[servicememeai]

Current cross-repo defects

• Existing v2-clean.yml auto-triggers on the current V2 dev but checks an old immutable 2026-10-16 source-set, which can incorrectly look like current dev validation.
• Existing prod.yml and tools/release-dev162.sh still package legacy CE14 extensions from floating dev, although dev now belongs to V2.

Patch

• Keep historical source-set CI as explicitly manual and remove triggers referencing deleted dev2-clean.
• Add v2-dev-bundle.yml: resolve Server/Hub dev once to immutable SHA, pin checkouts, assemble selected CE14 + V2 overlays using an ephemeral source-set, test fresh three-table schema with isolated MariaDB/Redis, produce version receipt of exact SHAs.
• Add optional --source-set to native assembler; its normal fixed-source behavior remains unchanged.
• Prevent old production and dev162 legacy image scripts from running from V2 Docker dev; historical release refs remain available as archives for explicit maintenance.
• Label existing dev.yml check as shared/legacy regression; print exact commit SHAs to job summary; mark old release.yaml explicitly historical without removing backward-compatible files.

Validation

• Python 3.12 syntax and Bash syntax checks passed; all changed YAML parsed via PyYAML.
• Clean source assembly with current Server 6fc5493... and Hub remediation a2f070a... passed on the authorized build host.
• This PR does not create tables or touch running Docker/MariaDB/Redis deployments.
• Dependency: Hub PR Added variable to launcher to allow the possibility to run the script… haiwen/seafile-docker#32 must merge before the new current-V2 bundle can go green; otherwise the check correctly detects legacy Hub imports and fails.

[servicememeai]

Current review finding (2026-10-20): the new current-dev bundle job correctly locks Server/Hub SHAs, but Actions run 39367508826 is red at legacy CloudFile dependency: cloudfile_ext.sso.eap_oauth from Hub dev; this is a real dependency on Hub PR haiwen#32, not a source-set parser problem. Keep the check gating current-dev verification rather than treating the older frozen workflow as release evidence. Two follow-ups before shipping: (1) tools/release-dev162.sh blocks the old recipe only when the local symbolic branch is literally dev; detached checkouts / another branch with V2 code can bypass this guard. Prefer an explicit allowed historical maintenance ref or provenance check instead of branch-name-only protection. (2) this job proves assembly/schema, not actual C/Go object I/O; include current Server same-shard staging PR #15 in the build acceptance path and make an actual native byte/EXDEV test a separate release gate. No running instance change is implied by this PR.

Concrete source-list gap: build/v2/source-set.json currently does not list fileserver/objstore/backend_fs.go under Server native_patches. The new workflow only changes overlay commit SHAs, so after Server PR #15 merges, its Go same-shard write fix will still be omitted from the assembled source unless this file is explicitly whitelisted and verified. Keep the native-CE allowlist (do not import the whole fork), but include this exact file and a storage regression in the current-dev bundle.

[servicememeai]

2026-10-20 scoped baseline + incremental-cache corrections (review only)

This PR branch now carries two small, independent corrections on top of the existing current-dev source bundling work:

1. Default source selection: tools/prepare-v2-source.py resolves checked-out Server/Hub dev refs into immutable commit SHAs before assembly. The old pinned build/v2/source-set.json is used as a historical snapshot only when explicitly passed with --source-set; the manual historical workflow now passes that argument. Upstream CE14 native source pins and the native patch allowlist remain fixed. Builds fail rather than quietly substituting an archived CloudFile overlay.
2. Incremental native cache independence: the combined v2-source-receipt.json (which changes on Hub-only commits) no longer enters the C/Go native Docker layer. build/v2/build-image.sh checks both components' file hashes against the immutable source receipt before any Docker tags/fetch/build; the full receipt still ships inside the final runtime image. Thus Hub-only changes should reuse the native C/Go layer provided the existing BuildKit cache is intact. The current-dev source assembly additionally allowlists the Go fileserver/objstore/backend_fs.go seam so Server PR build(v2): 固定 TagBatch + RepoTags 默认不计数 + 增量 Meili Worker #15's EXDEV fix is not omitted once merged.
3. Execution restraint: the current cross-repo source-bundle workflow is now workflow_dispatch only. This review did not run C/Go/Node compilation, rebuild images, deploy, restart or roll back. Lightweight read-only source invariant checks passed; actual on-host cache-hit rates have not been measured.

Remaining blockers before merging/releasing: Hub PR haiwen#32 currently addresses the legacy OAuth import that made the earlier current-dev bundle red. Server PR #15 remains unmerged, and exact runtime storage C/Go semantics must still be verified against the same chosen SHA tuple. The actual build host's base-image IDs, BuildKit cache, ccache/Go/npm/pip directories and Gunicorn launcher must be read-only inspected before any user-approved incremental build. Do not infer a valid cache hit or a release-ready image from script structure alone.

[servicememeai]

Scoped correction review checkpoint — 2026-10-20 (updated)

This existing PR carries the focused baseline and incremental-cache corrections; it is not merged.

• Default source: tools/prepare-v2-source.py resolves Server/Hub dev refs to exact SHAs before assembly. The frozen historical source-set.json is opt-in via explicit --source-set, and the manual historical workflow now passes it.
• Incremental native cache: the combined Server+Hub receipt no longer enters the C/Go native Docker layer, so a Hub-only commit does not by itself invalidate the native compile cache. Before image operations, build/v2/build-image.sh verifies the selected source files against SHA-256 values in the assembled receipt; the final image still contains the full receipt.
• Go storage seam: current-source assembly explicitly includes fileserver/objstore/backend_fs.go, so Server PR build(v2): 固定 TagBatch + RepoTags 默认不计数 + 增量 Meili Worker #15's same-shard staging fix is not omitted once it reaches dev.
• Manual integration check: v2-dev-bundle.yml is now workflow_dispatch only. No compilation, image build, deploy, restart or rollback was started.
• Historical release isolation: prod.yml and release-dev162.sh allow the old packaging recipe only from an explicitly selected maintenance/v0.9/* ref with fixed Server/Hub commit SHAs. Docker's own checked-out SHA is recorded in the resulting build receipt; it is not required to self-reference its SHA in a tracked manifest. The old recipe cannot silently package today's floating dev.

Evidence: all 11 static source invariant checks passed; there are no automatically initiated workflow runs for the latest PR commit. This is not proof of cache hits on the actual build host or of native runtime correctness. Hub PR haiwen#32 and Server PR #15 remain independently tracked before runtime integration. Inspect the target host's base images, BuildKit/ccache/Go/npm/pip caches and launcher entry points read-only before requesting any approved incremental build.