oh-my-pi

services:
  # ───────────────────────────────────────────────────────────────────────────
  # roboomp orchestrator
  #
  # NOTE: `env_file:` is INTENTIONALLY ABSENT. We never want the gh-proxy's
  # PAT (`GITHUB_TOKEN` in .env) to leak into this container's environment.
  # Every variable below is an explicit allowlist; compose still reads `.env`
  # for `${VAR}` interpolation, but only the keys listed here flow into the
  # container. Adding a new secret means an explicit compose-level decision
  # about which container is allowed to see it.
  # ───────────────────────────────────────────────────────────────────────────
  robomp:
    build:
      # pi root: gives the web-builder stage access to the workspace
      # bun.lock + catalog (web/package.json refs `catalog:` versions).
      # python/robomp/data and pi-root excludes are filtered via
      # Dockerfile.robomp.dockerignore at the context root.
      context: ../..
      dockerfile: Dockerfile.robomp
      args:
# ...