dongarandClaude Opus 5.5
2fb654f92b
A `review` target in the Dockerfile: its own user (nisse-review, uid 10002), git for its clones, state and clones in /var/lib/nisse-review, configuration at /etc/nisse-review, and only its own agent installed. release.yml publishes gitea.dongar.net/dev/nisse-review beside nisse-dev, at the same version. review-bringup.sh builds and runs the image, as bringup.sh runs nisse-dev's. The test stage adds an agent package its base lacks, without its dependencies, since the suite's own code imports every agent's. Without that, the tests over nisse-dev's image no longer import since test_review_live arrived. tests/deploy/test_images.py checks the image and that the test stage leaves what it installed as it was. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J5Utyfzw7gF7UhjRDEtjTk
124 lines
4.3 KiB
YAML
124 lines
4.3 KiB
YAML
name: Release
|
|
# A published release builds every agent's image and pushes it to Gitea's
|
|
# registry (Development Plan M1.5, M7.6, X4): gitea.dongar.net/dev/nisse-dev
|
|
# and gitea.dongar.net/dev/nisse-review, each tagged with the version (the
|
|
# release tag without its v) and latest. One release, one version for all:
|
|
# the agents share nisse-core and were tested together. Older versions are
|
|
# removed by the dev organization's package cleanup rule (keep the 10 most
|
|
# recent, and latest), set in Gitea, not here. Cut a
|
|
# release in Gitea (Releases → New release, tag vX.Y.Z); a tag pushed for any
|
|
# other reason builds nothing. The full test set runs first: no image without
|
|
# it passing.
|
|
#
|
|
# The registry needs a personal access token with write:package
|
|
# (REGISTRY_TOKEN, an organization secret of `dev`, belonging to the
|
|
# registry-push bot), never the built-in job token: Gitea's registry
|
|
# resolves an Actions job token to an empty package scope (go-gitea/gitea
|
|
# #23642 and others). Packages belong to the repository's owner, which is
|
|
# why this repository is the `dev` organization's: the bot writes packages
|
|
# through the org's registry-push team. Never on pull_request: registry
|
|
# credentials stay off that trigger.
|
|
on:
|
|
release:
|
|
types: [published]
|
|
|
|
env:
|
|
REGISTRY: gitea.dongar.net
|
|
REGISTRY_USER: registry-push # the token's account
|
|
IMAGE: gitea.dongar.net/dev/nisse-dev
|
|
REVIEW_IMAGE: gitea.dongar.net/dev/nisse-review
|
|
|
|
jobs:
|
|
tests:
|
|
# Everything, before an image exists: lint, unit tests with all 48
|
|
# property walks, integration tests and the whole end-to-end suite.
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 150
|
|
env:
|
|
NISSE_LLM_TOKEN: ${{ secrets.NISSE_LLM_TOKEN }}
|
|
NISSE_MATRIX_TOKEN: ${{ secrets.NISSE_MATRIX_TOKEN }}
|
|
NISSE_GITEA_TOKEN: ${{ secrets.NISSE_GITEA_TOKEN }}
|
|
NISSE_OPERATOR_TOKEN: ${{ secrets.NISSE_OPERATOR_TOKEN }}
|
|
NISSE_E2E_RUNS: /tmp/nisse-e2e-runs
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install uv
|
|
run: |
|
|
curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
|
|
- name: Sync workspace
|
|
run: uv sync --all-packages
|
|
|
|
- name: Install sshd
|
|
run: scripts/ci-sshd.sh
|
|
|
|
- name: Lint
|
|
run: uv run ruff check . && uv run ruff format --check .
|
|
|
|
- name: Unit tests
|
|
run: uv run pytest -n auto -m "not integration and not e2e"
|
|
|
|
- name: Integration tests
|
|
run: uv run pytest -m "integration and not e2e" -rs
|
|
|
|
- name: End-to-end tests
|
|
run: scripts/e2e.sh --local -v
|
|
|
|
build-and-push:
|
|
needs: tests
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Derive the image version from the release's tag
|
|
id: vars
|
|
env:
|
|
TAG: ${{ github.event.release.tag_name }}
|
|
run: echo "version=${TAG#v}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Log in to Gitea's container registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ env.REGISTRY_USER }}
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build and push nisse-dev
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
target: agent
|
|
push: true
|
|
build-args: |
|
|
VERSION=${{ steps.vars.outputs.version }}
|
|
labels: |
|
|
org.opencontainers.image.version=${{ steps.vars.outputs.version }}
|
|
org.opencontainers.image.revision=${{ github.sha }}
|
|
tags: |
|
|
${{ env.IMAGE }}:${{ steps.vars.outputs.version }}
|
|
${{ env.IMAGE }}:latest
|
|
|
|
- name: Build and push nisse-review
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
target: review
|
|
push: true
|
|
build-args: |
|
|
VERSION=${{ steps.vars.outputs.version }}
|
|
labels: |
|
|
org.opencontainers.image.version=${{ steps.vars.outputs.version }}
|
|
org.opencontainers.image.revision=${{ github.sha }}
|
|
tags: |
|
|
${{ env.REVIEW_IMAGE }}:${{ steps.vars.outputs.version }}
|
|
${{ env.REVIEW_IMAGE }}:latest
|