revert(webapp): drop cross-build asset carry-forward from Docker images

Mixing assets from two builds in one image adds too much debugging
complexity. Stale clients during a deploy window are covered by the
client-side recovery reload; a longer-term fix (serving /build from
object storage with retention) can be designed separately.

Author: kathiekiwi

.github/workflows/publish-webapp.yml

@@ -113,27 +113,6 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: 🔎 Resolve previous image for asset carry-forward
-        id: prev_image
-        # Previous image whose /build assets the Dockerfile carries forward.
-        # Prefer the tag being published (mutable tags still point at the
-        # previous build here); for fresh immutable/semver tags fall back to
-        # `latest` (the previous release — its users hold the stale HTML),
-        # then `main`. If nothing exists the Dockerfile default makes the
-        # carry-forward a no-op.
-        run: |
-          for candidate in "${IMAGE_REPO}:${TAG}" "${IMAGE_REPO}:latest" "${IMAGE_REPO}:main"; do
-            if docker manifest inspect "$candidate" >/dev/null 2>&1; then
-              echo "prev_image=${candidate}" >> "$GITHUB_OUTPUT"
-              echo "Using previous image: ${candidate}"
-              exit 0
-            fi
-          done
-          echo "No previous image found; asset carry-forward will be a no-op"
-        env:
-          IMAGE_REPO: ${{ steps.set_tags.outputs.image_repo }}
-          TAG: ${{ steps.get_tag.outputs.tag }}
-
       - name: 🐳 Build image and push to GitHub Container Registry
         id: build_push
         uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.18.0
@@ -151,7 +130,6 @@ jobs:
             SENTRY_RELEASE=${{ steps.set_build_info.outputs.BUILD_GIT_SHA }}
             SENTRY_ORG=triggerdev
             SENTRY_PROJECT=trigger-cloud
-            PREV_IMAGE=${{ steps.prev_image.outputs.prev_image || 'builder' }}
           secrets: |
             sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
 

.server-changes/stale-deploy-asset-recovery.md

@@ -3,4 +3,4 @@ area: webapp
 type: fix
 ---
 
-Fix intermittent unstyled/broken pages during rolling deploys, caused by stale HTML requesting `/build` asset hashes that 404 on the new image. Docker images now carry forward the previous image's `/build` assets (`PREV_IMAGE` build arg, no-op for forks/self-hosted, 14-day retention), documents default to `Cache-Control: no-cache`, and an inline script reloads the page (max twice) when a `/build` asset fails to load.
+Fix intermittent unstyled/broken pages during rolling deploys, caused by stale HTML requesting `/build` asset hashes that 404 on the new image. Documents now default to `Cache-Control: no-cache` so browsers always revalidate HTML, and an inline script reloads the page (max twice) when a `/build` asset fails to load.

docker/Dockerfile

@@ -1,7 +1,4 @@
 ARG NODE_IMAGE=node:22.23.1-bookworm-slim@sha256:813a7480f28fdadac1f7f5c824bcdad435b5bc1322a5968bbbdef8d058f9dff4
-# Previously published image whose /build assets are carried forward so
-# stale clients survive a rolling deploy. Default (builder) is a no-op.
-ARG PREV_IMAGE=builder
 
 FROM golang:1.26-alpine AS goose_builder
 RUN go install github.com/pressly/goose/v3/cmd/goose@v3.27.1
@@ -77,9 +74,6 @@ RUN --mount=type=secret,id=sentry_auth_token \
     SENTRY_AUTH_TOKEN=$(cat /run/secrets/sentry_auth_token) \
     pnpm run build --filter=webapp...
 
-# Previous release's hashed browser assets (see PREV_IMAGE above).
-FROM ${PREV_IMAGE} AS prev-assets
-
 # Runner
 FROM ${NODE_IMAGE} AS runner
 RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends openssl netcat-openbsd ca-certificates && rm -rf /var/lib/apt/lists/*
@@ -93,22 +87,7 @@ COPY --from=production-deps --chown=node:node /triggerdotdev .
 COPY --from=dev-deps --chown=node:node /triggerdotdev/internal-packages/database/generated ./internal-packages/database/generated
 COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/build/server.js ./apps/webapp/build/server.js
 COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/build ./apps/webapp/build
-# Previous assets, pruned to a 14-day window (COPY keeps mtimes), then the
-# current build on top. Pruning BEFORE the overlay means the current build's
-# assets can never be deleted, whatever mtimes the builder produces — a
-# broken prune can only mean slow image growth, never a broken image.
-COPY --from=prev-assets --chown=node:node /triggerdotdev/apps/webapp/public/build ./apps/webapp/public/build
-RUN find ./apps/webapp/public/build -type f -mtime +14 -delete \
-    && find ./apps/webapp/public/build -type d -empty -delete
 COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/public ./apps/webapp/public
-# Guard against silent retention failure (e.g. a builder that stops
-# preserving mtimes, making the prune a no-op): fail the build loudly if the
-# carried-forward window grows past a size no healthy 14-day window can reach.
-RUN size_mb=$(du -sm ./apps/webapp/public/build | cut -f1) \
-    && if [ "$size_mb" -gt 1024 ]; then \
-         echo "public/build is ${size_mb}MB (>1024MB): asset carry-forward is not being pruned" >&2; \
-         exit 1; \
-       fi
 COPY --from=builder --chown=node:node /triggerdotdev/scripts ./scripts
 
 # Goose and schemas