jb/eden
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: fail closed backend capabilities and isolate gate smoke

Browse Source
This commit is contained in:
jb
2026-09-19 10:01:23 -04:00
parent 1371995cbe
commit 5b0076cb20
17 changed files with 344 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+14 -9
View File
@@ -37,10 +37,10 @@ jobs:
bun run release:check
container:
# Docker builds run only for trusted pushes. Do not run this job for PR
# code on a shared/privileged runner; use a dedicated rootless runner once
# one is registered and verified in Gitea.
if: ${{ gitea.event_name == 'push' }}
# HOLD: no verified dedicated/rootless runner or protected-ref policy has
# been confirmed in Gitea. Keep this disabled rather than treating every
# push as trusted; enable only after operator approval and runner evidence.
if: ${{ false }}
runs-on: ubuntu-latest
steps:
- name: Checkout
@@ -48,22 +48,27 @@ jobs:
- name: Validate Compose expansion
run: docker compose config --quiet
- name: Build immutable web artifact
run: docker build --build-arg APP_RELEASE_ID=fixture-ci --tag eve-intelligence:fixture .
run: >-
docker build --build-arg APP_RELEASE_ID=fixture-ci
--tag "eve-intelligence:fixture-${GITHUB_RUN_ID:?}-${GITHUB_RUN_ATTEMPT:-1}" .
- name: Run isolated container smoke
shell: bash
run: |
set -euo pipefail
volume="eden-ci-reference-${GITHUB_RUN_ID:-trusted-push}"
container="eden-ci-web-${GITHUB_RUN_ID:-trusted-push}"
run_id="${GITHUB_RUN_ID:?GITHUB_RUN_ID is required}"
run_attempt="${GITHUB_RUN_ATTEMPT:-1}"
image="eve-intelligence:fixture-${run_id}-${run_attempt}"
volume="eden-ci-reference-${run_id}-${run_attempt}"
container="eden-ci-web-${run_id}-${run_attempt}"
cleanup() { docker rm --force "$container" >/dev/null 2>&1 || true; docker volume rm "$volume" >/dev/null 2>&1 || true; }
trap cleanup EXIT
docker volume create "$volume" >/dev/null
docker run --rm --network none --user root -v "$volume:/app/data/reference" eve-intelligence:fixture \
docker run --rm --network none --user root -v "$volume:/app/data/reference" "$image" \
bun workers/reference.ts --fixture --directory /app/data/reference
docker run --detach --name "$container" --network none \
-e APP_MODE=demo -e APP_ORIGIN=http://127.0.0.1:3000 -e ORIGIN=http://127.0.0.1:3000 \
-e HOST=127.0.0.1 -e PORT=3000 -e REFERENCE_DIR=/app/data/reference -e APP_RELEASE_ID=fixture-ci \
-v "$volume:/app/data/reference:ro" eve-intelligence:fixture >/dev/null
-v "$volume:/app/data/reference:ro" "$image" >/dev/null
for attempt in $(seq 1 60); do
if docker exec "$container" bun -e "const r = await fetch('http://127.0.0.1:3000'); if (r.status !== 200 || r.headers.get('x-application-release') !== 'fixture-ci') process.exit(1);"; then break; fi
if [ "$attempt" = 60 ]; then echo 'container smoke did not become ready' >&2; exit 1; fi