A submission failed with HTTP 403 against a freshly published image. The
cause was not Alpine, which carries the current yt-dlp: it was the apk layer
being reused from an older build, so the image shipped a yt-dlp two months
behind while /healthz reported today's tag.
"A rebuild is the update" only holds if the layer is genuinely re-run, so
the image target now passes --pull --no-cache. Slower, and the only thing
that makes the release honest about what is inside it.
fix, image, db, backup and clean were all sitting in README.md or
docs/deployment.md as blocks to paste. The image target takes IMAGE from
the caller so no registry of mine lands in the repository, and refuses an
untagged HEAD — the version reaches the binary only through the build arg,
so an untagged build makes /healthz claim something that was never released.
run was broken: since seeding landed, starting the bare binary against an
empty database fatals on the missing admin credentials. It now passes
development defaults and binds loopback.
The README's layout section still said the source was flat at the root.
Thirty-seven entries in the root, most of them .go files. The assets had to
come along: //go:embed cannot reach outside its own directory, so
templates/, static/ and migrations/ live beside the code that embeds them,
and testdata/ beside the test that reads it. storage/ stays put — runtime
data, not source.
go build now needs -o. Without it the output would be named after the
package directory and collide with src/ itself.
Verifying a change meant four invocations — gofmt, go vet, go build, go
test — and remembering the order. `make` is all of them with one exit code.
gofmt needs the wrapper: it reports offending files on stdout and still
exits 0, so a bare `gofmt -l .` in a target would never fail the build.
Esa Kataja