9326177534
3 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| 9326177534 |
#236: also pin the node helper images in workflows
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 5m41s
CI / Build container images (pull_request) Successful in 3m9s
CI / Auth e2e pack (pull_request) Successful in 8m32s
CI / Import/export fidelity gate (pull_request) Successful in 1m7s
CD / Build and push images (push) Successful in 21s
CD / Deploy to Test (push) Successful in 12s
CD / Smoke tests against Test (push) Successful in 1m17s
CD / Promote to Int (push) Successful in 11s
CI / Lint, typecheck, test (push) Successful in 6m0s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m32s
CI / Import/export fidelity gate (push) Successful in 1m3s
release.yml and drill.yml ran throwaway `docker run node:22.15-alpine` helpers outside the pin; the drift check now also fails on any node:<other>-alpine reference in .gitea/workflows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ |
|||
| a9e901c449 |
Run operations QA on every release candidate before the prod gate (#90)
All checks were successful
Release / Build release images and notes (push) Successful in 1m8s
CD / Build and push images (push) Successful in 1m9s
CD / Deploy to Test (push) Successful in 9s
Release / Release-candidate operations QA (push) Successful in 41s
CD / Smoke tests against Test (push) Successful in 1m10s
CD / Promote to Int (push) Successful in 10s
Prod deploy / Deploy the released images to Prod (push) Successful in 15s
CI / Lint, typecheck, test (push) Successful in 3m35s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 5m32s
CI / Import/export fidelity gate (push) Successful in 48s
New deploy/release-qa.sh, wired as the release workflow's second job: it boots the PREVIOUS release with pre-seeded fixture content in a scratch environment, swaps the api to the candidate against the same database (migrations auto-apply, readiness green, content intact — the seed_fixture/assert_fixture pair is the update-fixture contract future migrations extend), asserts the degraded-readyz semantics on the candidate (200 + warn-level checks without sidecars), and runs a full backup/restore roundtrip with the candidate's sidecar into a second, empty database. The wizard e2e already guards fresh installs in CI (issue #81). Verified green on the host for v0.1.0→v0.1.1; a simulated destructive migration made the suite fail loudly (negative test, not committed). A human pushes the prod tag only when both release jobs are green — the documented pre-approval gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1 |
|||
| 28f05e270d |
Add the release pipeline with a tag-based manual gate and Prod stack (#89)
All checks were successful
CD / Build and push images (push) Successful in 1m5s
CD / Deploy to Test (push) Successful in 9s
CD / Smoke tests against Test (push) Successful in 1m6s
CD / Promote to Int (push) Successful in 10s
CI / Lint, typecheck, test (push) Successful in 3m33s
CI / Build container images (push) Has been skipped
Release / Build release images and notes (push) Successful in 1m1s
Prod deploy / Deploy the released images to Prod (push) Successful in 14s
CI / Auth e2e pack (push) Successful in 5m31s
CI / Import/export fidelity gate (push) Successful in 47s
Pushing vX.Y.Z builds the four semver images and publishes a Gitea release whose notes list the changes since the previous release with a migration call-out derived from the migrations diff (the repo is trunk-based — commit subjects stand in for PR titles). Deploying to Prod is a separate human act: pushing prod-vX.Y.Z-<suffix> — Gitea 1.22 has no environment approvals, so the tag push is the gate — verifies the release images exist, pins TAG in the Prod .env, restarts the stack, and waits for readiness; rollbacks are new suffix tags on the previous release. The Prod stage is provisioned on ONE (ports 8120-8122, secrets generated on the host, full backup profile); deploy/go-live.md carries the executed mechanics and the operator checklist that blocks the DNS switch (DNS, Caddy block, wizard/SMTP, legal texts, monitors, Prod drill, BASEL mirror). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1 |
