294 lines
14 KiB
YAML
294 lines
14 KiB
YAML
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
workflow_dispatch:
|
|
|
|
# One deploy at a time; if you push twice quickly, cancel the older run so the
|
|
# newest commit is what lands on the server.
|
|
concurrency:
|
|
group: deploy
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build-deploy:
|
|
runs-on: arch-latest
|
|
steps:
|
|
- name: Install build dependencies
|
|
run: |
|
|
# Same keyring bootstrap the Crafter.Build CI does: the slim
|
|
# archlinux:latest image ships without a populated pacman keyring
|
|
# or local master key.
|
|
pacman-key --init
|
|
pacman-key --populate archlinux
|
|
pacman -Sy --noconfirm --needed archlinux-keyring
|
|
# nodejs is required for the JS-based actions (checkout, cache) to
|
|
# run inside this archlinux container — the runner execs them with
|
|
# node. This shell step needs no node, so installing it here (before
|
|
# Checkout) is enough.
|
|
# ffmpeg is for ffprobe, which tools/fetch-media.sh uses to read the
|
|
# pixel dimensions of each mirrored file. Those become the width/height
|
|
# attributes that stop the posts page reflowing as 5 MB recordings
|
|
# arrive, and tools/e2e.sh asserts they are present — so without this
|
|
# package the deploy fails at the e2e gate rather than shipping a
|
|
# janky page.
|
|
pacman -Syu --noconfirm --needed \
|
|
nodejs \
|
|
clang lld libc++ \
|
|
wasi-libc wasi-libc++ wasi-libc++abi wasi-compiler-rt \
|
|
git curl tar rsync zstd gzip jq openssl ffmpeg gnupg
|
|
# Container runs as root; workspace may be owned by another uid.
|
|
git config --global --add safe.directory '*'
|
|
|
|
- name: Install crafter-build
|
|
# Pull the rolling 'latest' Linux build from the Crafter.Build repo and
|
|
# install it distro-style so it auto-discovers its modules under
|
|
# /usr/share/crafter-build. v2 = SSE4.2 baseline, safe on the CI SBC.
|
|
run: |
|
|
set -eux
|
|
url="https://forgejo.catcrafts.net/Catcrafts/Crafter.Build/releases/download/latest/crafter-build-linux-x86_64-v2.tar.gz"
|
|
mkdir -p /tmp/cb
|
|
curl -fsSL "$url" -o /tmp/cb.tar.gz
|
|
tar -xzf /tmp/cb.tar.gz -C /tmp/cb
|
|
install -Dm755 /tmp/cb/bin/crafter-build /usr/bin/crafter-build
|
|
cp -r /tmp/cb/share/crafter-build /usr/share/
|
|
crafter-build --version || true
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Cache crafter-build dependency clones
|
|
# ~/.cache/crafter.build holds the Crafter.Graphics clone and prebuilt
|
|
# module cache. crafter-build still git-pulls the dep each run, so a
|
|
# stale cache only means a smaller delta fetch, never a stale build.
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: ~/.cache/crafter.build
|
|
key: crafter-cache-${{ runner.os }}-${{ hashFiles('project.cpp') }}
|
|
restore-keys: |
|
|
crafter-cache-${{ runner.os }}-
|
|
|
|
- name: Fetch ECB reference rates
|
|
# Feeds the indicative national-currency line on order pages. Every
|
|
# charge is in euros; this is display only, labelled with its date —
|
|
# which is why build-time freshness is enough and no rate service is
|
|
# ever called at page-view time. Exits 0 on failure: a stale rate
|
|
# (or none — the page then shows only euros) must not fail a deploy.
|
|
run: tools/fetch-rates.sh
|
|
|
|
- name: Fetch fediverse posts
|
|
# Build-time, not run-time: the site embeds the owner's own posts and
|
|
# links out for discussion, so there is no sync service and no runtime
|
|
# dependency on the instance being up. The script leaves the committed
|
|
# content/posts.json untouched and exits 0 on any failure, so a
|
|
# fediverse outage cannot fail a deploy.
|
|
run: tools/fetch-posts.sh
|
|
|
|
- name: Mirror post media
|
|
# Downloads the images and screen recordings the posts carry and rewrites
|
|
# content/posts.json to point at our own copies, so nothing the browser
|
|
# loads is third-party — which is what keeps the privacy notice's
|
|
# "everything comes from catcrafts.net" true.
|
|
#
|
|
# Content-addressed and incremental: a file already on the media mount is
|
|
# never downloaded again. Writes straight into the mount so the copies
|
|
# persist across deploys — they are NOT always reproducible, because a
|
|
# source instance deleting a file leaves ours as the only one.
|
|
run: |
|
|
set -eu
|
|
if [ -d /deploy-app ]; then
|
|
mkdir -p /deploy-app/media
|
|
tools/fetch-media.sh /deploy-app/media
|
|
else
|
|
echo "WARNING: /deploy-app not mounted; mirroring to a throwaway dir." >&2
|
|
echo "Media will be re-downloaded on every build until the mount exists." >&2
|
|
tools/fetch-media.sh media
|
|
fi
|
|
|
|
- name: Build and test the backend
|
|
id: srv
|
|
# The server product builds Catcrafts.Shared for the host, which is the
|
|
# only way to actually RUN the code that generates every byte of markup
|
|
# the site emits. --selftest is a gate: if escaping or the JSON reader
|
|
# regress, the deploy stops here rather than shipping broken pages.
|
|
#
|
|
# Same refuse-to-guess rule as the wasm bundle below: a variant
|
|
# directory embeds a config hash, so more than one match means the tree
|
|
# is ambiguous and picking the first would deploy an arbitrary build.
|
|
run: |
|
|
set -eux
|
|
crafter-build -- --product=server
|
|
matches=$(find bin -maxdepth 1 -type d -name 'Catcrafts.Server-*' | sort)
|
|
count=$(printf '%s\n' "$matches" | grep -c . || true)
|
|
if [ "$count" -ne 1 ]; then
|
|
echo "Expected exactly one Catcrafts.Server-* directory, found $count:" >&2
|
|
printf '%s\n' "$matches" >&2
|
|
exit 1
|
|
fi
|
|
echo "srv=$matches" >> "$GITHUB_OUTPUT"
|
|
"$matches/catcrafts-server" --selftest
|
|
"$matches/catcrafts-server" --routes
|
|
|
|
- name: Generate sitemap and Atom feed
|
|
# Both come from the same route table and Post model the pages use, so
|
|
# they cannot drift from what the site serves. Generated BEFORE the wasm
|
|
# build so cfg.files picks them up into the bundle.
|
|
env:
|
|
SRV: ${{ steps.srv.outputs.srv }}
|
|
run: |
|
|
set -eux
|
|
"$SRV/catcrafts-server" --sitemap > sitemap.xml
|
|
"$SRV/catcrafts-server" --feed > feed.xml
|
|
head -n 4 sitemap.xml
|
|
|
|
- name: Build (wasm bundle)
|
|
run: crafter-build
|
|
|
|
- name: Locate build output
|
|
id: out
|
|
run: |
|
|
set -eu
|
|
# The directory name embeds a config hash, so glob for it. Any change
|
|
# to compile/link flags produces a NEW hash, which is why we refuse to
|
|
# guess when more than one variant is present rather than taking
|
|
# whichever the filesystem happened to list first.
|
|
matches=$(find bin -maxdepth 1 -type d -name 'Catcrafts.Net-wasm32-wasip1-*' | sort)
|
|
count=$(printf '%s\n' "$matches" | grep -c . || true)
|
|
if [ "$count" -eq 0 ]; then
|
|
echo "No build output directory found under bin/" >&2
|
|
ls -la bin || true
|
|
exit 1
|
|
fi
|
|
if [ "$count" -gt 1 ]; then
|
|
echo "Ambiguous build output — $count variant directories under bin/:" >&2
|
|
printf '%s\n' "$matches" >&2
|
|
echo "Refusing to guess which one to deploy. Clean bin/ and rebuild." >&2
|
|
exit 1
|
|
fi
|
|
dist=$matches
|
|
echo "dist=$dist" >> "$GITHUB_OUTPUT"
|
|
echo "Built bundle: $dist"
|
|
ls -la "$dist"
|
|
|
|
- name: Make the static shell depth-safe
|
|
# Caddy serves this index.html directly when the backend is down, at
|
|
# whatever URL was requested — including two-segment ones like
|
|
# /demos/raytracer. Crafter.Build emits relative boot scripts and its
|
|
# runtime.js fetches variants.json/files.json/the wasm relative to the
|
|
# DOCUMENT, so at any depth the fallback loads nothing at all. The script
|
|
# roots the tags and adds <base href="/">, and fails loudly rather than
|
|
# silently no-opping. The SSR path handles itself; this is only the
|
|
# backend-down fallback.
|
|
env:
|
|
DIST: ${{ steps.out.outputs.dist }}
|
|
run: tools/fix-bundle-depth.sh "$DIST"
|
|
|
|
- name: End-to-end HTTP tests
|
|
# Starts the freshly built server on a scratch port and exercises it over
|
|
# real HTTP: status codes, redirects, headers, form submission, and the
|
|
# no-JavaScript guarantee. --selftest covers the pure functions; only a
|
|
# real request can show that /nope is a 404 rather than a soft 404, that
|
|
# /projects contains its content with no <script> at all, and that a
|
|
# rejected form comes back with the visitor's values still in it.
|
|
#
|
|
# Runs AFTER the wasm build, which is not cosmetic ordering. The server
|
|
# discovers the bundle under bin/ and lifts its <script> tags from it, so
|
|
# with no bundle present there is nothing to assert about wasm booting:
|
|
# "/demos/raytracer loads the wasm" fails outright, and every
|
|
# "ships no script" check passes vacuously because no page has scripts to
|
|
# begin with. Building first is what makes both meaningful.
|
|
#
|
|
# A gate, not a report: a failure here stops the deploy.
|
|
env:
|
|
SRV: ${{ steps.srv.outputs.srv }}
|
|
run: tools/e2e.sh "$SRV/catcrafts-server"
|
|
|
|
- name: Pre-compress static assets
|
|
# Caddy's `precompressed zstd gzip` (see deploy/Caddyfile.example)
|
|
# serves these siblings straight from disk instead of re-compressing
|
|
# the ~700 KB wasm module on every request. Building them here also
|
|
# buys a better ratio than on-the-fly encoding would spend CPU on.
|
|
env:
|
|
DIST: ${{ steps.out.outputs.dist }}
|
|
run: |
|
|
set -eu
|
|
for f in "$DIST"/*.wasm "$DIST"/*.js "$DIST"/*.css "$DIST"/*.xml "$DIST"/*.svg; do
|
|
[ -f "$f" ] || continue
|
|
zstd -19 -q -f -k -- "$f"
|
|
gzip -9 -f -k -- "$f"
|
|
done
|
|
echo "Compressed artifacts:"
|
|
ls -la "$DIST"
|
|
|
|
- name: Deploy to web root
|
|
# No SSH: the job already runs on the deploy box. The server's web root
|
|
# is bind-mounted into this container at /deploy via the runner config
|
|
# (container.options: "-v /path/to/webroot:/deploy"). We just copy into
|
|
# it. --delete makes the root an exact mirror of the build; Caddyfile.coi
|
|
# is a local dev helper (its 'root' points at the build machine), so the
|
|
# server's own Caddy config supplies the headers instead.
|
|
env:
|
|
DIST: ${{ steps.out.outputs.dist }}
|
|
run: |
|
|
set -eu
|
|
if [ ! -d /deploy ]; then
|
|
echo "ERROR: /deploy is not mounted into the runner container." >&2
|
|
echo "Add '-v /your/webroot:/deploy' to the runner's container.options" >&2
|
|
echo "in config.yaml and restart the runner." >&2
|
|
exit 1
|
|
fi
|
|
rsync -a --delete --exclude 'Caddyfile.coi' "$DIST"/ /deploy/
|
|
echo "Deployed $DIST -> /deploy (host web root)"
|
|
|
|
- name: Guard against leaking runtime files into the web root
|
|
# The web root is served by Caddy's file_server AND mirrored with
|
|
# --delete, so anything runtime-owned that lands there is both published
|
|
# and destroyed on the next push. Nothing does today; this is here so a
|
|
# future cfg.files line cannot quietly change that once the shop has a
|
|
# database and bank credentials.
|
|
run: |
|
|
set -eu
|
|
bad=$(find /deploy -maxdepth 1 \( -name '*.db' -o -name '*.db-*' \
|
|
-o -name '*.pem' -o -name '*.key' -o -name '*.env' \
|
|
-o -name '.*' ! -name '.' \) -print 2>/dev/null || true)
|
|
if [ -n "$bad" ]; then
|
|
echo "ERROR: runtime-owned files found in the public web root:" >&2
|
|
printf '%s\n' "$bad" >&2
|
|
exit 1
|
|
fi
|
|
echo "Web root contains no database, key or dotfile."
|
|
|
|
- name: Deploy backend
|
|
# Second bind mount, separate from the web root on purpose: the backend
|
|
# binary and its content must NOT be inside a directory Caddy serves and
|
|
# rsync --delete mirrors. Add to the runner's container.options:
|
|
# -v /srv/catcrafts-app:/deploy-app
|
|
#
|
|
# The restart is not done here. This job runs inside a container with no
|
|
# access to the host's systemd, and the alternatives (host root for the
|
|
# runner, or a polkit rule) grant CI far more than "restart one service"
|
|
# needs. Instead the last step touches a marker file that
|
|
# catcrafts-deploy.path watches — see deploy/catcrafts-deploy.path.
|
|
# That unit re-runs --selftest against the new binary before cutting
|
|
# over, so a broken deploy leaves the working server running.
|
|
env:
|
|
SRV: ${{ steps.srv.outputs.srv }}
|
|
run: |
|
|
set -eu
|
|
if [ ! -d /deploy-app ]; then
|
|
echo "ERROR: /deploy-app is not mounted into the runner container." >&2
|
|
echo "Add '-v /srv/catcrafts-app:/deploy-app' to the runner's" >&2
|
|
echo "container.options in config.yaml and restart the runner." >&2
|
|
exit 1
|
|
fi
|
|
install -m 0755 "$SRV/catcrafts-server" /deploy-app/catcrafts-server.new
|
|
mkdir -p /deploy-app/content
|
|
# --delete on content/ is safe: it is regenerated every build. Note it
|
|
# does NOT touch /deploy-app/media, which must survive.
|
|
rsync -a --delete content/ /deploy-app/content/
|
|
# Swap the binary into place atomically, so a request arriving mid-copy
|
|
# never hits a truncated executable.
|
|
mv -f /deploy-app/catcrafts-server.new /deploy-app/catcrafts-server
|
|
date -u +%FT%TZ > /deploy-app/.deploy-stamp
|
|
echo "Deployed backend -> /deploy-app; marker touched"
|