The builder stage installed dependencies with --no-install-project, so no
yunjin dist-info existed in the image and importlib.metadata fell back to
the 0.0.0+unknown placeholder in the footer.

Install the project during the build so the version from pyproject.toml
lands in the venv; the code still runs from /app/src via PYTHONPATH, which
takes precedence over site-packages.

Closes #56

@@ -86,1 +86,4 @@
             .
+      - name: Smoke-test built image
+        run: |
+          EXPECTED_VERSION=$(grep -oP '^version = "\K[^"]+' pyproject.toml)

@@ -87,0 +87,4 @@
+      - name: Smoke-test built image
+        run: |
+          EXPECTED_VERSION=$(grep -oP '^version = "\K[^"]+' pyproject.toml)
+          podman run -d --name yunjin-smoke -p 18080:8080 \

@@ -87,0 +102,4 @@
+            podman logs yunjin-smoke || true
+            exit 1
+          fi
+          grep -q "Yunjin v${EXPECTED_VERSION}" /tmp/smoke-page.html || {

@@ -87,0 +114,4 @@
+            echo "/favicon.ico did not resolve to the SVG icon" >&2
+            exit 1
+          }
+          podman rm -f yunjin-smoke

@@ -14,3 +16,2 @@
 WORKDIR /build
-COPY pyproject.toml uv.lock ./
-RUN uv sync --frozen --no-dev --no-install-project
+COPY pyproject.toml uv.lock README.md ./

@@ -15,2 +17,2 @@
-COPY pyproject.toml uv.lock ./
-RUN uv sync --frozen --no-dev --no-install-project
+COPY pyproject.toml uv.lock README.md ./
+COPY src/ ./src/

@@ -16,1 +17,3 @@
-RUN uv sync --frozen --no-dev --no-install-project
+COPY pyproject.toml uv.lock README.md ./
+COPY src/ ./src/
+RUN uv sync --frozen --no-dev

@@ -138,0 +143,4 @@
+    @app.route("/favicon.ico")
+    def favicon() -> ResponseReturnValue:
+        """Redirect legacy favicon requests to the SVG icon."""
+        return redirect(url_for("static", filename="favicon.svg"))

@@ -1784,0 +1793,4 @@
+        assert response.status_code == 200
+        html = response.data.decode()
+        assert 'rel="icon"' in html
+        assert "/static/favicon.svg" in html

@@ -13,3 +11,3 @@
 
 WORKDIR /build
-COPY pyproject.toml uv.lock ./
+COPY pyproject.toml uv.lock README.md ./

@@ -16,1 +21,4 @@
+# relative to the source tree root.
 RUN uv sync --frozen --no-dev --no-install-project
+COPY src/ ./src/
+RUN uv sync --frozen --no-dev --no-editable

@@ -14,1 +14,4 @@
 
+The build installs the project's package metadata (version from
+`pyproject.toml`) alongside the locked dependencies, so the web footer
+reports the real application version — e.g. `Yunjin v2026.9.26.1` — the

@@ -1784,0 +1788,4 @@
+
+    def test_base_template_links_svg_favicon(self, client: Any) -> None:
+        """Test every page advertises the SVG favicon in the head."""
+        response = client.get("/")

@@ -1784,0 +1797,4 @@
+
+    def test_svg_favicon_is_served(self, client: Any) -> None:
+        """Test the SVG icon file is served from static."""
+        response = client.get("/static/favicon.svg")

@@ -86,1 +86,4 @@
             .
+      - name: Smoke-test built image
+        run: |
+          EXPECTED_VERSION=$(sed -n 's/^version = "\([^"]*\)"/\1/p' pyproject.toml | head -1)

@@ -87,0 +109,4 @@
+          # Cloud favicon shipped with the app.
+          favicon="$rootfs/app/src/yunjin/web/static/favicon.svg"
+          test -f "$favicon" || { echo "favicon.svg missing from image" >&2; exit 1; }
+          grep -q '<svg' "$favicon" || { echo "favicon.svg is not SVG" >&2; exit 1; }

@@ -87,0 +112,4 @@
+          grep -q '<svg' "$favicon" || { echo "favicon.svg is not SVG" >&2; exit 1; }
+          # The app must resolve from /app/src (PYTHONPATH); the venv copy of
+          # the package exists to carry version metadata, never to be imported.
+          buildah run --isolation chroot "$ctr" \

@@ -86,1 +86,4 @@
             .
+      - name: Smoke-test built image
+        run: |
+          EXPECTED_VERSION=$(awk '/^\[project\]/{inproj=1;next} /^\[/{inproj=0} inproj && /^version = /{gsub(/"/,"",$3); print $3; exit}' pyproject.toml)

@@ -87,0 +97,4 @@
+          # with chroot isolation never creates a user namespace, so the
+          # storage ops and in-chroot exec below work where podman fails.
+          ctr=$(buildah from --isolation chroot registry.marvin8.zone/marvin8/yunjin:ci)
+          trap 'buildah rm -f "$ctr" >/dev/null 2>&1 || :' EXIT

@@ -87,0 +100,4 @@
+          trap 'buildah rm -f "$ctr" >/dev/null 2>&1 || :' EXIT
+          rootfs=$(buildah mount "$ctr")
+          # Version metadata baked into the venv — the footer's source.
+          installed=$(sed -n 's/^Version: \(.*\)$/\1/p' \

@@ -87,0 +102,4 @@
+          # Version metadata baked into the venv — the footer's source.
+          installed=$(sed -n 's/^Version: \(.*\)$/\1/p' \
+            "$rootfs"/app/.venv/lib/python3.*/site-packages/yunjin-*.dist-info/METADATA | head -1)
+          if [ "$installed" != "$EXPECTED_VERSION" ]; then

@@ -87,0 +124,4 @@
+            env PYTHONPATH=/app/src python -c "import yunjin; assert yunjin.__file__ == '/app/src/yunjin/__init__.py', yunjin.__file__"
+          buildah umount "$ctr"
+          buildah rm "$ctr"
+          echo "image smoke test OK: yunjin ${EXPECTED_VERSION} with favicon"

@@ -87,0 +121,4 @@
+          # The app must resolve from /app/src (PYTHONPATH); the venv copy of
+          # the package exists to carry version metadata, never to be imported.
+          buildah run --isolation chroot "$ctr" \
+            env PYTHONPATH=/app/src python -c "import yunjin; assert yunjin.__file__ == '/app/src/yunjin/__init__.py', yunjin.__file__"

@@ -16,1 +22,4 @@
 RUN uv sync --frozen --no-dev --no-install-project
+COPY src/ ./src/
+COPY README.md ./
+RUN uv sync --frozen --no-dev --no-editable

@@ -87,0 +98,4 @@
+          # with chroot isolation never creates a user namespace, so the
+          # storage ops, in-chroot exec and the booted server below work
+          # where podman fails.
+          buildah inspect --format '{{.OCIv1.Config.Env}}' "$IMAGE" \

@@ -87,0 +158,4 @@
+            exit 1
+          }
+          code=$(curl -s -o /dev/null -w '%{http_code}' -I http://localhost:18099/favicon.ico)
+          [ "$code" = "302" ] || {

@@ -16,1 +19,4 @@
+# PYTHONPATH shadows it. Code still runs from /app/src via PYTHONPATH (which
+# takes precedence over site-packages): init_db resolves alembic.ini
+# relative to the source tree root.
 RUN uv sync --frozen --no-dev --no-install-project

@@ -1784,0 +1808,4 @@
+
+        assert response.status_code == 302
+        assert response.headers["Location"].endswith("/static/favicon.svg")
+        followed = client.get("/favicon.ico", follow_redirects=True)

@@ -87,0 +116,4 @@
+          trap cleanup EXIT
+          # Version metadata baked into the venv — the footer's source.
+          rootfs=$(buildah mount "$ctr")
+          metadata=$(ls "$rootfs"/app/.venv/lib/python3.*/site-packages/yunjin-*.dist-info/METADATA 2>/dev/null | head -1 || true)

@@ -87,0 +153,4 @@
+            cat /tmp/yunjin-smoke.log >&2 || :
+            exit 1
+          fi
+          printf '%s' "$page" | grep -Fq "Yunjin v${EXPECTED_VERSION} |" || {

@@ -86,1 +86,4 @@
             .
+      - name: Smoke-test built image
+        run: |
+          EXPECTED_VERSION=$(awk '/^\[project\]/{inproj=1;next} /^\[/{inproj=0} inproj && /^version = /{gsub(/"/,"",$3); print $3; exit}' pyproject.toml)

@@ -87,0 +98,4 @@
+          # with chroot isolation never creates a user namespace, so the
+          # storage ops, in-chroot exec and the booted server below work
+          # where podman fails.
+          buildah inspect --format '{{.OCIv1.Config.Env}}' "$IMAGE" \

@@ -87,0 +107,4 @@
+          server_pid=
+          cleanup() {
+            if [ -n "$server_pid" ]; then
+              kill "$server_pid" 2>/dev/null || :

@@ -87,0 +139,4 @@
+          # Boot the real entrypoint and verify the user-visible behaviour:
+          # footer text and /favicon.ico resolution.
+          buildah run --isolation chroot "$ctr" \
+            env PORT=18099 /usr/local/bin/container-entrypoint.sh web >/tmp/yunjin-smoke.log 2>&1 &

@@ -12,6 +12,11 @@ registry.marvin8.zone/marvin8/yunjin:<version>
 
 The image runs as an unprivileged `yunjin` user and works on `linux/amd64`.
 
+The build installs the project's package metadata (version from

@@ -1784,0 +1793,4 @@
+        assert response.status_code == 200
+        html = response.data.decode()
+        assert 'rel="icon"' in html
+        assert "/static/favicon.svg" in html

@@ -1784,0 +1797,4 @@
+
+    def test_svg_favicon_is_served(self, client: Any) -> None:
+        """Test the SVG icon file is served from static."""
+        response = client.get("/static/favicon.svg")

@@ -86,1 +86,4 @@
             .
+      - name: Smoke-test built image
+        run: |
+          EXPECTED_VERSION=$(awk '/^\[project\]/{inproj=1;next} /^\[/{inproj=0} inproj && /^version = /{gsub(/"/,"",$3); print $3; exit}' pyproject.toml)

@@ -87,0 +98,4 @@
+          # with chroot isolation never creates a user namespace, so the
+          # storage ops, in-chroot exec and the booted server below work
+          # where podman fails.
+          buildah inspect --format '{{.OCIv1.Config.Env}}' "$IMAGE" \

@@ -87,0 +122,4 @@
+            exit 1
+          fi
+          installed=$(sed -n 's/^Version: \(.*\)$/\1/p' "$metadata")
+          if [ "$installed" != "$EXPECTED_VERSION" ]; then

@@ -87,0 +146,4 @@
+          server_pid=$!
+          page=""
+          for attempt in $(seq 1 30); do
+            if page=$(curl -fsS http://localhost:18099/ 2>/dev/null); then

@@ -15,0 +17,4 @@
+reports the real application version (`Yunjin v<version>`) — the same way
+a source-checkout run does. The application code itself is still imported
+from `/app/src` at runtime (`PYTHONPATH` takes precedence over
+site-packages); the installed copy only carries the metadata.