Template
Gabriel Brown
2356383da1
Rootless podman on cirunner-vps cannot copy cached actions into job containers (symlinks: "path escapes from parent"), so any job that landed there failed. Checkout is now plain git and Bun comes from its install script; both are verified on cirunner-vps.
109 lines
4.1 KiB
YAML
109 lines
4.1 KiB
YAML
name: Build and Push Next App
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- 'apps/next/**'
|
|
- 'packages/**'
|
|
- 'tools/**'
|
|
- 'scripts/**'
|
|
- 'docker/**'
|
|
- '.gitea/workflows/build-next.yml'
|
|
- 'package.json'
|
|
- 'bun.lock'
|
|
- 'turbo.json'
|
|
|
|
# One image build at a time; a newer push waits rather than racing.
|
|
concurrency:
|
|
group: build-next
|
|
cancel-in-progress: false
|
|
|
|
# This template is not deployed. CI runs the quality gate and builds and pushes
|
|
# the image so the template stays known-good. Env comes from the Infisical
|
|
# `staging` environment: each job logs in as the read-only
|
|
# `convexmonorepo-base-ci` machine identity and writes it to a temp file
|
|
# (scripts/ci-export-env.mjs), so no values live in Gitea.
|
|
jobs:
|
|
# Quality gate: workspace lint (sherif), eslint, typecheck and the unit,
|
|
# integration and component suites must pass before anything touches
|
|
# production. The local-stack e2e smoke check is skipped in CI.
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
# Plain git instead of actions/checkout: rootless podman on cirunner-vps
|
|
# rejects symlinks inside cached actions ("path escapes from parent").
|
|
env:
|
|
GITEA_TOKEN: ${{ gitea.token }}
|
|
run: |
|
|
git init -q .
|
|
git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
|
|
auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
|
|
git -c http.extraHeader="Authorization: basic $auth" \
|
|
fetch -q --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Set up Bun
|
|
# Install script instead of oven-sh/setup-bun (same podman symlink issue).
|
|
run: |
|
|
curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.14" >/dev/null
|
|
echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Install dependencies
|
|
run: ./scripts/ci-install
|
|
|
|
- name: Lint and typecheck
|
|
env:
|
|
INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
|
|
INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
|
|
run: |
|
|
env_file="$(mktemp)"
|
|
trap 'rm -f "$env_file"' EXIT
|
|
node scripts/ci-export-env.mjs staging > "$env_file"
|
|
bunx dotenv -e "$env_file" -- env NODE_ENV=test SKIP_E2E=1 bun run ci:check
|
|
|
|
build-next:
|
|
needs: [quality]
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
# Plain git instead of actions/checkout: rootless podman on cirunner-vps
|
|
# rejects symlinks inside cached actions ("path escapes from parent").
|
|
env:
|
|
GITEA_TOKEN: ${{ gitea.token }}
|
|
run: |
|
|
git init -q .
|
|
git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
|
|
auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
|
|
git -c http.extraHeader="Authorization: basic $auth" \
|
|
fetch -q --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
- name: Log in to container registry
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build app using project script
|
|
env:
|
|
INFISICAL_CLIENT_ID: ${{ secrets.INFISICAL_CLIENT_ID }}
|
|
INFISICAL_CLIENT_SECRET: ${{ secrets.INFISICAL_CLIENT_SECRET }}
|
|
run: |
|
|
env_file="$(mktemp)"
|
|
trap 'rm -f "$env_file"' EXIT
|
|
node scripts/ci-export-env.mjs staging > "$env_file"
|
|
CI_ENV_FILE="$env_file" ./scripts/build-next-app staging
|
|
|
|
- name: Tag built image
|
|
run: |
|
|
docker tag convexmonorepo-no-payload-next:latest git.gbrown.org/gib/convexmonorepo-no-payload-next:${{ gitea.sha }}
|
|
docker tag convexmonorepo-no-payload-next:latest git.gbrown.org/gib/convexmonorepo-no-payload-next:latest
|
|
|
|
- name: Push image tags
|
|
run: |
|
|
docker push git.gbrown.org/gib/convexmonorepo-no-payload-next:${{ gitea.sha }}
|
|
docker push git.gbrown.org/gib/convexmonorepo-no-payload-next:latest
|