118 lines
4.3 KiB
YAML
118 lines
4.3 KiB
YAML
name: Community Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*"
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: git.itexp.me
|
|
IMAGE_TAG: ${{ gitea.ref_name }}
|
|
ADMIN_API_IMAGE: git.itexp.me/bsodfather/crank-community-admin-api
|
|
MCP_SERVER_IMAGE: git.itexp.me/bsodfather/crank-community-mcp-server
|
|
UI_IMAGE: git.itexp.me/bsodfather/crank-community-ui
|
|
OPENBAO_ENV_FILE: .openbao-env
|
|
|
|
jobs:
|
|
release:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v5
|
|
|
|
- name: Use preinstalled Rust toolchain
|
|
run: |
|
|
set -eu
|
|
toolchain_dir="${RUSTUP_HOME:-$HOME/.rustup}/toolchains/1.96.1-x86_64-unknown-linux-gnu"
|
|
toolchain_bin="$toolchain_dir/bin"
|
|
if [ ! -x "$toolchain_bin/rustc" ] || [ ! -x "$toolchain_bin/cargo" ]; then
|
|
echo "Rust 1.96.1 is not preinstalled at $toolchain_dir." >&2
|
|
echo "Install it in the Gitea runner image/host before running CI:" >&2
|
|
echo "rustup toolchain install 1.96.1 --profile minimal --component clippy --component rustfmt" >&2
|
|
exit 1
|
|
fi
|
|
printf '%s\n' "$toolchain_bin" >> "$GITHUB_PATH"
|
|
"$toolchain_bin/rustc" --version
|
|
"$toolchain_bin/cargo" --version
|
|
"$toolchain_bin/rustfmt" --version
|
|
"$toolchain_bin/cargo-clippy" --version
|
|
|
|
- name: Verify runner toolchain
|
|
run: |
|
|
rustc --version
|
|
cargo --version
|
|
node --version
|
|
npm --version
|
|
docker --version
|
|
command -v bao
|
|
bao version
|
|
|
|
- name: Build release binaries
|
|
run: cargo build --release -p admin-api -p mcp-server
|
|
|
|
- name: Install UI dependencies
|
|
working-directory: apps/ui
|
|
run: npm ci
|
|
|
|
- name: Build UI dist
|
|
working-directory: apps/ui
|
|
run: npm run build
|
|
|
|
- name: Package release artifacts
|
|
run: |
|
|
mkdir -p dist/release
|
|
cp target/release/admin-api dist/release/admin-api
|
|
cp target/release/mcp-server dist/release/mcp-server
|
|
tar -C dist/release -czf dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz admin-api
|
|
tar -C dist/release -czf dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz mcp-server
|
|
tar -C apps/ui/dist -czf dist/crank-community-ui-${IMAGE_TAG}.tar.gz .
|
|
sha256sum \
|
|
dist/crank-community-admin-api-${IMAGE_TAG}.tar.gz \
|
|
dist/crank-community-mcp-server-${IMAGE_TAG}.tar.gz \
|
|
dist/crank-community-ui-${IMAGE_TAG}.tar.gz \
|
|
> dist/crank-community-${IMAGE_TAG}-checksums.txt
|
|
|
|
- name: Generate SBOM
|
|
run: |
|
|
docker run --rm -v "$PWD:/workspace" anchore/syft:latest \
|
|
dir:/workspace -o spdx-json \
|
|
> dist/crank-community-${IMAGE_TAG}-sbom.spdx.json
|
|
|
|
- name: Load deployment secrets from OpenBao
|
|
env:
|
|
BAO_ADDR: ${{ secrets.BAO_ADDR }}
|
|
BAO_ROLE_ID: ${{ secrets.BAO_ROLE_ID }}
|
|
BAO_SECRET_ID: ${{ secrets.BAO_SECRET_ID }}
|
|
OPENBAO_APP: crank
|
|
run: scripts/load-openbao-env.sh
|
|
|
|
- name: Login to registry
|
|
run: |
|
|
. "$OPENBAO_ENV_FILE"
|
|
printf '%s' "$DEPLOY_REGISTRY_TOKEN" | \
|
|
docker login '${{ env.REGISTRY }}' -u "$DEPLOY_REGISTRY_USER" --password-stdin
|
|
|
|
- name: Build and push release images
|
|
run: |
|
|
docker build -f apps/admin-api/Dockerfile \
|
|
-t '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}' \
|
|
-t '${{ env.ADMIN_API_IMAGE }}:latest' .
|
|
docker build -f apps/mcp-server/Dockerfile \
|
|
-t '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}' \
|
|
-t '${{ env.MCP_SERVER_IMAGE }}:latest' .
|
|
docker build -f apps/ui/Dockerfile \
|
|
-t '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}' \
|
|
-t '${{ env.UI_IMAGE }}:latest' .
|
|
docker push '${{ env.ADMIN_API_IMAGE }}:${{ env.IMAGE_TAG }}'
|
|
docker push '${{ env.ADMIN_API_IMAGE }}:latest'
|
|
docker push '${{ env.MCP_SERVER_IMAGE }}:${{ env.IMAGE_TAG }}'
|
|
docker push '${{ env.MCP_SERVER_IMAGE }}:latest'
|
|
docker push '${{ env.UI_IMAGE }}:${{ env.IMAGE_TAG }}'
|
|
docker push '${{ env.UI_IMAGE }}:latest'
|
|
|
|
- name: Show release bundle summary
|
|
run: |
|
|
ls -lh dist
|