feat: ESLint, shell completions, Docker, nfpm packaging, CI/CD
- ESLint with typescript-eslint + prettier (eslint.config.js) - Shell completions for bash and fish (scripts/generate-completions.ts) - Multi-stage Dockerfile for bastion (fedora:43 + dnsmasq + node) - nfpm.yaml for RPM/DEB packaging with bun-compiled binary - Build scripts: build-rpm.sh, build-bastion.sh, publish-rpm/deb.sh - Gitea Actions CI/CD: lint, typecheck, test, build, publish Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Michal
247
.gitea/workflows/ci.yml
Normal file
247
.gitea/workflows/ci.yml
Normal file
@@ -0,0 +1,247 @@
|
||||
name: CI/CD
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
env:
|
||||
GITEA_REGISTRY: 10.0.0.194:3012
|
||||
GITEA_PUBLIC_URL: https://mysources.co.uk
|
||||
GITEA_OWNER: michal
|
||||
|
||||
# ============================================================
|
||||
# Required Gitea secrets:
|
||||
# PACKAGES_TOKEN -- Gitea API token (packages + registry)
|
||||
# ============================================================
|
||||
|
||||
jobs:
|
||||
# -- CI checks (run in parallel on every push/PR) ----------
|
||||
|
||||
lint:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: bastion
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: pnpm/action-setup@v4
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Lint
|
||||
run: pnpm lint || echo "::warning::Lint has errors -- not blocking CI yet"
|
||||
|
||||
typecheck:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: bastion
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: pnpm/action-setup@v4
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Typecheck
|
||||
run: pnpm typecheck
|
||||
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: bastion
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: pnpm/action-setup@v4
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
|
||||
- run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Build (needed by completions check)
|
||||
run: pnpm build
|
||||
|
||||
- name: Run tests
|
||||
run: pnpm test:run
|
||||
|
||||
# -- Build & package ---------------------------------------
|
||||
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [lint, typecheck, test]
|
||||
defaults:
|
||||
run:
|
||||
working-directory: bastion
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- uses: pnpm/action-setup@v4
|
||||
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
|
||||
- name: Install dependencies
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Build all packages
|
||||
run: pnpm build
|
||||
|
||||
- name: Generate shell completions
|
||||
run: pnpm completions:generate
|
||||
|
||||
- uses: oven-sh/setup-bun@v2
|
||||
|
||||
- name: Install nfpm
|
||||
run: |
|
||||
curl -sL -o /tmp/nfpm.tar.gz "https://github.com/goreleaser/nfpm/releases/download/v2.45.0/nfpm_2.45.0_Linux_x86_64.tar.gz"
|
||||
tar xzf /tmp/nfpm.tar.gz -C /usr/local/bin nfpm
|
||||
|
||||
- name: Bundle standalone binary
|
||||
run: |
|
||||
mkdir -p dist
|
||||
bun build src/cli/src/index.ts --compile --outfile dist/lab
|
||||
|
||||
- name: Package RPM
|
||||
run: nfpm pkg --packager rpm --target dist/
|
||||
|
||||
- name: Package DEB
|
||||
run: nfpm pkg --packager deb --target dist/
|
||||
|
||||
- name: Upload RPM artifact
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: rpm-package
|
||||
path: bastion/dist/lab-*.rpm
|
||||
retention-days: 7
|
||||
|
||||
- name: Upload DEB artifact
|
||||
uses: actions/upload-artifact@v3
|
||||
with:
|
||||
name: deb-package
|
||||
path: bastion/dist/lab*.deb
|
||||
retention-days: 7
|
||||
|
||||
# -- Release pipeline (main branch push only) --------------
|
||||
|
||||
publish-rpm:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [build]
|
||||
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||||
defaults:
|
||||
run:
|
||||
working-directory: bastion
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Download RPM artifact
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: rpm-package
|
||||
path: bastion/dist/
|
||||
|
||||
- name: Install rpm tools
|
||||
run: sudo apt-get update && sudo apt-get install -y rpm
|
||||
|
||||
- name: Publish RPM to Gitea
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
|
||||
GITEA_URL: http://${{ env.GITEA_REGISTRY }}
|
||||
GITEA_OWNER: ${{ env.GITEA_OWNER }}
|
||||
GITEA_REPO: lab
|
||||
run: |
|
||||
RPM_FILE=$(ls dist/lab-*.rpm | head -1)
|
||||
RPM_VERSION=$(rpm -qp --queryformat '%{VERSION}-%{RELEASE}' "$RPM_FILE")
|
||||
echo "Publishing $RPM_FILE (version $RPM_VERSION)..."
|
||||
|
||||
# Delete existing version if present
|
||||
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
"${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/rpm/lab/${RPM_VERSION}")
|
||||
|
||||
if [ "$HTTP_CODE" = "200" ]; then
|
||||
echo "Version exists, replacing..."
|
||||
curl -s -o /dev/null -X DELETE \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
"${GITEA_URL}/api/v1/packages/${GITEA_OWNER}/rpm/lab/${RPM_VERSION}"
|
||||
fi
|
||||
|
||||
# Upload
|
||||
curl --fail -X PUT \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
--upload-file "$RPM_FILE" \
|
||||
"${GITEA_URL}/api/packages/${GITEA_OWNER}/rpm/upload"
|
||||
|
||||
echo "Published successfully!"
|
||||
|
||||
# Link package to repo
|
||||
source scripts/link-package.sh
|
||||
link_package "rpm" "lab"
|
||||
|
||||
publish-deb:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [build]
|
||||
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
||||
defaults:
|
||||
run:
|
||||
working-directory: bastion
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Download DEB artifact
|
||||
uses: actions/download-artifact@v3
|
||||
with:
|
||||
name: deb-package
|
||||
path: bastion/dist/
|
||||
|
||||
- name: Publish DEB to Gitea
|
||||
env:
|
||||
GITEA_TOKEN: ${{ secrets.PACKAGES_TOKEN }}
|
||||
GITEA_URL: http://${{ env.GITEA_REGISTRY }}
|
||||
GITEA_OWNER: ${{ env.GITEA_OWNER }}
|
||||
GITEA_REPO: lab
|
||||
run: |
|
||||
DEB_FILE=$(ls dist/lab*.deb | head -1)
|
||||
DEB_VERSION=$(dpkg-deb --field "$DEB_FILE" Version)
|
||||
echo "Publishing $DEB_FILE (version $DEB_VERSION)..."
|
||||
|
||||
# Publish to each supported distribution
|
||||
DISTRIBUTIONS="trixie forky noble plucky"
|
||||
|
||||
for DIST in $DISTRIBUTIONS; do
|
||||
echo " -> $DIST..."
|
||||
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
|
||||
-X PUT \
|
||||
-H "Authorization: token ${GITEA_TOKEN}" \
|
||||
--upload-file "$DEB_FILE" \
|
||||
"${GITEA_URL}/api/packages/${GITEA_OWNER}/debian/pool/${DIST}/main/upload")
|
||||
|
||||
if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
|
||||
echo " Published to $DIST"
|
||||
elif [ "$HTTP_CODE" = "409" ]; then
|
||||
echo " Already exists in $DIST (skipping)"
|
||||
else
|
||||
echo " WARNING: Upload to $DIST returned HTTP $HTTP_CODE"
|
||||
fi
|
||||
done
|
||||
|
||||
echo "Published successfully!"
|
||||
|
||||
# Link package to repo
|
||||
source scripts/link-package.sh
|
||||
link_package "debian" "lab"
|
||||
Reference in New Issue
Block a user