ci: bundle puppeteer-core in every official self-host release image

[JSONbored]

Summary

• Part of the visual-capture convergence epic (Epic: extend automated visual-capture convergence (#577) to self-host + metagraphed #3607). release-selfhost.yml's release build never passed --build-arg INSTALL_VISUAL_REVIEW=true, so puppeteer-core has never been installed in any officially published self-host image — a self-hoster who wants the automated before/after screenshot capture has had to build a custom image from the Dockerfile themselves, undocumented, to get a dependency the feature otherwise fully supports at runtime.
• Adds INSTALL_VISUAL_REVIEW=true to the release build-args, so every future official image ships with puppeteer-core installed. This changes nothing about default RUNTIME behavior — the feature stays fully gated by BROWSER_WS_ENDPOINT + GITTENSORY_REVIEW_SCREENSHOTS=true, both still unset by default. A self-hoster who never sets those two still gets a byte-identical, inert deploy; one who does can now just flip the runtime flags instead of also needing a custom image build.
• Updated the Dockerfile and docker-compose.yml comments accordingly — the ARG INSTALL_VISUAL_REVIEW=false default is unchanged (still correct for a bare docker build . with no build-arg, e.g. a local/custom build), only the official release build's own build-args changed.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• No single open issue this PR alone resolves. This is the image-level prerequisite for Enable + validate automated visual capture end-to-end for metagraphed #3611's "flag enabled on edge-us-01" deliverable (enable + validate visual capture end-to-end for metagraphed) — Enable + validate automated visual capture end-to-end for metagraphed #3611 also needs a real validated PR and a week of production observation before it's done, so this PR doesn't close it by itself. Part of the parent epic Epic: extend automated visual-capture convergence (#577) to self-host + metagraphed #3607.

Validation

• git diff --check
• npm run actionlint — clean
• npm run typecheck — clean (no src/** changes; workflow/Dockerfile/compose only)
• Verified the resolved YAML directly (yaml.safe_load on the workflow file) to confirm build-args parses to exactly GITTENSORY_VERSION=...\nINSTALL_VISUAL_REVIEW=true\n with no stray content — a build-args: | block scalar treats every line as literal string content, including #-prefixed ones, so an inline explanatory comment inside it would have been silently embedded in the actual build-arg string rather than treated as a YAML comment; caught this while drafting and moved the comment above the key instead.
• docker-compose.yml re-validated as parseable YAML after the comment-only edit.
• Not run: test:coverage/test:workers/ui:* (no src/, test/, or apps/ files touched) and npm audit (no dependency manifest changed) — none apply to a workflow/Dockerfile/compose-comment-only change.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• N/A — no auth/cookie/CORS/GitHub App/Cloudflare/session changes.
• N/A — no API/OpenAPI/MCP surface touched.
• N/A — no UI changes.
• N/A — no docs/changelog changes needed (this is the docs-equivalent comment update itself).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.71%. Comparing base (b8a1ba4) to head (9ae2616).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4143   +/-   ##
=======================================
  Coverage   93.71%   93.71%           
=======================================
  Files         385      385           
  Lines       36209    36209           
  Branches    13266    13266           
=======================================
  Hits        33934    33934           
  Misses       1618     1618           
  Partials      657      657           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-08 07:52:13 UTC}

3 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This adds `INSTALL_VISUAL_REVIEW=true` to the official release build-args in `.github/workflows/release-selfhost.yml` so puppeteer-core is installed in every published self-host image, plus matching comment updates in the Dockerfile and docker-compose.yml. The change is narrowly scoped to a single build-arg plus documentation-only comment edits; the `ARG INSTALL_VISUAL_REVIEW=false` default for bare/local `docker build .` is correctly left unchanged, and the feature remains fully gated at runtime by `BROWSER_WS_ENDPOINT` + `GITTENSORY_REVIEW_SCREENSHOTS=true`. Both changed non-workflow files (Dockerfile, docker-compose.yml) show comment-only diffs with no logic changes, and CI is green on this commit.

Nits — 5 non-blocking

• The PR description calls the default (flags-unset) deploy 'byte-identical' to before, but it isn't — puppeteer-core is now actually installed in every official image (adding real size/dependency surface), it's just functionally inert; worth rewording to 'functionally identical' to avoid future confusion when someone diffs image layers.
• Neither the PR description nor the Dockerfile/workflow comments quantify the image-size cost of always installing puppeteer-core@​22.13.1 in the official image now, which is relevant given the repo's own docs (docs.self-hosting-release-checklist) track image size deltas closely — consider noting the measured delta.
• The PR's own scope checklist leaves 'closes an eligible open issue' unchecked, relying instead on linking parent epic Epic: extend automated visual-capture convergence (#577) to self-host + metagraphed #3607 and forward-referencing Enable + validate automated visual capture end-to-end for metagraphed #3611; worth an explicit maintainer note confirming this satisfies the issue-linkage bar for this repo rather than leaving it implicit.
• Consider adding the measured image-size delta (before/after this change) to the PR description, mirroring the precedent set in apps/gittensory-ui/src/routes/docs.self-hosting-release-checklist.tsx which tracks this exact metric for INSTALL_AI_CLIS.
• If a future PR revisits the full/minimal image-variant question referenced in the self-hosting-release-checklist doc, this PR's puppeteer-core-always-on default should be re-evaluated alongside it.

Concerns raised — review before merging

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 52 registered-repo PR(s), 43 merged, 496 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 52 PR(s), 496 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
• Official Gittensor activity: 52 PR(s), 496 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review