crank/.gitea/workflows/release.yml

name: Community Release

on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

env:
  REGISTRY: git.itexp.me
  IMAGE_TAG: ${{ gitea.ref_name }}
  ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
  MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
  UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
  OPENBAO_ENV_FILE: .openbao-env

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v5

      - name: Use preinstalled Rust toolchain
        run: |
          set -eu
          toolchain_dir="${RUSTUP_HOME:-$HOME/.rustup}/toolchains/1.96.1-x86_64-unknown-linux-gnu"
          toolchain_bin="$toolchain_dir/bin"
          if [ ! -x "$toolchain_bin/rustc" ] || [ ! -x "$toolchain_bin/cargo" ]; then
            echo "Rust 1.96.1 is not preinstalled at $toolchain_dir." >&2
            echo "Install it in the Gitea runner image/host before running CI:" >&2
            echo "rustup toolchain install 1.96.1 --profile minimal --component clippy --component rustfmt" >&2
            exit 1
          fi
          printf '%s\n' "$toolchain_bin" >> "$GITHUB_PATH"
          "$toolchain_bin/rustc" --version
          "$toolchain_bin/cargo" --version
          "$toolchain_bin/rustfmt" --version
          "$toolchain_bin/cargo-clippy" --version

      - name: Verify runner toolchain
        run: |
          rustc --version
          cargo --version
          node --version
          npm --version
          docker --version
          command -v bao
          bao version

      - name: Install dependency policy tool
        run: cargo install cargo-deny --version 0.20.2 --locked

      - name: Run release quality gates
        run: |
          cargo fmt --all --check
          cargo clippy --workspace --all-targets --all-features -- -D warnings
          cargo test --workspace --all-targets
          cargo deny --locked check advisories bans licenses sources

      - name: Build release binaries
        run: cargo build --release -p admin-api -p mcp-server

      - name: Install UI dependencies
        working-directory: apps/ui
        run: npm ci

      - name: Audit UI dependencies
        working-directory: apps/ui
        run: npm audit --audit-level=high

      - name: Build UI dist
        working-directory: apps/ui
        run: npm run build

      - name: Install Playwright browser
        working-directory: apps/ui
        run: npx playwright install --with-deps chromium

      - name: Run release end-to-end tests
        working-directory: apps/ui
        run: npm run e2e

      - name: Validate deployment manifest
        run: docker compose -f deploy/community/docker-compose.yml --env-file deploy/community/.env.example config -q

      - name: Package release artifacts
        run: |
          mkdir -p dist/release
          cp target/release/admin-api dist/release/admin-api
          cp target/release/mcp-server dist/release/mcp-server
          tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api
          tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
          tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
          sha256sum \
            dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \
            dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \
            dist/crank-community-ui-${IMAGE_TAG}.tar.gz \
            > dist/crank-community-${IMAGE_TAG}-checksums.txt

      - name: Generate SBOM
        run: |
          docker run --rm -v "$PWD:/workspace" anchore/syft:latest \
            dir:/workspace -o spdx-json \
            > dist/crank-community-${IMAGE_TAG}-sbom.spdx.json

      - name: Load deployment secrets from OpenBao
        env:
          BAO_ADDR: ${{ secrets.BAO_ADDR }}
          BAO_ROLE_ID: ${{ secrets.BAO_ROLE_ID }}
          BAO_SECRET_ID: ${{ secrets.BAO_SECRET_ID }}
          OPENBAO_APP: crank
        run: scripts/load-openbao-env.sh

      - name: Login to registry
        run: |
          . "$OPENBAO_ENV_FILE"
          printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
            docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin

      - name: Build and push release images
        run: |
          docker build -f apps/admin-api/Dockerfile \
            -t '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
            -t '${{ env.ADMIN_API_IMAGE }}:latest' .
          docker build -f apps/mcp-server/Dockerfile \
            -t '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
            -t '${{ env.MCP_SERVER_IMAGE }}:latest' .
          docker build -f apps/ui/Dockerfile \
            -t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
            -t '${{ env.UI_IMAGE }}:latest' .
          scripts/scan-images.sh \
            '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
            '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
            '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
          docker push '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}'
          docker push '${{ env.ADMIN_API_IMAGE }}:latest'
          docker push '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}'
          docker push '${{ env.MCP_SERVER_IMAGE }}:latest'
          docker push '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
          docker push '${{ env.UI_IMAGE }}:latest'

      - name: Show release bundle summary
        run: |
          ls -lh dist