feat(ci): trigger Watchtower update after image push

Automatically notify Watchtower to pull and deploy the new image
after a successful registry push.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -13,15 +13,23 @@ jobs:
       - name: Login to Gitea Registry
         uses: docker/login-action@v3
         with:
-          registry: git.schweitz.net
+          registry: git.schweitz.internal
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           push: true
+          provenance: false
+          sbom: false
           tags: |
-            git.schweitz.net/jpmschweitzer/tatlock:latest
-            git.schweitz.net/jpmschweitzer/tatlock:${{ github.ref_name }}
+            git.schweitz.internal/jpmschweitzer/tatlock:latest
+            git.schweitz.internal/jpmschweitzer/tatlock:${{ github.ref_name }}
+
+      - name: Trigger Watchtower update
+        if: success()
+        run: |
+          curl -sf -H "Authorization: Bearer ${{ secrets.WATCHTOWER_TOKEN }}" \
+            http://watchtower:8080/v1/update

CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.4] - 2025-12-14
+
+### Added
+
+- **CI**: Trigger Watchtower update after successful image push
+
+## [1.2.3] - 2025-12-14
+
+### Fixed
+
+- **CI**: Upgrade to build-push-action@v6, disable provenance and sbom for Gitea registry
+
+## [1.2.2] - 2025-12-13
+
+### Fixed
+
+- **CI**: Add `provenance: false` to docker/build-push-action to fix Gitea registry push
+
+## [1.2.1] - 2025-12-13
+
+### Changed
+
+- **Dependency slimming**: Switched from `pydantic-ai` to `pydantic-ai-slim[openai]`
+  - Removes unused LLM provider SDKs (anthropic, boto3, cohere, google-genai, groq, huggingface)
+  - Production packages: 53 (down from ~158)
+  - Production footprint: 178MB
+  - Tatlock uses Ollama via OpenAI-compatible API, so only `openai` extra is needed
+  - See `DEPENDENCY_SLIM.md` for rollback instructions
+
 ## [1.2.0] - 2025-12-13
 
 ### Added

DEPENDENCY_SLIM.md

@@ -0,0 +1,72 @@
+# Dependency Slimming: pydantic-ai → pydantic-ai-slim
+
+**Date**: 2025-12-13
+**Version**: Post v1.2.0
+
+## Change
+
+Switched from `pydantic-ai` to `pydantic-ai-slim[openai]` to reduce container image size.
+
+### Before
+```
+pydantic-ai>=1.27,<1.28
+```
+
+This installs SDKs for ALL LLM providers:
+- anthropic
+- boto3 + botocore (AWS Bedrock)
+- cohere
+- google-genai + google-auth
+- groq
+- huggingface-hub
+
+Total packages: ~158
+
+### After
+```
+pydantic-ai-slim[openai]>=1.27,<1.28
+```
+
+Only installs the OpenAI-compatible SDK. Ollama works through this interface.
+
+Expected packages: ~80-90 (significant reduction)
+
+## Why This Works
+
+Tatlock uses Ollama exclusively, which implements the OpenAI-compatible API. The code uses:
+```python
+from pydantic_ai.models.openai import OpenAIChatModel
+from pydantic_ai.providers.ollama import OllamaProvider
+
+model = OpenAIChatModel(
+    model_name=config.OLLAMA_DEFAULT_MODEL,
+    provider=OllamaProvider(base_url=f"{config.OLLAMA_HOST}/v1")
+)
+```
+
+This pattern only requires the `openai` extra, not the full pydantic-ai package.
+
+## Rollback Instructions
+
+If this change breaks things:
+
+1. Revert requirements.txt:
+```diff
+- pydantic-ai-slim[openai]>=1.27,<1.28
++ pydantic-ai>=1.27,<1.28
+```
+
+2. Reinstall dependencies:
+```bash
+pip install -r requirements.txt
+```
+
+3. Delete this file once confirmed stable.
+
+## Testing Checklist
+
+- [ ] Unit tests pass
+- [ ] Integration tests pass (with Ollama running)
+- [ ] Wakeup script e2e test passes
+- [ ] Container builds successfully
+- [ ] Container runs correctly

README.md

@@ -432,7 +432,7 @@ For LLM agent development guidelines and architectural decisions, see [AGENTS.md
 
 ## Version
 
-Current version: **1.2.0** - Phase F: Memory System (The Biographer)
+Current version: **1.2.4** - Watchtower integration
 
 ---
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "tatlock"
-version = "1.2.0"
+version = "1.2.4"
 description = "OpenAI-compatible API with Ollama backend"
 requires-python = ">=3.12"
 dependencies = []

requirements.txt

@@ -16,9 +16,10 @@ pydantic>=2.11,<2.13
 
 # AI/LLM integration
 # PydanticAI: Agent framework for using Pydantic with LLMs
-# Latest: 1.27.0 (Dec 5, 2025) - No known CVEs
-# Supports Ollama backend out of the box
-pydantic-ai>=1.27,<1.28
+# Using slim version with only openai extra (Ollama uses OpenAI-compatible API)
+# This avoids installing SDKs for anthropic, cohere, google, groq, huggingface, etc.
+# See DEPENDENCY_SLIM.md for rollback instructions if this breaks
+pydantic-ai-slim[openai]>=1.27,<1.28
 
 # HTTP client for Ollama communication
 # Latest: 0.28.1 - No known CVEs