Claude Fable 5
9326177534
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 5m41s
CI / Build container images (pull_request) Successful in 3m9s
CI / Auth e2e pack (pull_request) Successful in 8m32s
CI / Import/export fidelity gate (pull_request) Successful in 1m7s
CD / Build and push images (push) Successful in 21s
CD / Deploy to Test (push) Successful in 12s
CD / Smoke tests against Test (push) Successful in 1m17s
CD / Promote to Int (push) Successful in 11s
CI / Lint, typecheck, test (push) Successful in 6m0s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m32s
CI / Import/export fidelity gate (push) Successful in 1m3s
release.yml and drill.yml ran throwaway `docker run node:22.15-alpine` helpers outside the pin; the drift check now also fails on any node:<other>-alpine reference in .gitea/workflows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ
88 lines
3.6 KiB
YAML
88 lines
3.6 KiB
YAML
# Release build (ADR 0014, issue #89): pushing a semver tag `vX.Y.Z` builds
|
|
# and pushes the immutable release images and publishes a Gitea release
|
|
# whose notes list the changes since the previous release, with a call-out
|
|
# when the release contains database migrations (the `migration` marker the
|
|
# update guide promises). Deploying to Prod is a SEPARATE, manual step:
|
|
# after reviewing the release, push a `prod-vX.Y.Z-<suffix>` tag
|
|
# (prod-deploy.yml) — that tag push is the manual approval gate, since
|
|
# Gitea 1.22 has no environment approvals (revisit on 1.23+).
|
|
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags: ['v*.*.*']
|
|
|
|
env:
|
|
IMAGE_BASE: gitea.101010.cloud/stwaidele/dorfteich
|
|
|
|
jobs:
|
|
build-release:
|
|
name: Build release images and notes
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Log in to the Gitea registry
|
|
run: printf '%s' "${{ secrets.REGISTRY_TOKEN }}" | tr -d '[:space:]' | docker login gitea.101010.cloud -u fable-5 --password-stdin
|
|
|
|
- name: Build and push semver images
|
|
run: |
|
|
TAG=${GITHUB_REF_NAME}
|
|
for app in web api collab backup; do
|
|
docker build -f apps/$app/Dockerfile --build-arg APP_VERSION=$TAG \
|
|
-t $IMAGE_BASE-$app:$TAG .
|
|
docker push $IMAGE_BASE-$app:$TAG
|
|
done
|
|
|
|
- name: Generate release notes and publish the release
|
|
run: |
|
|
TAG=${GITHUB_REF_NAME}
|
|
PREV=$(git tag --list 'v*.*.*' --sort=-v:refname | grep -vx "$TAG" | head -n1 || true)
|
|
RANGE=${PREV:+$PREV..}$TAG
|
|
{
|
|
echo "## Changes since ${PREV:-the beginning}"
|
|
echo
|
|
git log --no-merges --pretty='- %s' $RANGE
|
|
echo
|
|
if git diff --name-only ${PREV:-$(git hash-object -t tree /dev/null)} $TAG -- apps/api/prisma/migrations/ | grep -q .; then
|
|
echo '> ⚠️ **migration** — this release applies database migrations automatically at api start. Downgrade window: one minor release (docs/self-hosting).'
|
|
else
|
|
echo '_No database migrations in this release._'
|
|
fi
|
|
} > notes.md
|
|
TAG=$TAG docker run --rm -i -e TAG node:22.15.1-alpine node -e \
|
|
'const fs=require("fs");const body=fs.readFileSync(0,"utf8");process.stdout.write(JSON.stringify({tag_name:process.env.TAG,name:process.env.TAG,body}))' \
|
|
< notes.md > release.json
|
|
curl -sf -X POST \
|
|
-H "Authorization: token ${{ github.token }}" \
|
|
-H 'Content-Type: application/json' \
|
|
--data @release.json \
|
|
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases" \
|
|
> /dev/null && echo "release $TAG published"
|
|
|
|
# Operations QA (issue #90): the pre-approval gate. A human pushes the
|
|
# prod-vX.Y.Z tag only after BOTH jobs of this release run are green.
|
|
ops-qa:
|
|
name: Release-candidate operations QA
|
|
needs: build-release
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Log in to the Gitea registry
|
|
run: printf '%s' "${{ secrets.REGISTRY_TOKEN }}" | tr -d '[:space:]' | docker login gitea.101010.cloud -u fable-5 --password-stdin
|
|
|
|
- name: Run update simulation, degraded readiness, and backup roundtrip
|
|
run: |
|
|
PREV=$(git tag --list 'v*.*.*' --sort=-v:refname | grep -vx "$GITHUB_REF_NAME" | head -n1 || true)
|
|
NEXT_TAG=$GITHUB_REF_NAME PREV_TAG=$PREV IMAGE_BASE=$IMAGE_BASE \
|
|
sh deploy/release-qa.sh
|