spencermandClaude Fable 5.1
0b663bb2b2
New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16, React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated from the M: install. - CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN, SECURITY rewritten for the server with the requirement ID table, DEPLOY, stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK). - packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version, healthcheck. Settings from the environment with secret files. Stack guard (test never points at VISUAL production). Security headers and CSP. Trusted proxy resolved by name. JSON logs with redaction. - Migration runner and 0001_base: settings, append-only audit_events with hash chain, ps_notify, grants for ps_app. - Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea index only), compose base, proxy overlay for npm_default, CI overlay, postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions. - Frontend: Vite, React, TypeScript, the PESCO dark theme ported with self-hosted fonts, placeholder sign-in and home. - Verified on docker-1: image builds, CI stack comes up healthy, doctor database checks pass, 77 server tests pass against PostgreSQL. Co-Authored-By: Claude Fable 5.1 <[email protected]>
60 lines
1.8 KiB
YAML
60 lines
1.8 KiB
YAML
# Release: on a v* tag, give the already tested :sha-<sha> image the version tag.
|
|
# Nothing is rebuilt, so production runs the exact image CI tested. Never tags :latest.
|
|
# ci.yml pushes :sha-<sha> for the same tag push. This job waits for it.
|
|
name: release
|
|
|
|
on:
|
|
push:
|
|
tags: ["v*"]
|
|
|
|
env:
|
|
REGISTRY: gt.pescoinc.biz
|
|
IMAGE_NAME: gt.pescoinc.biz/spencerm/packetstation
|
|
|
|
jobs:
|
|
retag:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: docker/setup-buildx-action@v3
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ secrets.REGISTRY_USER }}
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
- name: Check the tag name
|
|
env:
|
|
TAG: ${{ gitea.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
if ! printf '%s' "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.]+)?$'; then
|
|
echo "Tag $TAG is not vX.Y.Z" >&2
|
|
exit 1
|
|
fi
|
|
|
|
- name: Wait for the tested sha image
|
|
env:
|
|
SRC: ${{ env.IMAGE_NAME }}:sha-${{ gitea.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
# ci.yml builds it only after the server and frontend jobs pass. Wait up to 60 minutes.
|
|
for i in $(seq 1 120); do
|
|
if docker buildx imagetools inspect "$SRC" > /dev/null 2>&1; then
|
|
echo "Found $SRC"
|
|
exit 0
|
|
fi
|
|
sleep 30
|
|
done
|
|
echo "$SRC never appeared. Did CI fail for this commit?" >&2
|
|
exit 1
|
|
|
|
- name: Re-tag as the version
|
|
env:
|
|
SRC: ${{ env.IMAGE_NAME }}:sha-${{ gitea.sha }}
|
|
DST: ${{ env.IMAGE_NAME }}:${{ gitea.ref_name }}
|
|
run: |
|
|
set -euo pipefail
|
|
docker buildx imagetools create --tag "$DST" "$SRC"
|
|
docker buildx imagetools inspect "$DST"
|