bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

feat: harden community production foundation through story 1.5

Browse Source
This commit is contained in:
bsodfather
2026-08-14 00:21:59 +03:00
parent c30461cc92
commit f6fc2e5c9b
161 changed files with 16758 additions and 2515 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+34 -3
View File
@@ -61,6 +61,34 @@ jobs:
- name: Run tooling unit tests
run: python3 -m unittest discover -s tests/unit
- name: Check typed runtime configuration contract
run: |
cargo run -p crank-config --bin crank-config-contract -- --check
python3 scripts/check-runtime-config.py --root .
python3 scripts/check-config-boundaries.py --root .
- name: Check canonical migration contract
run: cargo run -p admin-api --bin crank-migrate -- plan --check
- name: Check Capability Inventory
run: |
required_args=""
for number in $(seq 1 54); do
required_args="$required_args --required-fr FR-$number"
done
python3 scripts/validate-capability-inventory.py \
--root . \
--inventory docs/capability-inventory.json \
--schema docs/schemas/capability-inventory.schema.json \
$required_args
- name: Check Capability Baseline
run: |
python3 scripts/validate-capability-baseline.py \
--root . \
--manifest docs/capability-baseline/manifest.json \
--schema docs/schemas/capability-baseline.schema.json
- name: Check Community scope
run: scripts/check-community-scope.sh
@@ -80,7 +108,7 @@ jobs:
run: cargo clippy --workspace --all-targets --all-features --jobs "$CARGO_BUILD_JOBS" -- -D warnings
- name: Run tests
run: cargo test --workspace --all-targets --jobs "$CARGO_BUILD_JOBS"
run: cargo test --workspace --all-targets --jobs "$CARGO_BUILD_JOBS" -- --test-threads=1
ui:
name: UI Checks
@@ -199,8 +227,11 @@ jobs:
- name: Checkout
uses: actions/checkout@v5
- name: Validate Community deployment manifest
run: docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example config -q
- name: Validate Community deployment manifests
run: |
docker compose -f docker-compose.yml --env-file .env.example config -q
docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example config -q
docker compose -f deploy/community/docker-compose.images.yml --env-file deploy/community/.env.images.example --profile local-db config -q
- name: Build Community images
run: |
.gitea/workflows/release.yml
+70 -4
View File
@@ -41,6 +41,7 @@ jobs:
- name: Verify runner toolchain
run: |
python3 --version
rustc --version
cargo --version
node --version
@@ -52,11 +53,46 @@ jobs:
- name: Install dependency policy tool
run: cargo install cargo-deny --version 0.20.2 --locked
- name: Run tooling unit tests
run: python3 -m unittest discover -s tests/unit
- name: Check typed runtime configuration contract
run: |
cargo run -p crank-config --bin crank-config-contract -- --check
python3 scripts/check-runtime-config.py --root .
python3 scripts/check-config-boundaries.py --root .
scripts/check-rust-boundaries.sh
- name: Check canonical migration contract
run: cargo run -p admin-api --bin crank-migrate -- plan --check
- name: Check Capability Inventory
run: |
required_args=""
for number in $(seq 1 54); do
required_args="$required_args --required-fr FR-$number"
done
python3 scripts/validate-capability-inventory.py \
--root . \
--inventory docs/capability-inventory.json \
--schema docs/schemas/capability-inventory.schema.json \
$required_args
- name: Check Capability Baseline
run: |
python3 scripts/validate-capability-baseline.py \
--root . \
--manifest docs/capability-baseline/manifest.json \
--schema docs/schemas/capability-baseline.schema.json
- name: Check Community scope
run: scripts/check-community-scope.sh
- name: Run release quality gates
run: |
cargo fmt --all --check
cargo clippy --workspace --all-targets --all-features -- -D warnings
cargo test --workspace --all-targets
cargo test --workspace --all-targets -- --test-threads=1
cargo deny --locked check advisories bans licenses sources
- name: Build release binaries
@@ -82,15 +118,19 @@ jobs:
working-directory: apps/ui
run: npm run e2e
- name: Validate deployment manifest
run: docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example config -q
- name: Validate deployment manifests
run: |
docker compose -f docker-compose.yml --env-file .env.example config -q
docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example config -q
docker compose -f deploy/community/docker-compose.images.yml --env-file deploy/community/.env.images.example --profile local-db config -q
- name: Package release artifacts
run: |
mkdir -p dist/release
cp target/release/admin-api dist/release/admin-api
cp target/release/crank-migrate dist/release/crank-migrate
cp target/release/mcp-server dist/release/mcp-server
tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api
tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api crank-migrate
tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
sha256sum \
@@ -130,6 +170,32 @@ jobs:
docker build -f apps/ui/Dockerfile \
-t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
-t '${{ env.UI_IMAGE }}:latest' .
mkdir -p .tmp
cat > .tmp/release-migration-smoke.env <<EOF
COMPOSE_PROJECT_NAME=crank-release-migration-${{ github.run_id }}-${{ github.run_attempt }}
POSTGRES_HOST=postgres
POSTGRES_DB=crank
POSTGRES_USER=crank
POSTGRES_PASSWORD=release-smoke-password
CRANK_ADMIN_API_IMAGE=${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}
CRANK_MCP_SERVER_IMAGE=${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}
CRANK_UI_IMAGE=${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}
CRANK_MASTER_KEY=0000000000000000000000000000000000000000000000000000000000000000
CRANK_SESSION_SECRET=release-smoke-session
CRANK_PASSWORD_PEPPER=release-smoke-pepper
CRANK_BOOTSTRAP_ADMIN_EMAIL=owner@crank.test
CRANK_BOOTSTRAP_ADMIN_PASSWORD=release-smoke-password
CRANK_BASE_URL=http://127.0.0.1
CRANK_PUBLISH_BIND=127.0.0.1
CRANK_ADMIN_PUBLISH_PORT=0
CRANK_MCP_PUBLISH_PORT=0
CRANK_UI_PUBLISH_PORT=0
EOF
trap 'docker compose -f deploy/community/docker-compose.images.yml --env-file .tmp/release-migration-smoke.env --profile local-db down -v --remove-orphans || true' EXIT
docker compose -f deploy/community/docker-compose.images.yml \
--env-file .tmp/release-migration-smoke.env --profile local-db up -d --wait
docker compose -f deploy/community/docker-compose.images.yml \
--env-file .tmp/release-migration-smoke.env --profile local-db logs migrate | grep '"status":"applied"'
scripts/scan-images.sh \
'${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
'${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \