Switch to datastar-pro and stop tracking downloaded libs

Datastar-pro is fetched from a private Gitea repo (ryan/vendor-libs)
using VENDOR_TOKEN for CI/Docker builds, with a local fallback from
../optional/ for development. DaisyUI is pinned to v5.5.19 instead of
tracking latest. Downloaded files are now gitignored and fetched at
build time via 'task download', which is a dependency of both build
and live tasks.

.env.example

@@ -11,6 +11,10 @@
 # PORT=7331
 
 # Goose CLI migration config (only needed for running goose manually)
+# Gitea API token for downloading datastar-pro from private repo (CI/Docker only).
+# Not needed for local dev — falls back to copying from ../optional/.
+# VENDOR_TOKEN=
+
 GOOSE_DRIVER=sqlite3
 GOOSE_DBSTRING=data/games.db?_pragma=foreign_keys(1)&_pragma=journal_mode(WAL)
 GOOSE_MIGRATION_DIR=db/migrations

.gitea/workflows/deploy.yml

@@ -61,11 +61,13 @@ jobs:
           mkdir -p $DEPLOY_DIR/data
 
       - name: Rebuild and restart
+        env:
+          VENDOR_TOKEN: ${{ secrets.VENDOR_TOKEN }}
         run: |
           cd $DEPLOY_DIR
           VERSION=$(git describe --tags --always)
           COMMIT=$(git rev-parse --short HEAD)
-          VERSION=$VERSION COMMIT=$COMMIT docker compose up -d --build --remove-orphans
+          VERSION=$VERSION COMMIT=$COMMIT VENDOR_TOKEN=$VENDOR_TOKEN docker compose up -d --build --remove-orphans
 
       - name: Prune unused images
         run: docker image prune -f

.gitignore

@@ -27,6 +27,10 @@
 *_templ.go
 assets/css/output.css
 
+# Downloaded client-side libs (fetched by cmd/downloader)
+assets/js/datastar/*
+assets/css/daisyui/*
+
 # Deploy scripts and configs
 !deploy/*.sh
 !deploy/*.service

Dockerfile

@@ -10,6 +10,11 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
+
+RUN --mount=type=secret,id=vendor_token \
+    VENDOR_TOKEN=$(cat /run/secrets/vendor_token) \
+    go run cmd/downloader/main.go
+
 RUN go tool templ generate
 RUN go tool gotailwind -i assets/css/input.css -o assets/css/output.css --minify
 RUN --mount=type=cache,target=/root/.cache/go-build \

Taskfile.yml

@@ -2,9 +2,12 @@ version: "3"
 
 tasks:
   download:
-    desc: Download latest client-side libs
+    desc: Download pinned client-side libs
     cmds:
       - go run cmd/downloader/main.go
+    status:
+      - test -f assets/js/datastar/datastar.js
+      - test -f assets/css/daisyui/daisyui.js
 
   build:templ:
     desc: Compile .templ files to Go
@@ -31,6 +34,7 @@ tasks:
     cmds:
       - go build -o bin/games .
     deps:
+      - download
       - build:templ
       - build:styles
 
@@ -58,6 +62,7 @@ tasks:
   live:
     desc: Dev mode with hot-reload
     deps:
+      - download
       - live:templ
       - live:styles
       - live:server

assets/css/input.css

@@ -1,8 +1,8 @@
 @import 'tailwindcss';
 
-@source not "./daisyui{,*}.mjs";
+@source not "./daisyui/daisyui{,*}.js";
-@plugin "./daisyui.mjs";
+@plugin "./daisyui/daisyui.js";
-@plugin "./daisyui-theme.mjs" {
+@plugin "./daisyui/daisyui-theme.js" {
   name: "stealth";
   default: true;
   color-scheme: light;

assets/js/README.md

@@ -0,0 +1 @@
+Downloaded by cmd/downloader at build time.

cmd/downloader/main.go

@@ -1,30 +1,20 @@
 package main
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"sync"
-)
 
-// Asset directories, relative to project root.
+	"github.com/ryanhamamura/games/assets"
-const (
-	jsDir  = "assets/js"
-	cssDir = "assets/css"
 )
 
-// files maps download URLs to local destination paths.
-var files = map[string]string{
-	"https://raw.githubusercontent.com/starfederation/datastar/main/bundles/datastar.js":     jsDir + "/datastar.js",
-	"https://raw.githubusercontent.com/starfederation/datastar/main/bundles/datastar.js.map": jsDir + "/datastar.js.map",
-	"https://github.com/saadeghi/daisyui/releases/latest/download/daisyui.mjs":               cssDir + "/daisyui.mjs",
-	"https://github.com/saadeghi/daisyui/releases/latest/download/daisyui-theme.mjs":         cssDir + "/daisyui-theme.mjs",
-}
-
 func main() {
 	if err := run(); err != nil {
 		slog.Error("failure", "error", err)
@@ -32,16 +22,243 @@ func main() {
 	}
 }
 
+// Pinned dependency versions — update these to upgrade.
+const (
+	datastarVersion = "v1.0.0-RC.8" // Pro build — fetched from private Gitea repo
+	daisyuiVersion  = "v5.5.19"
+)
+
+// dependencies tracks pinned versions alongside their GitHub coordinates
+// so the version check can look up the latest release for each.
+var dependencies = []dependency{
+	{name: "datastar", owner: "starfederation", repo: "datastar", pinnedVersion: datastarVersion},
+	{name: "daisyui", owner: "saadeghi", repo: "daisyui", pinnedVersion: daisyuiVersion},
+}
+
+type dependency struct {
+	name          string
+	owner         string
+	repo          string
+	pinnedVersion string
+}
+
+// datastar-pro sources, in order of preference.
+const (
+	giteaRawURL       = "https://gitea.adriatica.io/ryan/vendor-libs/raw/branch/main/datastar/datastar.js"
+	localFallbackPath = "../optional/web/resources/static/datastar/datastar.js"
+)
+
 func run() error {
-	dirs := []string{jsDir, cssDir}
+	jsDir := assets.DirectoryPath + "/js/datastar"
+	cssDir := assets.DirectoryPath + "/css/daisyui"
 
-	for _, dir := range dirs {
+	daisyuiBase := "https://github.com/saadeghi/daisyui/releases/download/" + daisyuiVersion + "/"
-		if err := os.MkdirAll(dir, 0755); err != nil {
+
-			return fmt.Errorf("create directory %s: %w", dir, err)
+	downloads := map[string]string{
-		}
+		daisyuiBase + "daisyui.js":       cssDir + "/daisyui.js",
+		daisyuiBase + "daisyui-theme.js": cssDir + "/daisyui-theme.js",
 	}
 
-	return download(files)
+	directories := []string{jsDir, cssDir}
+
+	if err := removeDirectories(directories); err != nil {
+		return err
+	}
+
+	if err := createDirectories(directories); err != nil {
+		return err
+	}
+
+	if err := acquireDatastar(jsDir + "/datastar.js"); err != nil {
+		return err
+	}
+
+	if err := download(downloads); err != nil {
+		return err
+	}
+
+	checkForUpdates()
+
+	return nil
+}
+
+// acquireDatastar fetches datastar-pro from the private Gitea repo when
+// GITEA_TOKEN is set, otherwise copies from the local optional project.
+func acquireDatastar(dest string) error {
+	if token := os.Getenv("VENDOR_TOKEN"); token != "" {
+		slog.Info("downloading datastar-pro from private repo...")
+		return downloadWithAuth(giteaRawURL, dest, token)
+	}
+
+	slog.Info("copying datastar-pro from local fallback...", "src", localFallbackPath)
+	return copyFile(localFallbackPath, dest)
+}
+
+func copyFile(src, dest string) error {
+	in, err := os.Open(src) //nolint:gosec // paths are hardcoded constants
+	if err != nil {
+		return fmt.Errorf("open %s: %w", src, err)
+	}
+	defer in.Close() //nolint:errcheck
+
+	out, err := os.Create(dest) //nolint:gosec // paths are hardcoded constants
+	if err != nil {
+		return fmt.Errorf("create %s: %w", dest, err)
+	}
+
+	if _, err := io.Copy(out, in); err != nil {
+		out.Close() //nolint:errcheck
+		return fmt.Errorf("copy to %s: %w", dest, err)
+	}
+
+	if err := out.Close(); err != nil {
+		return fmt.Errorf("close %s: %w", dest, err)
+	}
+
+	return nil
+}
+
+func downloadWithAuth(rawURL, dest, token string) error {
+	req, err := http.NewRequest(http.MethodGet, rawURL, nil)
+	if err != nil {
+		return fmt.Errorf("create request for %s: %w", rawURL, err)
+	}
+	req.Header.Set("Authorization", "token "+token)
+
+	resp, err := http.DefaultClient.Do(req) //nolint:gosec // URL is built from compile-time constants
+	if err != nil {
+		return fmt.Errorf("GET %s: %w", rawURL, err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("GET %s: status %s", rawURL, resp.Status)
+	}
+
+	out, err := os.Create(dest) //nolint:gosec // paths are hardcoded constants
+	if err != nil {
+		return fmt.Errorf("create %s: %w", dest, err)
+	}
+
+	if _, err := io.Copy(out, resp.Body); err != nil {
+		out.Close() //nolint:errcheck
+		return fmt.Errorf("write %s: %w", dest, err)
+	}
+
+	if err := out.Close(); err != nil {
+		return fmt.Errorf("close %s: %w", dest, err)
+	}
+
+	return nil
+}
+
+// checkForUpdates queries the GitHub releases API for each dependency
+// and logs a notice if a newer version is available. Failures are
+// logged but never cause the download to fail.
+func checkForUpdates() {
+	var wg sync.WaitGroup
+
+	for _, dep := range dependencies {
+		wg.Go(func() {
+			latest, err := latestGitHubRelease(dep.owner, dep.repo)
+			if err != nil {
+				slog.Warn("could not check for updates", "dependency", dep.name, "error", err)
+				return
+			}
+
+			if latest != dep.pinnedVersion {
+				slog.Warn("newer version available",
+					"dependency", dep.name,
+					"pinned", dep.pinnedVersion,
+					"latest", latest,
+				)
+			}
+		})
+	}
+
+	wg.Wait()
+}
+
+// githubRelease is the minimal subset of the GitHub releases API response we need.
+type githubRelease struct {
+	TagName string `json:"tag_name"`
+}
+
+func latestGitHubRelease(owner, repo string) (string, error) {
+	u := &url.URL{
+		Scheme: "https",
+		Host:   "api.github.com",
+		Path:   fmt.Sprintf("/repos/%s/%s/releases/latest", owner, repo),
+	}
+
+	req, err := http.NewRequest(http.MethodGet, u.String(), nil)
+	if err != nil {
+		return "", fmt.Errorf("creating request: %w", err)
+	}
+	req.Header.Set("Accept", "application/vnd.github+json")
+
+	resp, err := http.DefaultClient.Do(req) //nolint:gosec
+	if err != nil {
+		return "", fmt.Errorf("fetching release: %w", err)
+	}
+	defer resp.Body.Close() //nolint:errcheck
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("unexpected status %s", resp.Status)
+	}
+
+	var release githubRelease
+	if err := json.NewDecoder(resp.Body).Decode(&release); err != nil {
+		return "", fmt.Errorf("decoding response: %w", err)
+	}
+
+	return release.TagName, nil
+}
+
+func removeDirectories(dirs []string) error {
+	var wg sync.WaitGroup
+	errCh := make(chan error, len(dirs))
+
+	for _, path := range dirs {
+		wg.Go(func() {
+			if err := os.RemoveAll(path); err != nil {
+				errCh <- fmt.Errorf("remove directory %s: %w", path, err)
+			}
+		})
+	}
+
+	wg.Wait()
+	close(errCh)
+
+	var errs []error
+	for err := range errCh {
+		errs = append(errs, err)
+	}
+
+	return errors.Join(errs...)
+}
+
+func createDirectories(dirs []string) error {
+	var wg sync.WaitGroup
+	errCh := make(chan error, len(dirs))
+
+	for _, path := range dirs {
+		wg.Go(func() {
+			if err := os.MkdirAll(path, 0755); err != nil {
+				errCh <- fmt.Errorf("create directory %s: %w", path, err)
+			}
+		})
+	}
+
+	wg.Wait()
+	close(errCh)
+
+	var errs []error
+	for err := range errCh {
+		errs = append(errs, err)
+	}
+
+	return errors.Join(errs...)
 }
 
 func download(files map[string]string) error {
@@ -71,15 +288,15 @@ func download(files map[string]string) error {
 	return errors.Join(errs...)
 }
 
-func downloadFile(url, dest string) error {
+func downloadFile(rawURL, dest string) error {
-	resp, err := http.Get(url) //nolint:gosec,noctx // static URLs, simple tool
+	resp, err := http.Get(rawURL) //nolint:gosec,noctx // static URLs, simple tool
 	if err != nil {
-		return fmt.Errorf("GET %s: %w", url, err)
+		return fmt.Errorf("GET %s: %w", rawURL, err)
 	}
 	defer resp.Body.Close() //nolint:errcheck
 
 	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("GET %s: status %s", url, resp.Status)
+		return fmt.Errorf("GET %s: status %s", rawURL, resp.Status)
 	}
 
 	out, err := os.Create(dest) //nolint:gosec // paths are hardcoded constants

docker-compose.yml

@@ -5,6 +5,8 @@ services:
       args:
         VERSION: ${VERSION:-dev}
         COMMIT: ${COMMIT:-unknown}
+      secrets:
+        - vendor_token
     container_name: games
     restart: unless-stopped
     ports:
@@ -16,3 +18,7 @@ services:
       - PORT=8080
     volumes:
       - ./data:/data
+
+secrets:
+  vendor_token:
+    environment: VENDOR_TOKEN

features/common/layouts/base.templ

@@ -12,7 +12,7 @@ templ Base(title string) {
 		<head>
 			<title>{ title }</title>
 			<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"/>
-			<script defer type="module" src={ assets.StaticPath("js/datastar.js") }></script>
+			<script defer type="module" src={ assets.StaticPath("js/datastar/datastar.js") }></script>
 			<link href={ assets.StaticPath("css/output.css") } rel="stylesheet" type="text/css"/>
 		</head>
 		<body class="flex flex-col h-screen">