ci: add community release workflow

2026-05-15 17:03:15 +00:00
parent 3eeac67634
commit da86da8cc1
2 changed files with 176 additions and 0 deletions
@@ -0,0 +1,151 @@
+name: Community Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  packages: write
+
+env:
+  IMAGE_TAG: ${{ github.ref_name }}
+  ADMIN_API_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-admin-api
+  MCP_SERVER_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-mcp-server
+  UI_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-ui
+
+jobs:
+  build-release-assets:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: 1.85.0
+
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: apps/ui/package-lock.json
+
+      - name: Build release binaries
+        run: cargo build --release -p admin-api -p mcp-server
+
+      - name: Install UI dependencies
+        working-directory: apps/ui
+        run: npm ci
+
+      - name: Build UI dist
+        working-directory: apps/ui
+        run: npm run build
+
+      - name: Package release artifacts
+        run: |
+          mkdir -p dist/release
+          cp target/release/admin-api dist/release/admin-api
+          cp target/release/mcp-server dist/release/mcp-server
+          tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api
+          tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
+          tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
+          sha256sum \
+            dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \
+            dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \
+            dist/crank-community-ui-${IMAGE_TAG}.tar.gz \
+            > dist/crank-community-${IMAGE_TAG}-checksums.txt
+
+      - name: Generate SBOM
+        run: |
+          docker run --rm -v "$PWD:/workspace" anchore/syft:latest \
+            dir:/workspace -o spdx-json \
+            > dist/crank-community-${IMAGE_TAG}-sbom.spdx.json
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: community-release-artifacts
+          path: |
+            dist/crank-community-admin-api-${{ env.IMAGE_TAG }}.tar.gz
+            dist/crank-community-mcp-server-${{ env.IMAGE_TAG }}.tar.gz
+            dist/crank-community-ui-${{ env.IMAGE_TAG }}.tar.gz
+            dist/crank-community-${{ env.IMAGE_TAG }}-checksums.txt
+            dist/crank-community-${{ env.IMAGE_TAG }}-sbom.spdx.json
+
+  publish-images:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: admin-api
+            dockerfile: apps/admin-api/Dockerfile
+            image: ghcr.io/${{ github.repository_owner }}/crank-community-admin-api
+          - name: mcp-server
+            dockerfile: apps/mcp-server/Dockerfile
+            image: ghcr.io/${{ github.repository_owner }}/crank-community-mcp-server
+          - name: ui
+            dockerfile: apps/ui/Dockerfile
+            image: ghcr.io/${{ github.repository_owner }}/crank-community-ui
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push ${{ matrix.name }}
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          push: true
+          tags: |
+            ${{ matrix.image }}:${{ env.IMAGE_TAG }}
+            ${{ matrix.image }}:latest
+          cache-from: type=gha,scope=release-${{ matrix.name }}
+          cache-to: type=gha,mode=max,scope=release-${{ matrix.name }}
+
+  github-release:
+    needs:
+      - build-release-assets
+      - publish-images
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: community-release-artifacts
+          path: dist
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/crank-community-admin-api-${{ env.IMAGE_TAG }}.tar.gz
+            dist/crank-community-mcp-server-${{ env.IMAGE_TAG }}.tar.gz
+            dist/crank-community-ui-${{ env.IMAGE_TAG }}.tar.gz
+            dist/crank-community-${{ env.IMAGE_TAG }}-checksums.txt
+            dist/crank-community-${{ env.IMAGE_TAG }}-sbom.spdx.json
@@ -172,3 +172,28 @@ Progress:
  - Phase 3 dependency slice: added `CacheBackendFactory` in `crank-runtime` with `BuiltinCacheBackendFactory`; unlike the original draft, the seam lives in runtime rather than core to avoid a `crank-core -> crank-runtime` dependency cycle around `RuntimeCacheStores`
  - Phase 5 / task `5.1`: added Community UI overlay foundation — `slot-registry.js`, `overlay-loader.js`, optional `CRANK_UI_OVERLAY_DIR` copy path in the UI build, settings slot mounts, and wizard protocol-card slot mounts; Community build stays noop without any private overlay package
  - backward-compatible alias `CommunityMachineCredentialVerifier` сохранен, поведение Community не изменено
+
+### `feat/community-release-pipeline`
+
+Status: in_progress
+
+Goal:
+- закрыть `Phase 6.1` и сделать reproducible tag-release flow для `crank-community`.
+
+Main code areas:
+- `.github/workflows/release.yml`
+- `apps/admin-api/Dockerfile`
+- `apps/mcp-server/Dockerfile`
+- `apps/ui/Dockerfile`
+
+Implementation slices:
+1. build release binaries and UI dist on `push tag v*`;
+2. publish Community images to `GHCR`;
+3. attach checksums and SBOM to GitHub Release.
+
+DoD:
+- `crank-community` выпускается из собственного repo без private inputs;
+- tag push `v*` produces GitHub Release artifacts and container images.
+
+Verification:
+- `python3` YAML parse for `.github/workflows/release.yml`