Release 2.3.0.0202: version-tagged images, changelog

- Drone: an image-tags step writes .tags (latest, commit SHA, changelog
  version) for the master publish, so each release can be pulled and
  rolled back by version. The master publish step no longer hardcodes tags.
- Version 2.2.0.0201 -> 2.3.0.0202 in xteve.go and changelog-beta.md, with
  a changelog entry covering the improvements branch.
- README / README-DEV describe the version tag.

.drone.yml

@@ -51,6 +51,22 @@ steps:
       event:
         - pull_request
 
+  # plugins/docker reads its tag list from a .tags file when no "tags"
+  # setting is given. Master images get latest, the commit SHA and the
+  # release version from changelog-beta.md, so a release can be pulled by name.
+  - name: image-tags
+    image: cache.coadcorp.com/library/golang:1.27.1
+    commands:
+      - XTEVE_VERSION="$(grep -m1 '^#### ' changelog-beta.md | cut -d' ' -f2 | sed 's/-beta$//')"
+      - test -n "$XTEVE_VERSION"
+      - printf '%s' "latest,${DRONE_COMMIT_SHA},$XTEVE_VERSION" > .tags
+      - cat .tags
+    when:
+      event:
+        - push
+      branch:
+        - master
+
   - name: docker-publish
     image: plugins/docker
     environment:
@@ -63,9 +79,6 @@ steps:
       username: nathan
       password:
         from_secret: registry_password
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA}
       build_args:
         - TARGETOS=linux
         - TARGETARCH=amd64

README-DEV.md

@@ -53,7 +53,7 @@ Add `-dev` to serve the web interface from the local `html/` directory instead o
 
 The version lives in two places that must agree: `var Version` in `xteve.go` and the first `#### ` heading in `changelog-beta.md` (without the `-beta` suffix). CI fails on drift.
 
-Drone (`.drone.yml`) runs vet, tests, the bundle check, hadolint and compose validation on every push. Pushes to `master` publish `registry.coadcorp.com/nathan/xteve:latest` and `:<sha>`; other branches publish `:<branch>` and `:<sha>`.
+Drone (`.drone.yml`) runs vet, tests, the bundle check, hadolint and compose validation on every push. Pushes to `master` publish `registry.coadcorp.com/nathan/xteve:latest`, `:<version>` and `:<sha>`; other branches publish `:<branch>` and `:<sha>`.
 
 ## Endpoints useful for operations
 

README.md

@@ -74,7 +74,7 @@ registry.coadcorp.com/nathan/xteve
 
 Tags:
 
-* `latest` and `<commit sha>` from the `master` branch.
+* `latest`, the release version (for example `2.3.0.0202`) and `<commit sha>` from the `master` branch. Pin the version tag if you want to control when you upgrade, or to roll back.
 * `<branch name>` and `<commit sha>` from every other branch.
 
 ```bash

changelog-beta.md

@@ -1,3 +1,20 @@
+#### 2.3.0.0202-beta
+```diff
++ Security: provider-supplied text is rendered as text in the web UI; websocket requests must come from the same origin; the session cookie is HttpOnly and SameSite=Strict; logo uploads, backup restores, the ffmpeg/VLC path and stream URLs are validated; backups can only be downloaded with a web session.
++ Passwords are stored with bcrypt. Existing accounts are upgraded on their next login.
++ Streaming: buffer state rewritten around a single lock with an atomic tuner limit; ffmpeg/VLC are stopped when the last client leaves or when no data arrives within 20 seconds; long streams no longer accumulate open handles.
++ Per-playlist buffer choice (default, none, xTeVe, FFmpeg, VLC) in the playlist dialog.
++ New filter type: regular expression.
++ Web UI: one persistent websocket with automatic reconnect, light theme following the OS setting, focus is kept when the menu refreshes, errors are announced to screen readers.
++ The web interface is embedded with go:embed and built from a pinned TypeScript toolchain; the language file is gone (English only).
++ New /healthz endpoint, used by the container healthcheck.
++ Container: PUID/PGID are applied at start-up; ffmpeg 9.0.2; images are also tagged with the release version.
++ Settings and other state files are written atomically; settings.json is readable by the owner only.
++ HTTP server and provider downloads have timeouts.
+- Removed the built-in self-updater. Updates are delivered through the container image.
+- Removed XTEVE_UID/XTEVE_GID as the documented variables (still accepted as a fallback for PUID/PGID).
+```
+
 #### 2.2.0.0201-beta
 Add UI enhancement for range selecting checkboxes
 

tasks/todo.md

@@ -47,7 +47,7 @@ Status: all phases done on branch `improvements` (2026-09-26). Open: the `agent.
 - [x] i18n dropped: 254 placeholders inlined, `en.json` deleted, only HTML pages templated (`authenticationErr`)
 - [x] `package.json` + `ts/tsconfig.json` (tsc 5.9.3, ES2020, single outFile `html/js/app.js`, committed, CI-verified); 10 dead JS files deleted; 6 tsc errors fixed incl. a real ASI bug in the search shortcut
 - [x] CI: vet, gofmt check, staticcheck v0.8.1 (config in `staticcheck.conf`), bundle freshness check. `go test -race` still to add once tests exist
-- [ ] Version-tagged images (amd64 only)
+- [x] Version-tagged images: master publishes `latest`, the commit SHA and the changelog version via a `.tags` file (amd64 only)
 - [x] PUID/PGID via su-exec at runtime; static-ffmpeg pinned to 7.1.1; `VOLUME /xteve/config`; `/xteve` removed from `LEGACY_CONFIG_DIRS`; compose files pull from the registry and document SSDP/host networking
 - [x] `/healthz` endpoint; Dockerfile healthcheck uses it
 - [x] `README-DEV.md` and fork-specific `README.md` (about, container usage, env vars, security notes)

xteve.go

@@ -23,7 +23,7 @@ const Name = "xTeVe"
 
 // Version : Version, die Build Nummer wird in der main func geparst.
 // Can be overwritten at build time: -ldflags "-X main.Version=..."
-var Version = "2.2.0.0201"
+var Version = "2.3.0.0202"
 
 // DBVersion : Datanbank Version
 const DBVersion = "2.1.0"