[jamesmulcahy]

Adds pull request checks for the parts of the repo CI didn't cover yet: the Django code, the Docker image, the generated protobuf code and the React components. With #388 (Django tests) and #392 (MQTTManager tests), every part of the repo is now checked on each pull request. Each check is its own commit, so any of them can be dropped.

The checks have already paid for themselves. While they were being written they found 11 broken call sites in the Django views, and three .proto changes (#385, #394, #405) whose firmware C code was never regenerated. All of these are fixed here, and every check passes on this branch.

Checks

Workflow	Runs on changes to	Fails when
Django checks (django-checks.yml)	docker/web/, docker/ruff.toml	ruff finds an undefined name or syntax error (F821, E9); manage.py check reports a problem; a model change has no migration (makemigrations --check)
Docker build (docker-build.yml)	docker/	The release image doesn't build. Pull requests and pushes build amd64 and aarch64. A weekly run, which can also be started by hand, adds armv7, armhf and i386. Nothing is pushed.
Protobuf (protobuf.yml)	.proto files, generated code, conanfile.py, requirements.txt	The committed C++, Python or firmware C code differs from what compile_all.sh generates; or protoc, the Conan package and the Python package aren't the same protobuf release
React components (react-components.yml)	web/react-components/	tsc -b or vite build fails, or the committed dist/ and templates/scripts.html differ from a fresh build. ESLint runs but doesn't fail the job yet.

All four run on pull requests and on pushes to main, devel and beta.

Regenerating protobuf code

docker/protobuf/regenerate.sh is new. It regenerates all the committed protobuf code in a throwaway Ubuntu container and needs only Docker. Before, the only way was the full dev container, which takes a Conan build to create. The protobuf check runs the same script, so when it fails, its error message says to run regenerate.sh and commit the result, and that fixes it.

Fixes found by the checks

• Undefined names (ruff F821), 11 of them:
  • Feat first page react #391 removed the NSPanelRoomEntitiesPages component, but ten htmx views still built one to render their response. Each raised NameError and returned 500. Nothing in the templates, static JS or React code calls them any more, so this removes them, their routes, and handle_entity_modal_result, which only dispatched to one of them.
  • scenes_post looked up lights through a Light model that no longer exists, so POST /rest/scenes failed for any request with light states. It now looks them up in Entity, filtered to lights.
• Firmware protobuf code regenerated for volume_step (Home Assistant media players and album art for NSPanels #385), buzzer sounds (Send per-event buzzer sounds to panels in NSPanelConfig #394) and tz_posix (Send NSPanels the POSIX TZ rule for the manager's timezone #405).

Other changes

• docker/ruff.toml lists its rules. It never set select, so the rules came from whichever ruff was installed: 0.8 reports 102 findings, 0.16 reports 394. It now lists ruff's long-standing defaults (E4, E7, E9, F) and excludes the generated migrations and protobuf modules. CI pins ruff 0.16.10. 82 findings remain, mostly unused imports, so for now only F821 and E9 fail the build. The rest can be cleaned up in a later pass.
• Faster Docker builds. The release build compiles every Conan dependency from source, which takes about an hour. The Conan package cache is now a BuildKit cache mount, and CI keeps it between runs (actions/cache with buildkit-cache-dance, one cache per architecture). Local rebuilds reuse the packages too. Cold builds, including releases, work as before. A new push to a pull request cancels that pull request's running image build.
• Choosing which Web UI to build. A new WEB_UI_REF build argument picks the NSPanelManager-Web-UI branch, tag or commit to build, e.g. --build-arg WEB_UI_REF=devel. It defaults to main, so releases still ship whatever the Web UI's main holds.
• compile_all.sh's output directories can be set from the environment, with the same defaults as before.

Current state

• The committed React build and the generated C++/Python protobuf code match a fresh build exactly. There are no missing migrations, and manage.py check passes.
• bun.lock is out of date: it's missing every runtime dependency added since May, and bun install --frozen-lockfile fails. package-lock.json matches package.json, so CI installs with npm ci.
• ESLint reports 30 errors, mostly no-explicit-any and react-refresh/only-export-components. Once those are fixed, it can be made blocking.

Notes

• Required checks. All the workflows use paths: filters. If any of them becomes a required check, a pull request that doesn't touch those paths will wait for it forever.
• Docker build cache. The first build on each architecture fills the Conan cache, which takes about an hour. Builds after that reuse it.

🤖 Generated with Claude Code

[tpanajott]

I've been thinking about this. Maybe it wouldn't be bad to build a nightly release if things has changed for developers to more easily test things out before release. Especially now with conan caching I see this as a possibility. Really nice work, thanks a ton!

[jamesmulcahy]

Thank you! A nightly build would be a neat thing to build on top of this. With the Conan cache in place it should be cheap enough to only build when devel has changed, and it would make it much easier for people to try things out before a release.

[tpanajott]

Do you know of any better library than protc? As protc has some limitations and it's stuck on an old version of protobuf and no longer seems maintained. Some things aren't implemented, such as "optional" and it makes it so that we have to manually control "has_*" flags in the protobuf and cannot update protobuf generally to get bug fixes and other things.

[tpanajott]

This to me looks a bit malformed, --mount=type=cache should probably be mount --type=cache?

[jamesmulcahy]

Thanks for looking at this closely! It does look unusual, but this one is valid as written. --mount is a flag on the RUN instruction itself, part of BuildKit's Dockerfile syntax (docs). type=cache mounts /MQTTManager/conan_cache as a cache directory that persists between builds but is never included in the image, so the Conan dependencies are reused instead of being rebuilt each time.

BuildKit is the default builder in current Docker, and CI builds with docker/setup-buildx-action + docker/build-push-action. buildkit-cache-dance moves the actions/cache copy into that same mount, which is how CI gets to reuse it between runs.