ci: migrate community workflows to gitea

2026-05-26 21:49:09 +00:00
parent 69edbfb717
commit 15d7cfa8d9
10 changed files with 165 additions and 271 deletions
@@ -0,0 +1,115 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - "feat/**"
+
+jobs:
+  rust:
+    name: Rust Checks
+    runs-on: [self-hosted, linux, x64]
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: crank_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d crank_test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      TEST_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/crank_test
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Verify runner toolchain
+        run: |
+          rustc --version
+          cargo --version
+          rustfmt --version
+          cargo clippy --version
+
+      - name: Check formatting
+        run: cargo fmt --all --check
+
+      - name: Check workspace
+        run: cargo check --workspace
+
+      - name: Run clippy
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+      - name: Run tests
+        run: cargo test --workspace --all-targets
+
+  ui:
+    name: UI Checks
+    runs-on: [self-hosted, linux, x64]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Verify runner toolchain
+        run: |
+          node --version
+          npm --version
+          docker --version
+
+      - name: Install UI dependencies
+        working-directory: apps/ui
+        run: npm ci
+
+      - name: Build UI bundle
+        working-directory: apps/ui
+        run: npm run build
+
+      - name: Build UI image
+        run: docker build -f apps/ui/Dockerfile .
+
+  frontend-e2e:
+    name: Frontend E2E
+    runs-on: [self-hosted, linux, x64]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Verify runner toolchain
+        run: |
+          rustc --version
+          cargo --version
+          node --version
+          npm --version
+
+      - name: Install UI dependencies
+        working-directory: apps/ui
+        run: npm ci
+
+      - name: Install Playwright browser
+        working-directory: apps/ui
+        run: npx playwright install --with-deps chromium
+
+      - name: Run Playwright e2e
+        working-directory: apps/ui
+        run: npx playwright test
+
+  deployment:
+    name: Deployment Manifests
+    runs-on: [self-hosted, linux, x64]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Validate Community deployment manifest
+        run: docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example config -q
@@ -0,0 +1,200 @@
+name: Deploy
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  REGISTRY: git.itexp.me
+  IMAGE_TAG: ${{ gitea.sha }}
+  ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
+  MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
+  UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
+
+jobs:
+  build-images:
+    runs-on: [self-hosted, linux, x64]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: admin-api
+            dockerfile: apps/admin-api/Dockerfile
+            image: git.itexp.me/bsodfather/crank-community-admin-api
+          - name: mcp-server
+            dockerfile: apps/mcp-server/Dockerfile
+            image: git.itexp.me/bsodfather/crank-community-mcp-server
+          - name: ui
+            dockerfile: apps/ui/Dockerfile
+            image: git.itexp.me/bsodfather/crank-community-ui
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Verify runner toolchain
+        run: docker --version
+
+      - name: Login to registry
+        run: |
+          printf '%s' '${{ secrets.DEPLOY_REGISTRY_TOKEN }}' | \
+            docker login '${{ env.REGISTRY }}' -u '${{ secrets.DEPLOY_REGISTRY_USER }}' --password-stdin
+
+      - name: Build and push ${{ matrix.name }}
+        run: |
+          docker build -f '${{ matrix.dockerfile }}' \
+            -t '${{ matrix.image }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ matrix.image }}:main' \
+            .
+          docker push '${{ matrix.image }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ matrix.image }}:main'
+
+  deploy:
+    needs: build-images
+    runs-on: [self-hosted, linux, x64]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Configure SSH key
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          printf '%s\n' '${{ secrets.DEPLOY_SSH_KEY }}' > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+
+      - name: Configure known hosts
+        run: |
+          printf '%s\n' '${{ secrets.DEPLOY_KNOWN_HOSTS }}' > ~/.ssh/known_hosts
+          chmod 644 ~/.ssh/known_hosts
+
+      - name: Sync deployment files to server
+        run: |
+          ssh -p '${{ secrets.DEPLOY_PORT }}' '${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}' \
+            "mkdir -p '${{ secrets.DEPLOY_PATH }}'"
+          rsync -az -e "ssh -p ${{ secrets.DEPLOY_PORT }}" deploy/community/docker-compose.yml \
+            '${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}:${{ secrets.DEPLOY_PATH }}/docker-compose.yml'
+
+      - name: Write environment file
+        env:
+          POSTGRES_DB: ${{ secrets.POSTGRES_DB }}
+          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+          POSTGRES_HOST: ${{ secrets.POSTGRES_HOST }}
+          POSTGRES_PORT: ${{ secrets.POSTGRES_PORT }}
+          CRANK_STORAGE_ROOT: ${{ secrets.CRANK_STORAGE_ROOT }}
+          CRANK_PUBLISH_BIND: ${{ secrets.CRANK_PUBLISH_BIND }}
+          CRANK_ADMIN_BIND: ${{ secrets.CRANK_ADMIN_BIND }}
+          CRANK_MCP_BIND: ${{ secrets.CRANK_MCP_BIND }}
+          CRANK_MCP_REFRESH_MS: ${{ secrets.CRANK_MCP_REFRESH_MS }}
+          CRANK_LOG_LEVEL: ${{ secrets.CRANK_LOG_LEVEL }}
+          CRANK_MASTER_KEY: ${{ secrets.CRANK_MASTER_KEY }}
+          CRANK_BASE_URL: ${{ secrets.CRANK_BASE_URL }}
+          CRANK_CACHE_BACKEND: ${{ secrets.CRANK_CACHE_BACKEND }}
+          CRANK_CACHE_URL: ${{ secrets.CRANK_CACHE_URL }}
+          CRANK_CACHE_DEFAULT_TTL_MS: ${{ secrets.CRANK_CACHE_DEFAULT_TTL_MS }}
+          CRANK_SESSION_SECRET: ${{ secrets.CRANK_SESSION_SECRET }}
+          CRANK_PASSWORD_PEPPER: ${{ secrets.CRANK_PASSWORD_PEPPER }}
+          CRANK_SESSION_TTL_HOURS: ${{ secrets.CRANK_SESSION_TTL_HOURS }}
+          CRANK_BOOTSTRAP_ADMIN_EMAIL: ${{ secrets.CRANK_BOOTSTRAP_ADMIN_EMAIL }}
+          CRANK_BOOTSTRAP_ADMIN_PASSWORD: ${{ secrets.CRANK_BOOTSTRAP_ADMIN_PASSWORD }}
+          CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME: ${{ secrets.CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME }}
+          CRANK_DEMO_SEED: ${{ secrets.CRANK_DEMO_SEED }}
+        run: |
+          tmp_env="$(mktemp)"
+          append_if_set() {
+            if [ -n "$2" ]; then
+              printf '%s=%s\n' "$1" "$2" >> "$tmp_env"
+            fi
+          }
+          : > "$tmp_env"
+          append_if_set POSTGRES_DB "$POSTGRES_DB"
+          append_if_set POSTGRES_USER "$POSTGRES_USER"
+          append_if_set POSTGRES_PASSWORD "$POSTGRES_PASSWORD"
+          append_if_set POSTGRES_HOST "$POSTGRES_HOST"
+          append_if_set POSTGRES_PORT "$POSTGRES_PORT"
+          append_if_set CRANK_STORAGE_ROOT "$CRANK_STORAGE_ROOT"
+          append_if_set CRANK_PUBLISH_BIND "$CRANK_PUBLISH_BIND"
+          append_if_set CRANK_ADMIN_BIND "$CRANK_ADMIN_BIND"
+          append_if_set CRANK_MCP_BIND "$CRANK_MCP_BIND"
+          append_if_set CRANK_MCP_REFRESH_MS "$CRANK_MCP_REFRESH_MS"
+          append_if_set CRANK_LOG_LEVEL "$CRANK_LOG_LEVEL"
+          append_if_set CRANK_MASTER_KEY "$CRANK_MASTER_KEY"
+          append_if_set CRANK_BASE_URL "$CRANK_BASE_URL"
+          append_if_set CRANK_CACHE_BACKEND "$CRANK_CACHE_BACKEND"
+          append_if_set CRANK_CACHE_URL "$CRANK_CACHE_URL"
+          append_if_set CRANK_CACHE_DEFAULT_TTL_MS "$CRANK_CACHE_DEFAULT_TTL_MS"
+          append_if_set CRANK_SESSION_SECRET "$CRANK_SESSION_SECRET"
+          append_if_set CRANK_PASSWORD_PEPPER "$CRANK_PASSWORD_PEPPER"
+          append_if_set CRANK_SESSION_TTL_HOURS "$CRANK_SESSION_TTL_HOURS"
+          append_if_set CRANK_BOOTSTRAP_ADMIN_EMAIL "$CRANK_BOOTSTRAP_ADMIN_EMAIL"
+          append_if_set CRANK_BOOTSTRAP_ADMIN_PASSWORD "$CRANK_BOOTSTRAP_ADMIN_PASSWORD"
+          append_if_set CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME "$CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME"
+          append_if_set CRANK_DEMO_SEED "$CRANK_DEMO_SEED"
+          {
+            printf 'CRANK_ADMIN_API_IMAGE=%s:%s\n' '${{ env.ADMIN_API_IMAGE }}' '${{ env.IMAGE_TAG }}'
+            printf 'CRANK_MCP_SERVER_IMAGE=%s:%s\n' '${{ env.MCP_SERVER_IMAGE }}' '${{ env.IMAGE_TAG }}'
+            printf 'CRANK_UI_IMAGE=%s:%s\n' '${{ env.UI_IMAGE }}' '${{ env.IMAGE_TAG }}'
+          } >> "$tmp_env"
+          cat "$tmp_env" | ssh -p '${{ secrets.DEPLOY_PORT }}' '${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}' \
+            "mkdir -p '${{ secrets.DEPLOY_PATH }}' && cat > '${{ secrets.DEPLOY_PATH }}/.env'"
+          rm -f "$tmp_env"
+
+      - name: Validate required environment variables
+        run: |
+          ssh -p '${{ secrets.DEPLOY_PORT }}' '${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}' "
+            set -e
+            cd '${{ secrets.DEPLOY_PATH }}'
+            required_vars='
+              POSTGRES_HOST
+              POSTGRES_PORT
+              POSTGRES_DB
+              POSTGRES_USER
+              POSTGRES_PASSWORD
+              CRANK_MASTER_KEY
+              CRANK_SESSION_SECRET
+              CRANK_PASSWORD_PEPPER
+              CRANK_BOOTSTRAP_ADMIN_EMAIL
+              CRANK_BOOTSTRAP_ADMIN_PASSWORD
+              CRANK_BASE_URL
+            '
+            for var in \$required_vars; do
+              value=\$(grep -E \"^\${var}=\" .env | tail -n1 | cut -d= -f2- || true)
+              if [ -z \"\$value\" ]; then
+                echo \"missing required env: \$var\" >&2
+                exit 1
+              fi
+            done
+          "
+
+      - name: Deploy with Docker Compose
+        run: |
+          ssh -p '${{ secrets.DEPLOY_PORT }}' '${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}' "
+            set -e
+            cd '${{ secrets.DEPLOY_PATH }}'
+            echo '${{ secrets.DEPLOY_REGISTRY_TOKEN }}' | docker login '${{ env.REGISTRY }}' -u '${{ secrets.DEPLOY_REGISTRY_USER }}' --password-stdin
+            docker compose config -q
+            docker compose pull admin-api mcp-server ui
+            docker compose up -d --remove-orphans
+          "
+
+      - name: Verify health endpoints
+        run: |
+          ssh -p '${{ secrets.DEPLOY_PORT }}' '${{ secrets.DEPLOY_USER }}@${{ secrets.DEPLOY_HOST }}' "
+            set -e
+            cd '${{ secrets.DEPLOY_PATH }}'
+            for attempt in \$(seq 1 30); do
+              if curl --fail --silent http://127.0.0.1:3000/ >/dev/null \
+                && curl --fail --silent http://127.0.0.1:3001/health >/dev/null \
+                && curl --fail --silent http://127.0.0.1:3002/health >/dev/null; then
+                exit 0
+              fi
+              sleep 2
+            done
+            echo 'deployment health verification failed' >&2
+            docker compose ps >&2
+            exit 1
+          "
@@ -0,0 +1,88 @@
+name: Community Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+env:
+  REGISTRY: git.itexp.me
+  IMAGE_TAG: ${{ gitea.ref_name }}
+  ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
+  MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
+  UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
+
+jobs:
+  release:
+    runs-on: [self-hosted, linux, x64]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Verify runner toolchain
+        run: |
+          rustc --version
+          cargo --version
+          node --version
+          npm --version
+          docker --version
+
+      - name: Build release binaries
+        run: cargo build --release -p admin-api -p mcp-server
+
+      - name: Install UI dependencies
+        working-directory: apps/ui
+        run: npm ci
+
+      - name: Build UI dist
+        working-directory: apps/ui
+        run: npm run build
+
+      - name: Package release artifacts
+        run: |
+          mkdir -p dist/release
+          cp target/release/admin-api dist/release/admin-api
+          cp target/release/mcp-server dist/release/mcp-server
+          tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api
+          tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
+          tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
+          sha256sum \
+            dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \
+            dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \
+            dist/crank-community-ui-${IMAGE_TAG}.tar.gz \
+            > dist/crank-community-${IMAGE_TAG}-checksums.txt
+
+      - name: Generate SBOM
+        run: |
+          docker run --rm -v "$PWD:/workspace" anchore/syft:latest \
+            dir:/workspace -o spdx-json \
+            > dist/crank-community-${IMAGE_TAG}-sbom.spdx.json
+
+      - name: Login to registry
+        run: |
+          printf '%s' '${{ secrets.DEPLOY_REGISTRY_TOKEN }}' | \
+            docker login '${{ env.REGISTRY }}' -u '${{ secrets.DEPLOY_REGISTRY_USER }}' --password-stdin
+
+      - name: Build and push release images
+        run: |
+          docker build -f apps/admin-api/Dockerfile \
+            -t '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.ADMIN_API_IMAGE }}:latest' .
+          docker build -f apps/mcp-server/Dockerfile \
+            -t '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.MCP_SERVER_IMAGE }}:latest' .
+          docker build -f apps/ui/Dockerfile \
+            -t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
+            -t '${{ env.UI_IMAGE }}:latest' .
+          docker push '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.ADMIN_API_IMAGE }}:latest'
+          docker push '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.MCP_SERVER_IMAGE }}:latest'
+          docker push '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
+          docker push '${{ env.UI_IMAGE }}:latest'
+
+      - name: Show release bundle summary
+        run: |
+          ls -lh dist