107 lines
5.0 KiB
YAML
107 lines
5.0 KiB
YAML
name: Publish verified PortfolioHub image
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "v*.*.*"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Reject every event except a strict version tag push
|
|
env:
|
|
RELEASE_EVENT: ${{ github.event_name }}
|
|
RELEASE_REF: ${{ github.ref }}
|
|
RELEASE_SHA: ${{ github.sha }}
|
|
run: |
|
|
python - <<'PY'
|
|
import os, re
|
|
assert os.environ["RELEASE_EVENT"] == "push"
|
|
assert re.fullmatch(r"refs/tags/v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)", os.environ["RELEASE_REF"])
|
|
assert re.fullmatch(r"[0-9a-f]{40}", os.environ["RELEASE_SHA"])
|
|
PY
|
|
- name: Check out exact tagged source commit
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
fetch-depth: 0
|
|
- run: python scripts/image_release.py validate-checkout --actual "$(git rev-parse HEAD)" --expected "${GITHUB_SHA}"
|
|
- run: python scripts/image_release.py validate-event --event "${GITHUB_EVENT_NAME}" --ref "${GITHUB_REF}" --commit "${GITHUB_SHA}" --project pyproject.toml
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.11"
|
|
- run: python -m pip install "uv==0.11.14"
|
|
- run: uv sync --extra dev --locked
|
|
- run: uv run python -m pytest -q
|
|
- name: Honest scoped lint
|
|
run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py scripts/ruff_ratchet.py tests/release
|
|
- name: Reject Ruff findings introduced by v0.3.0 or later patches
|
|
run: |
|
|
uv run python scripts/ruff_ratchet.py --base v0.2.1
|
|
uv run python scripts/ruff_ratchet.py --base v0.3.0
|
|
uv run python scripts/ruff_ratchet.py --base v0.3.1
|
|
- name: Record exact source migration inventory
|
|
run: uv run python -c 'from app.db.migrations import migration_inventory; print("\n".join(migration_inventory()))' > migration-inventory.txt
|
|
- name: Create excluded synthetic canary
|
|
run: printf '%s\n' 'PORTFOLIO_HUB_SECRET_CANARY_DO_NOT_SHIP' > .env.ci-canary
|
|
- name: Build exact source image once
|
|
run: docker build --platform linux/amd64 --provenance=false --build-arg "SOURCE_COMMIT=${GITHUB_SHA}" --build-arg "RELEASE_VERSION=${GITHUB_REF_NAME}" --tag "portfolio-hub-ci:${GITHUB_SHA}" .
|
|
- name: Smoke installed payload, health, migration and isolated PostgreSQL
|
|
run: python scripts/image_release.py smoke --image "portfolio-hub-ci:${GITHUB_SHA}" --inventory migration-inventory.txt --timeout 180
|
|
- name: Record tested image ID
|
|
run: python scripts/image_release.py record-image-id --image "portfolio-hub-ci:${GITHUB_SHA}" --output portfolio-hub-image.id
|
|
- name: Export tested image without rebuilding
|
|
run: docker save --output portfolio-hub-image.tar "portfolio-hub-ci:${GITHUB_SHA}"
|
|
- name: Scan filesystem, history, inspect, archive metadata and outputs
|
|
run: |
|
|
set +e
|
|
python scripts/image_release.py scan --image "portfolio-hub-ci:${GITHUB_SHA}" --archive portfolio-hub-image.tar >canary-scan.stdout 2>canary-scan.stderr
|
|
scan_status=$?
|
|
set -e
|
|
python scripts/image_release.py assert-clean-output canary-scan.stdout canary-scan.stderr
|
|
exit "${scan_status}"
|
|
- run: python scripts/image_release.py checksum --archive portfolio-hub-image.tar --output portfolio-hub-image.tar.sha256
|
|
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
|
|
if-no-files-found: error
|
|
retention-days: 7
|
|
path: |
|
|
portfolio-hub-image.tar
|
|
portfolio-hub-image.tar.sha256
|
|
portfolio-hub-image.id
|
|
migration-inventory.txt
|
|
scripts/image_release.py
|
|
|
|
publish:
|
|
needs: verify
|
|
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
|
|
with:
|
|
name: tested-image-${{ github.run_id }}-${{ github.run_attempt }}
|
|
path: tested-image
|
|
- name: Load same archive, tag and publish without rebuilding
|
|
id: publish
|
|
env:
|
|
GITHUB_ACTOR: ${{ github.actor }}
|
|
REGISTRY_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
python tested-image/scripts/image_release.py publish \
|
|
--archive tested-image/portfolio-hub-image.tar \
|
|
--checksum tested-image/portfolio-hub-image.tar.sha256 \
|
|
--image-id tested-image/portfolio-hub-image.id \
|
|
--local-image "portfolio-hub-ci:${GITHUB_SHA}" \
|
|
--commit "${GITHUB_SHA}" --event "${GITHUB_EVENT_NAME}" --ref "${GITHUB_REF}"
|