From b76f5996dada4bff35e0b04700bd4da0cdb07e9c Mon Sep 17 00:00:00 2001
From: Gabriel Kaszewski <gabrielkaszewski@gmail.com>
Date: Sun, 25 Oct 2026 22:58:46 +0100
Subject: [PATCH] chore: dockerfile manifest guard

---
 .gitea/workflows/ci.yml                       |  2 +-
 .github/workflows/ci.yml                      |  2 +-
 Makefile                                      | 20 +++++++++++++++++--
 ...{poster_sync.rs => poster_sync_handler.rs} |  0
 4 files changed, 20 insertions(+), 4 deletions(-)
 rename crates/application/src/movies/{poster_sync.rs => poster_sync_handler.rs} (100%)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 7cb9e078..27dec2ae 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -47,4 +47,4 @@ jobs:
       # Layering guards. These live in the Makefile and were previously local-only,
       # so a PR could go green in CI while violating them.
       - name: guards
-        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-binaries-are-thin check-sqlite-is-ap-free
+        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 00020619..b42587f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
       # Layering guards. These live in the Makefile and were previously local-only,
       # so a PR could go green in CI while violating them.
       - name: guards
-        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-binaries-are-thin check-sqlite-is-ap-free
+        run: make check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
 
   docker:
     name: Build & Push Docker Image
diff --git a/Makefile b/Makefile
index 7de7a00d..b018db21 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 .DEFAULT_GOAL := check
 
-check: fmt-check clippy test test-federation-off check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-binaries-are-thin check-sqlite-is-ap-free
+check: fmt-check clippy test test-federation-off check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
 	@echo "✅ All checks passed"
 
 check-appcontext:
@@ -87,6 +87,22 @@ check-sqlite-is-ap-free:
 	fi
 	@echo "✅ sqlite crate depends on no k-ap, activitypub, or *-federation crate"
 
+check-dockerfile-manifests:
+	@members=$$(awk '/^members = \[/{f=1;next} f&&/^\]/{f=0} f' Cargo.toml | sed -n 's/^[[:space:]]*"\(.*\)",\{0,1\}[[:space:]]*$$/\1/p'); \
+	copied=$$(sed -n 's/^COPY \([^[:space:]]*\)\/Cargo\.toml[[:space:]].*/\1/p' Dockerfile | grep -v '^\(Cargo\.toml\|\.\)$$' || true); \
+	bad=""; \
+	for m in $$members; do \
+	    echo "$$copied" | grep -qx "$$m" || bad="$$bad missing-COPY:$$m"; \
+	done; \
+	for c in $$copied; do \
+	    echo "$$members" | grep -qx "$$c" || bad="$$bad not-a-member:$$c"; \
+	done; \
+	if [ -n "$$bad" ]; then \
+	    echo "❌ Dockerfile manifest COPY lines out of sync with workspace members:$$bad"; \
+	    exit 1; \
+	fi; \
+	echo "✅ Dockerfile copies a manifest for every workspace member"
+
 fmt:
 	cargo fmt
 
@@ -129,4 +145,4 @@ dev-spa:
 spa-dev:
 	@npm --prefix spa run dev
 
-.PHONY: check fmt fmt-check clippy test test-federation-off fix dev dev-stop dev-worker dev-spa spa-dev check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-binaries-are-thin check-sqlite-is-ap-free
+.PHONY: check fmt fmt-check clippy test test-federation-off fix dev dev-stop dev-worker dev-spa spa-dev check-appcontext check-handler-deps check-handler-repos check-http-adapter-deps check-federation-off-social check-sqlite-is-ap-free check-binaries-are-thin check-dockerfile-manifests
diff --git a/crates/application/src/movies/poster_sync.rs b/crates/application/src/movies/poster_sync_handler.rs
similarity index 100%
rename from crates/application/src/movies/poster_sync.rs
rename to crates/application/src/movies/poster_sync_handler.rs