From da86da8cc193d2ccc08051321614b77f29308fc7 Mon Sep 17 00:00:00 2001 From: github-ops Date: Fri, 15 May 2026 17:03:15 +0000 Subject: [PATCH] ci: add community release workflow --- .github/workflows/release.yml | 151 ++++++++++++++++++++++++++++++++++ TASKS.md | 25 ++++++ 2 files changed, 176 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..90edca9 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,151 @@ +name: Community Release + +on: + push: + tags: + - "v*" + workflow_dispatch: + +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: true + +permissions: + contents: write + packages: write + +env: + IMAGE_TAG: ${{ github.ref_name }} + ADMIN_API_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-admin-api + MCP_SERVER_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-mcp-server + UI_IMAGE: ghcr.io/${{ github.repository_owner }}/crank-community-ui + +jobs: + build-release-assets: + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v5 + + - name: Install Rust toolchain + uses: dtolnay/rust-toolchain@master + with: + toolchain: 1.85.0 + + - name: Cache cargo artifacts + uses: Swatinem/rust-cache@v2 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: 22 + cache: npm + cache-dependency-path: apps/ui/package-lock.json + + - name: Build release binaries + run: cargo build --release -p admin-api -p mcp-server + + - name: Install UI dependencies + working-directory: apps/ui + run: npm ci + + - name: Build UI dist + working-directory: apps/ui + run: npm run build + + - name: Package release artifacts + run: | + mkdir -p dist/release + cp target/release/admin-api dist/release/admin-api + cp target/release/mcp-server dist/release/mcp-server + tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api + tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server + tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz . + sha256sum \ + dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \ + dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \ + dist/crank-community-ui-${IMAGE_TAG}.tar.gz \ + > dist/crank-community-${IMAGE_TAG}-checksums.txt + + - name: Generate SBOM + run: | + docker run --rm -v "$PWD:/workspace" anchore/syft:latest \ + dir:/workspace -o spdx-json \ + > dist/crank-community-${IMAGE_TAG}-sbom.spdx.json + + - name: Upload release artifacts + uses: actions/upload-artifact@v4 + with: + name: community-release-artifacts + path: | + dist/crank-community-admin-api-${{ env.IMAGE_TAG }}.tar.gz + dist/crank-community-mcp-server-${{ env.IMAGE_TAG }}.tar.gz + dist/crank-community-ui-${{ env.IMAGE_TAG }}.tar.gz + dist/crank-community-${{ env.IMAGE_TAG }}-checksums.txt + dist/crank-community-${{ env.IMAGE_TAG }}-sbom.spdx.json + + publish-images: + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + include: + - name: admin-api + dockerfile: apps/admin-api/Dockerfile + image: ghcr.io/${{ github.repository_owner }}/crank-community-admin-api + - name: mcp-server + dockerfile: apps/mcp-server/Dockerfile + image: ghcr.io/${{ github.repository_owner }}/crank-community-mcp-server + - name: ui + dockerfile: apps/ui/Dockerfile + image: ghcr.io/${{ github.repository_owner }}/crank-community-ui + + steps: + - name: Checkout + uses: actions/checkout@v5 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v4 + + - name: Log in to GHCR + uses: docker/login-action@v4 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Build and push ${{ matrix.name }} + uses: docker/build-push-action@v7 + with: + context: . + file: ${{ matrix.dockerfile }} + push: true + tags: | + ${{ matrix.image }}:${{ env.IMAGE_TAG }} + ${{ matrix.image }}:latest + cache-from: type=gha,scope=release-${{ matrix.name }} + cache-to: type=gha,mode=max,scope=release-${{ matrix.name }} + + github-release: + needs: + - build-release-assets + - publish-images + runs-on: ubuntu-latest + + steps: + - name: Download release artifacts + uses: actions/download-artifact@v4 + with: + name: community-release-artifacts + path: dist + + - name: Publish GitHub Release + uses: softprops/action-gh-release@v2 + with: + files: | + dist/crank-community-admin-api-${{ env.IMAGE_TAG }}.tar.gz + dist/crank-community-mcp-server-${{ env.IMAGE_TAG }}.tar.gz + dist/crank-community-ui-${{ env.IMAGE_TAG }}.tar.gz + dist/crank-community-${{ env.IMAGE_TAG }}-checksums.txt + dist/crank-community-${{ env.IMAGE_TAG }}-sbom.spdx.json diff --git a/TASKS.md b/TASKS.md index 4e1e448..6699f6e 100644 --- a/TASKS.md +++ b/TASKS.md @@ -172,3 +172,28 @@ Progress: - Phase 3 dependency slice: added `CacheBackendFactory` in `crank-runtime` with `BuiltinCacheBackendFactory`; unlike the original draft, the seam lives in runtime rather than core to avoid a `crank-core -> crank-runtime` dependency cycle around `RuntimeCacheStores` - Phase 5 / task `5.1`: added Community UI overlay foundation — `slot-registry.js`, `overlay-loader.js`, optional `CRANK_UI_OVERLAY_DIR` copy path in the UI build, settings slot mounts, and wizard protocol-card slot mounts; Community build stays noop without any private overlay package - backward-compatible alias `CommunityMachineCredentialVerifier` сохранен, поведение Community не изменено + +### `feat/community-release-pipeline` + +Status: in_progress + +Goal: +- закрыть `Phase 6.1` и сделать reproducible tag-release flow для `crank-community`. + +Main code areas: +- `.github/workflows/release.yml` +- `apps/admin-api/Dockerfile` +- `apps/mcp-server/Dockerfile` +- `apps/ui/Dockerfile` + +Implementation slices: +1. build release binaries and UI dist on `push tag v*`; +2. publish Community images to `GHCR`; +3. attach checksums and SBOM to GitHub Release. + +DoD: +- `crank-community` выпускается из собственного repo без private inputs; +- tag push `v*` produces GitHub Release artifacts and container images. + +Verification: +- `python3` YAML parse for `.github/workflows/release.yml`