Stop cache busting admin assets on every CI build

Author: dzarlax

.github/workflows/ci.yml

@@ -123,10 +123,6 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          # Force re-download of admin UI static assets (dzarlax design system,
-          # htmx) on every CI build so images ship with the latest main.
-          build-args: |
-            ASSETS_CACHEBUST=${{ github.sha }}
 
   release-bridge:
     name: Release Bridge Binaries

.github/workflows/docker-arm64.yml

@@ -45,5 +45,3 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha,scope=arm64
           cache-to: type=gha,mode=max,scope=arm64
-          build-args: |
-            ASSETS_CACHEBUST=${{ github.sha }}

Dockerfile

@@ -2,19 +2,13 @@ FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS builder
 
 ARG TARGETARCH
 
-# Admin UI static assets. Re-fetched on every build when ASSETS_CACHEBUST
-# differs (CI passes a timestamp / commit SHA). For local iteration, the
-# default value keeps the cached layer.
-#
-# Override for a one-off local refresh:
-#   docker build --build-arg ASSETS_CACHEBUST=$(date +%s) .
-# Pin to a commit SHA rather than @main so jsdelivr's aggressive branch-tip
-# caching can't serve a stale bundle for hours after a DS push. Bump this
-# when you want the latest DS changes; confirm the hash exists at
-# github.com/dzarlax/design-system before committing.
+# Admin UI static assets. Pin to a commit SHA rather than @main so jsdelivr's
+# aggressive branch-tip caching can't serve a stale bundle for hours after a DS
+# push. Bump DS_VERSION or HTMX_VERSION when you want to refresh these assets;
+# confirm the DS hash exists at github.com/dzarlax/design-system before
+# committing.
 ARG DS_VERSION=f36e79e50e9341ef5780fb89ec41c1f49e447811
 ARG HTMX_VERSION=2.0.3
-ARG ASSETS_CACHEBUST=pinned
 
 RUN apk add --no-cache curl
 
@@ -25,10 +19,7 @@ RUN go mod download
 
 COPY . .
 
-# Overwrite the committed placeholders with real assets. The ASSETS_CACHEBUST
-# ARG is referenced so that changing it invalidates this layer.
-RUN echo "assets cachebust: ${ASSETS_CACHEBUST}" && \
-    curl -fsSL "https://cdn.jsdelivr.net/gh/dzarlax/design-system@${DS_VERSION}/dist/dzarlax.css" \
+RUN curl -fsSL "https://cdn.jsdelivr.net/gh/dzarlax/design-system@${DS_VERSION}/dist/dzarlax.css" \
          -o internal/adminapi/static/dzarlax.css && \
     curl -fsSL "https://cdn.jsdelivr.net/gh/dzarlax/design-system@${DS_VERSION}/dist/dzarlax.js" \
          -o internal/adminapi/static/dzarlax.js && \

internal/adminapi/static/README.md

@@ -2,18 +2,11 @@
 
 These files are placeholders so `go build` works without Docker. The **real**
 assets are downloaded from upstream at Docker build time — see the `curl`
-step in the repo-root `Dockerfile` (`ARG DS_VERSION`, `ARG HTMX_VERSION`,
-`ARG ASSETS_CACHEBUST`).
+step in the repo-root `Dockerfile` (`ARG DS_VERSION`, `ARG HTMX_VERSION`).
 
-To force a refresh of the design system on your next build, pass a new
-cache-bust value:
-
-```bash
-docker build --build-arg ASSETS_CACHEBUST=$(date +%s) .
-```
-
-CI passes this automatically so every built image ships with the current
-design system `@main`.
+To refresh the design system or htmx in built images, bump `DS_VERSION` or
+`HTMX_VERSION` in `Dockerfile`. Do not use branch names such as `@main` for
+production assets; CDN edge caches can serve stale branch-tip files.
 
 Do **not** commit real builds of `dzarlax.css`, `dzarlax.js`, or
 `htmx.min.js` — they bloat diffs and go stale.