scene images are content-hashed at build time → safe to cache hard. - location /assets/ { + # Everything under /assets/ is content-fingerprinted at build time -> cache hard. + # `^~` gives this prefix priority over the regex `.js` location below, so fingerprinted + # JavaScript gets the immutable policy rather than no-cache. + location ^~ /assets/ { include /etc/nginx/security-headers.conf; expires 1y; add_header Cache-Control "public, immutable" always; } - # Scripts are NOT fingerprinted yet — revalidate so a deploy actually propagates. + # Any JS OUTSIDE /assets/ (there is none today) revalidates; fingerprinted app JS is + # handled immutably by the ^~ /assets/ block above. location ~* \.js$ { include /etc/nginx/security-headers.conf; add_header Cache-Control "no-cache" always; diff --git a/pilot/arc.tpl.html b/pilot/arc.tpl.html index 20519eb..c5cf0e4 100644 --- a/pilot/arc.tpl.html +++ b/pilot/arc.tpl.html @@ -7,10 +7,10 @@ -