Phase 0: repo skeleton, image, compose stacks, doctor, migration runner, frontend shell
New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16, React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated from the M: install. - CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN, SECURITY rewritten for the server with the requirement ID table, DEPLOY, stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK). - packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version, healthcheck. Settings from the environment with secret files. Stack guard (test never points at VISUAL production). Security headers and CSP. Trusted proxy resolved by name. JSON logs with redaction. - Migration runner and 0001_base: settings, append-only audit_events with hash chain, ps_notify, grants for ps_app. - Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea index only), compose base, proxy overlay for npm_default, CI overlay, postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions. - Frontend: Vite, React, TypeScript, the PESCO dark theme ported with self-hosted fonts, placeholder sign-in and home. - Verified on docker-1: image builds, CI stack comes up healthy, doctor database checks pass, 77 server tests pass against PostgreSQL. Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
Claude Fable 5.1
@@ -0,0 +1,153 @@
|
||||
# Packet Station CI. Runs on every push to main, every v* tag and every pull request.
|
||||
# server and frontend run in parallel. image builds and pushes :sha-<sha> only on a push to
|
||||
# main or a v* tag, after both pass. release.yml re-tags that image. Nothing is ever :latest.
|
||||
name: ci
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
tags: ["v*"]
|
||||
pull_request:
|
||||
|
||||
env:
|
||||
REGISTRY: gt.pescoinc.biz
|
||||
IMAGE_NAME: gt.pescoinc.biz/spencerm/packetstation
|
||||
# PESCO's Gitea index. It serves visualkit, mfileskit and their dependencies only.
|
||||
PESCO_INDEX_URL: https://gt.pescoinc.biz/api/packages/spencerm/pypi/simple/
|
||||
|
||||
jobs:
|
||||
server:
|
||||
runs-on: ubuntu-latest
|
||||
services:
|
||||
# Throwaway database for the tests. Trust auth inside the job network, so no password.
|
||||
postgres:
|
||||
image: postgres:16-bookworm
|
||||
env:
|
||||
POSTGRES_HOST_AUTH_METHOD: trust
|
||||
options: >-
|
||||
--health-cmd "pg_isready -U postgres"
|
||||
--health-interval 5s
|
||||
--health-timeout 5s
|
||||
--health-retries 20
|
||||
env:
|
||||
# act_runner runs the job in a container on the service network, so the host is "postgres".
|
||||
TEST_PG_SUPERUSER_URL: postgresql://postgres@postgres:5432/postgres
|
||||
STACK: ci
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: "3.12"
|
||||
cache: pip
|
||||
cache-dependency-path: |
|
||||
server/requirements.txt
|
||||
server/requirements-pesco.txt
|
||||
|
||||
- name: unixODBC for pyodbc imports
|
||||
run: |
|
||||
set -euo pipefail
|
||||
sudo_cmd=""
|
||||
if [ "$(id -u)" != "0" ]; then sudo_cmd="sudo"; fi
|
||||
$sudo_cmd apt-get update
|
||||
$sudo_cmd apt-get install -y --no-install-recommends unixodbc
|
||||
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
set -euo pipefail
|
||||
python -m pip install --upgrade pip
|
||||
# Public packages from PyPI.
|
||||
pip install -r server/requirements.txt
|
||||
# PESCO packages from Gitea only. Never --extra-index-url.
|
||||
pip install --index-url "$PESCO_INDEX_URL" -r server/requirements-pesco.txt
|
||||
# The package itself, editable, with its dependencies already in place.
|
||||
pip install --no-deps -e .
|
||||
# Dev tools from pyproject's dev extra, installed by name so pip never
|
||||
# resolves visualkit or mfileskit against PyPI.
|
||||
python -c 'import tomllib; print("\n".join(tomllib.load(open("pyproject.toml", "rb"))["project"]["optional-dependencies"]["dev"]))' > "$RUNNER_TEMP/dev-requirements.txt"
|
||||
pip install -r "$RUNNER_TEMP/dev-requirements.txt"
|
||||
pip check
|
||||
|
||||
- name: Lint (ruff)
|
||||
run: |
|
||||
ruff check .
|
||||
ruff format --check .
|
||||
|
||||
- name: Types (mypy)
|
||||
run: mypy
|
||||
|
||||
- name: Tests (pytest)
|
||||
run: pytest
|
||||
|
||||
frontend:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: frontend
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: "22"
|
||||
cache: npm
|
||||
cache-dependency-path: frontend/package-lock.json
|
||||
|
||||
- name: Install
|
||||
run: npm ci --no-audit --no-fund
|
||||
- name: Lint
|
||||
run: npm run lint
|
||||
- name: Types (tsc)
|
||||
run: npm run typecheck
|
||||
- name: Unit tests
|
||||
run: npm test
|
||||
- name: Build
|
||||
run: npm run build
|
||||
|
||||
image:
|
||||
needs: [server, frontend]
|
||||
if: gitea.event_name == 'push' && (gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/tags/v'))
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
|
||||
- uses: docker/login-action@v3
|
||||
with:
|
||||
registry: ${{ env.REGISTRY }}
|
||||
username: ${{ secrets.REGISTRY_USER }}
|
||||
password: ${{ secrets.REGISTRY_TOKEN }}
|
||||
|
||||
- name: Build and push sha image
|
||||
uses: docker/build-push-action@v6
|
||||
with:
|
||||
context: .
|
||||
file: Dockerfile
|
||||
platforms: linux/amd64
|
||||
push: true
|
||||
tags: ${{ env.IMAGE_NAME }}:sha-${{ gitea.sha }}
|
||||
build-args: |
|
||||
PS_BUILD=sha-${{ gitea.sha }}
|
||||
cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
|
||||
cache-to: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache,mode=max
|
||||
provenance: false
|
||||
|
||||
# Phase 1: end to end. Compose up with the CI overlay and the Samba DC, seed fixtures,
|
||||
# run the Playwright scenarios, upload the report, then down -v.
|
||||
# e2e:
|
||||
# needs: [server, frontend]
|
||||
# runs-on: ubuntu-latest
|
||||
# steps:
|
||||
# - uses: actions/checkout@v4
|
||||
# - run: deploy/ci/make-secrets.sh
|
||||
# - run: >-
|
||||
# docker compose -p packetstation-ci --env-file deploy/ci/ci.env
|
||||
# -f deploy/compose.yaml -f deploy/compose.ci.yaml up -d --build --wait
|
||||
# - run: >-
|
||||
# docker compose -p packetstation-ci --env-file deploy/ci/ci.env
|
||||
# -f deploy/compose.yaml -f deploy/compose.ci.yaml --profile e2e run --rm playwright
|
||||
# - if: always()
|
||||
# run: >-
|
||||
# docker compose -p packetstation-ci --env-file deploy/ci/ci.env
|
||||
# -f deploy/compose.yaml -f deploy/compose.ci.yaml down -v
|
||||
Reference in New Issue
Block a user