timka123andClaude Opus 5
bc6ff3c489
Four workflows, none of which existed: * `tests.yml` — backend, desktop, `:core` and the web app's typecheck+build, in parallel. `:core` needs no Android SDK at all, because settings.gradle.kts leaves `:app` out when there is none; `:app`'s Robolectric suite therefore lives in the APK workflow, where the SDK is installed anyway. Nothing needs a running backend — the suites feed on committed fixtures, which is the whole reason they were written that way. * `lint.yml` — ruff, which the repo had been configured for and never run. * `docker.yml` — builds the image, *starts* it against SQLite and waits for /api/health before pushing, then publishes `:latest` and `:<short-sha>` to git.timka.su. A tag nobody can run is worse than no tag. * `android-release.yml` — the release APK on every push to master, signed from secrets, with `apksigner verify --print-certs` reporting which key was really used and failing if it was the debug one. Three things the repo needed before any of that could work: `versionCode` was pinned at 1, so every APK looked like the same version to the phone and would not install over its predecessor. It now comes from the run number, with `versionName` from a property, both via one `setting()` helper that reads a Gradle property or an environment variable. The release build fell back to the *debug* signing key whenever the keystore was missing — silently. That is a trap: the APK installs, looks fine, and can never be upgraded by a properly signed build. `KADENCE_REQUIRE_SIGNING=1` makes that case fail the build instead, and the release job sets it whenever a keystore secret is present. The compose files built an image with no name, so there was nothing to pull. `image:` now names the registry tag while `up --build` still builds locally. Also: `android/ci/install-sdk.sh` (idempotent, cacheable, and the one place that knows `platforms;android-37.0` is spelled with the minor version), the runner as a compose service with its config and a setup checklist, six make targets, and a README section. No runner is registered yet — `make ci-runner` is step two of that checklist. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
71 lines
2.3 KiB
YAML
71 lines
2.3 KiB
YAML
# Build the backend + web image and push it to this Gitea's own registry.
|
|
#
|
|
# The image is the same one `docker compose` builds locally — one Dockerfile,
|
|
# two stages, Vite's output baked in and served from the same origin as the API.
|
|
# Tagged twice: `latest` for the deploy script to pull, and the short commit for
|
|
# every build to be nameable after the fact.
|
|
#
|
|
# Needs a runner that can reach a docker daemon. The compose service in
|
|
# `docker-compose.ci.yml` mounts the host's socket into the job container, which
|
|
# is the usual arrangement for a single-machine Gitea.
|
|
name: docker
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
tags: ["v*"]
|
|
|
|
env:
|
|
REGISTRY: git.timka.su
|
|
IMAGE: git.timka.su/timka123/kadence
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Check the daemon is reachable
|
|
run: docker version
|
|
|
|
- name: Log in to the Gitea registry
|
|
run: |
|
|
echo "${{ secrets.REGISTRY_TOKEN }}" \
|
|
| docker login "$REGISTRY" -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
|
|
- name: Build
|
|
run: |
|
|
SHORT="$(git rev-parse --short HEAD)"
|
|
echo "SHORT=$SHORT" >> "$GITHUB_ENV"
|
|
docker build -t "$IMAGE:$SHORT" -t "$IMAGE:latest" .
|
|
|
|
- name: Smoke-test the image before it is published
|
|
run: |
|
|
# A tag nobody can run is worse than no tag. SQLite keeps this to one
|
|
# container: no database service, no network, no .env.
|
|
docker run -d --name kadence-smoke \
|
|
-e DATABASE_URL="sqlite:///./kadence.db" \
|
|
-e SCHEDULER_ENABLED=0 -e TELEGRAM_BOT_ENABLED=0 \
|
|
-p 18000:8000 "$IMAGE:$SHORT"
|
|
for _ in $(seq 1 30); do
|
|
if curl -fsS http://127.0.0.1:18000/api/health >/dev/null 2>&1; then
|
|
echo "healthy"; break
|
|
fi
|
|
sleep 2
|
|
done
|
|
curl -fsS http://127.0.0.1:18000/api/health
|
|
docker logs kadence-smoke | tail -20
|
|
docker rm -f kadence-smoke
|
|
|
|
- name: Push
|
|
run: |
|
|
docker push "$IMAGE:$SHORT"
|
|
docker push "$IMAGE:latest"
|
|
|
|
- name: Push the tag, when there is one
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
run: |
|
|
VERSION="${GITHUB_REF#refs/tags/}"
|
|
docker tag "$IMAGE:$SHORT" "$IMAGE:$VERSION"
|
|
docker push "$IMAGE:$VERSION"
|