Add an updater-first script for 2.x → 3.x Compose upgrades - #1224
Conversation
Orange Update recreates Core before the sidecar, which is unsafe for the first DuckDB hop. Give operators a curl-able script that backs up, pins ftw-updater to a published tag, checks /capabilities, then moves Core. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_056bcd2a-bfb7-4943-b0bd-de3807651197) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
brand-cleanup treats new forty-two-watts copy as unclassified. Migrated installs may still use that service name, and the script must detect it without guessing when both names exist. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_75f02a41-1f94-4a3d-8ab6-d77f92b152f0) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 42da9f2d8c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| else | ||
| core_may_have_opened_data=true |
There was a problem hiding this comment.
If the script is interrupted or another command fails during the first 120 seconds after compose up succeeds, core_may_have_opened_data is still false and the EXIT trap recreates the old 2.x Core. The new Core can open and migrate persistent state within seconds, well before /api/status becomes ready, so this rollback can run the old binary against already-migrated data—the exact image/data mismatch this script is intended to prevent. Treat data as potentially opened immediately after a successful recreation, and only permit rollback after conclusively detecting the preflight refusal that occurs before state is opened.
Useful? React with 👍 / 👎.
| [ "$data_mount_type" = bind ] || die "the /app/data mount must be a host bind" | ||
| [ -d "$data_mount_source" ] || die "the /app/data source does not exist: $data_mount_source" | ||
| expected_data_source="$(cd "$data_mount_source" && pwd -P)" |
There was a problem hiding this comment.
When the current Compose configuration no longer matches the running container—for example after moving the installation directory, changing an override, or supplying the wrong --dir—this path is derived only from docker compose config. The script then backs up that possibly inactive directory and force-recreates the existing project against it, making the site appear to lose its real configuration and history while claiming the backup is valid. Inspect the running Core's /app/data mount and require it to equal this resolved source before changing either container.
Useful? React with 👍 / 👎.
2 participants
Problem and result
Orange Update is not a safe 2.x → 3.x path. It recreates Core only; the sidecar replaces itself after Core is healthy. The first DuckDB hop needs the new updater already running (
docs/self-update.md, #1164, #1223).People who want 3.x had SSH runbook fragments and no one-liner. This adds
scripts/upgrade-paired-release.shand docs/upgrade-paired-release.md: verified.ftwbak, pinftw-updaterto a published tag, requireGET /capabilities, then move Core to the same tag.Until this merges, the raw script URL is the branch, not
master.Scope and safety
ghcr.io/srcfl/ftwandFTW_*_IMAGE_TAG. Olderfrahlg/layouts stay onupgrade-from-legacy.md.latest/beta/v3.2.0-beta.1.preserve_core_on_readiness_failure.update ftw-updater firstbefore it can have opened data, previous Core is restored and the new updater stays. A long DuckDB wait does not image-rollback.No overlapping open PRs on these files.
Verification
bash scripts/test-upgrade-paired-release.sh— refuses aliases andv3.2.0-beta.1; updater pull/recreate happens before Core; missing/capabilitiesdoes not pull Core;.envcomments and unrelated keys survive.bash .github/scripts/test-change-classifier.shNot run on a physical 2.14 box in this PR. Hardware: SSH to a 2.14 site, USB
--backup-dir,--tagof a publishedv3.2.1-beta.1+release, thendocker compose images//api/health//api/status.Checklist