dovenest

.hearthforge-ci.toml

1	# Steps run in file order, in one container, sharing /ci/build.
2	# Alpine, so the published binary is the same static musl build the
3	# Containerfile ships.
4
5	image = "docker.io/rust:1.98-alpine3.24"
6	work_dir = "/ci/build"
7	clone_project_to = "/ci/build/project"
8
9	# busybox ash, which does support `set -o pipefail`.
10	shell = ["/bin/sh", "-c"]
11
12	# CARGO_TARGET_DIR must stay outside clone_project_to: the checkout is
13	# extracted over that directory, so a cache inside it would be overwritten.
14	shell_setup = """
15	set -euo pipefail
16	export CARGO_TARGET_DIR=/ci/cache/target
17	"""
18
19	timeout = 5400
20	memory_limit = "6g"
21
22	# Caps are a safety valve against unbounded growth, not a budget: hitting one
23	# costs a full rebuild. Sized roughly twice the working set. A local target
24	# holding all three profiles measures 26G, of which debug is 22G.
25	cache = [
26	{ path = "/ci/cache/target", max_size = "20g" },
27	{ path = "/usr/local/cargo/registry", max_size = "4g" },
28	{ path = "/root/.bun/install/cache", max_size = "2g" },
29	]
30
31	[on]
32	push = ["master"]
33	tag = true
34
35	# bun publishes no musl installer, so take the binary from the official image.
36	# This mirrors the Containerfile's COPY --from. The -alpine tag is required:
37	# the glibc build will not run here. bun also needs libstdc++, which setup
38	# installs before anything executes it.
39	[[copy]]
40	image = "docker.io/oven/bun:1.4.2-alpine"
41	from = "/usr/local/bin/bun"
42	to = "/usr/local/bin"
43
44	[variables]
45
46	[variables.TRUNK_VERSION]
47	default = "0.21.14"
48	description = "Trunk release that builds the wasm frontend. Matches the Containerfile."
49
50	# ── toolchain ────────────────────────────────────────────────────────────────
51	# binaryen supplies wasm-opt. Without it trunk downloads a glibc build that
52	# cannot run on musl. just comes from apk here, so no install script.
53	[[steps]]
54	name = "setup"
55	timeout = 900
56	run_sh = """
57	# openssl-dev + openssl-libs-static: webauthn-rs links OpenSSL, and this is
58	# a static musl build. make builds jemalloc. Mirrors the Containerfile's
59	# build stage.
60	apk add --no-cache musl-dev binaryen just curl libstdc++ podman-remote make \
61	openssl-dev openssl-libs-static pkgconfig
62
63	# The official rust images use rustup's minimal profile, so rustfmt and
64	# clippy are absent. `just lint` needs both.
65	rustup component add rustfmt clippy
66	rustup target add wasm32-unknown-unknown
67
68	url="https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-musl.tar.gz"
69	curl -fsSL -o /tmp/trunk.tar.gz "$url"
70	curl -fsSL "$url.sha256" \| awk '{print $1 " /tmp/trunk.tar.gz"}' \| sha256sum -c -
71	tar xzf /tmp/trunk.tar.gz -C /usr/local/bin
72	rm -f /tmp/trunk.tar.gz
73
74	just --version && bun --version && trunk --version
75	cargo fmt --version && cargo clippy --version
76	"""
77
78	# ── checks ───────────────────────────────────────────────────────────────────
79	# Formatting and clippy findings are reported, not gated. The pinned CI
80	# toolchain can lag local machines, and clippy disagrees across versions.
81	[[steps]]
82	name = "lint"
83	run_sh = "cd project && just lint"
84	warn_on_fail = true
85
86	[[steps]]
87	name = "test"
88	run_sh = "cd project && just test"
89
90	# ── build ────────────────────────────────────────────────────────────────────
91	[[steps]]
92	name = "build"
93	timeout = 2400
94	run_sh = "cd project && just build"
95	publish_file = ["/ci/cache/target/release/dovenest"]
96
97	# `just e2e` would rebuild the frontend. The build step already staged
98	# server/dist, so run the embedded suite against it directly.
99	[[steps]]
100	name = "e2e"
101	run_sh = "cd project && cargo test -p server --features embedded --test api embedded"
102
103	# ── release ──────────────────────────────────────────────────────────────────
104	[[steps]]
105	name = "release"
106	run_if = 'test -n "${CI_COMMIT_TAG}"'
107	run_sh = """
108	cd project
109	install -Dm755 "${CARGO_TARGET_DIR}/release/dovenest" \
110	"dist/dovenest-${CI_COMMIT_TAG}-x86_64-linux-musl"
111	"""
112	publish_gzip = ["/ci/build/project/dist/"]
113
114	# ── image ────────────────────────────────────────────────────────────────────
115	# Packages the binary the build step made, so the image ships exactly what
116	# e2e tested. The Containerfile's build stage is skipped via BIN_STAGE.
117	# engine_socket hands this step the host engine, which is Podman on this
118	# server (needs CI_ENGINE_SOCKET=1). REGISTRY_PASSWORD is a CI secret with the
119	# admin password. CI_REGISTRY is "<host>/<repo>" on the built-in registry.
120	# Tags: every run pushes the short sha and "edge"; a tag run also pushes the
121	# tag and "latest".
122	[[steps]]
123	name = "image"
124	engine_socket = true
125	timeout = 900
126	run_sh = """
127	cd project
128	mkdir -p ci-bin
129	cp "${CARGO_TARGET_DIR}/release/dovenest" ci-bin/dovenest
130
131	echo "$REGISTRY_PASSWORD" \| podman-remote login "${CI_REGISTRY%%/*}" -u admin --password-stdin
132
133	# A remote build sends a seccomp profile path that the server opens. Alpine
134	# ships one at /etc/containers/seccomp.json and podman picks it over the
135	# /usr/share copy, but the server has only the latter. Ask the server for its
136	# own path. An empty answer means no profile can be named, so the build runs
137	# unconfined rather than failing.
138	prof=$(podman-remote info --format '{{.Host.Security.SECCOMPProfilePath}}' 2>/dev/null \|\| true)
139	if [ -n "$prof" ]; then
140	seccomp="seccomp=$prof"
141	else
142	seccomp="seccomp=unconfined"
143	fi
144
145	img="$CI_REGISTRY:$CI_COMMIT_SHORT_SHA"
146	podman-remote build --security-opt "$seccomp" \
147	-f Containerfile -t "$img" --build-arg BIN_STAGE=prebuilt .
148	podman-remote push "$img"
149
150	if [ -n "${CI_COMMIT_TAG:-}" ]; then
151	tags="$CI_COMMIT_TAG latest"
152	else
153	tags="edge"
154	fi
155	for t in $tags; do
156	podman-remote tag "$img" "$CI_REGISTRY:$t"
157	podman-remote push "$CI_REGISTRY:$t"
158	done
159	"""
160