.hearthforge-ci.toml
| 1 | # Steps run in file order, in one container, sharing /ci/build. |
| 2 | # Alpine, so the published binary is the same static musl build the |
| 3 | # Containerfile ships. |
| 4 | |
| 5 | image = "docker.io/rust:1.98-alpine3.24" |
| 6 | work_dir = "/ci/build" |
| 7 | clone_project_to = "/ci/build/project" |
| 8 | |
| 9 | # busybox ash, which does support `set -o pipefail`. |
| 10 | shell = ["/bin/sh", "-c"] |
| 11 | |
| 12 | # CARGO_TARGET_DIR must stay outside clone_project_to: the checkout is |
| 13 | # extracted over that directory, so a cache inside it would be overwritten. |
| 14 | shell_setup = """ |
| 15 | set -euo pipefail |
| 16 | export CARGO_TARGET_DIR=/ci/cache/target |
| 17 | """ |
| 18 | |
| 19 | timeout = 5400 |
| 20 | memory_limit = "6g" |
| 21 | |
| 22 | # Caps are a safety valve against unbounded growth, not a budget: hitting one |
| 23 | # costs a full rebuild. Sized roughly twice the working set. A local target |
| 24 | # holding all three profiles measures 26G, of which debug is 22G. |
| 25 | cache = [ |
| 26 | { path = "/ci/cache/target", max_size = "20g" }, |
| 27 | { path = "/usr/local/cargo/registry", max_size = "4g" }, |
| 28 | { path = "/root/.bun/install/cache", max_size = "2g" }, |
| 29 | ] |
| 30 | |
| 31 | [on] |
| 32 | push = ["master"] |
| 33 | tag = true |
| 34 | |
| 35 | # bun publishes no musl installer, so take the binary from the official image. |
| 36 | # This mirrors the Containerfile's COPY --from. The -alpine tag is required: |
| 37 | # the glibc build will not run here. bun also needs libstdc++, which setup |
| 38 | # installs before anything executes it. |
| 39 | [[copy]] |
| 40 | image = "docker.io/oven/bun:1.4.2-alpine" |
| 41 | from = "/usr/local/bin/bun" |
| 42 | to = "/usr/local/bin" |
| 43 | |
| 44 | [variables] |
| 45 | |
| 46 | [variables.TRUNK_VERSION] |
| 47 | default = "0.21.14" |
| 48 | description = "Trunk release that builds the wasm frontend. Matches the Containerfile." |
| 49 | |
| 50 | # ── toolchain ──────────────────────────────────────────────────────────────── |
| 51 | # binaryen supplies wasm-opt. Without it trunk downloads a glibc build that |
| 52 | # cannot run on musl. just comes from apk here, so no install script. |
| 53 | [[steps]] |
| 54 | name = "setup" |
| 55 | timeout = 900 |
| 56 | run_sh = """ |
| 57 | # openssl-dev + openssl-libs-static: webauthn-rs links OpenSSL, and this is |
| 58 | # a static musl build. make builds jemalloc. Mirrors the Containerfile's |
| 59 | # build stage. |
| 60 | apk add --no-cache musl-dev binaryen just curl libstdc++ podman-remote make \ |
| 61 | openssl-dev openssl-libs-static pkgconfig |
| 62 | |
| 63 | # The official rust images use rustup's minimal profile, so rustfmt and |
| 64 | # clippy are absent. `just lint` needs both. |
| 65 | rustup component add rustfmt clippy |
| 66 | rustup target add wasm32-unknown-unknown |
| 67 | |
| 68 | url="https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-musl.tar.gz" |
| 69 | curl -fsSL -o /tmp/trunk.tar.gz "$url" |
| 70 | curl -fsSL "$url.sha256" | awk '{print $1 " /tmp/trunk.tar.gz"}' | sha256sum -c - |
| 71 | tar xzf /tmp/trunk.tar.gz -C /usr/local/bin |
| 72 | rm -f /tmp/trunk.tar.gz |
| 73 | |
| 74 | just --version && bun --version && trunk --version |
| 75 | cargo fmt --version && cargo clippy --version |
| 76 | """ |
| 77 | |
| 78 | # ── checks ─────────────────────────────────────────────────────────────────── |
| 79 | # Formatting and clippy findings are reported, not gated. The pinned CI |
| 80 | # toolchain can lag local machines, and clippy disagrees across versions. |
| 81 | [[steps]] |
| 82 | name = "lint" |
| 83 | run_sh = "cd project && just lint" |
| 84 | warn_on_fail = true |
| 85 | |
| 86 | # `just test` covers server and api-types only, hence the extra web run. |
| 87 | [[steps]] |
| 88 | name = "test" |
| 89 | run_sh = "cd project && just test && cargo test -p web" |
| 90 | |
| 91 | # ── build ──────────────────────────────────────────────────────────────────── |
| 92 | [[steps]] |
| 93 | name = "build" |
| 94 | timeout = 2400 |
| 95 | run_sh = "cd project && just build" |
| 96 | publish_file = ["/ci/cache/target/release/dovenest"] |
| 97 | |
| 98 | # `just e2e` would rebuild the frontend. The build step already staged |
| 99 | # server/dist, so run the embedded suite against it directly. |
| 100 | [[steps]] |
| 101 | name = "e2e" |
| 102 | run_sh = "cd project && cargo test -p server --features embedded" |
| 103 | |
| 104 | # ── release ────────────────────────────────────────────────────────────────── |
| 105 | [[steps]] |
| 106 | name = "release" |
| 107 | run_if = 'test -n "${CI_COMMIT_TAG}"' |
| 108 | run_sh = """ |
| 109 | cd project |
| 110 | install -Dm755 "${CARGO_TARGET_DIR}/release/dovenest" \ |
| 111 | "dist/dovenest-${CI_COMMIT_TAG}-x86_64-linux-musl" |
| 112 | """ |
| 113 | publish_gzip = ["/ci/build/project/dist/"] |
| 114 | |
| 115 | # ── image ──────────────────────────────────────────────────────────────────── |
| 116 | # Packages the binary the build step made, so the image ships exactly what |
| 117 | # e2e tested. The Containerfile's build stage is skipped via BIN_STAGE. |
| 118 | # engine_socket hands this step the host engine, which is Podman on this |
| 119 | # server (needs CI_ENGINE_SOCKET=1). REGISTRY_PASSWORD is a CI secret with the |
| 120 | # admin password. CI_REGISTRY is "<host>/<repo>" on the built-in registry. |
| 121 | # Tags: every run pushes the short sha and "edge"; a tag run also pushes the |
| 122 | # tag and "latest". |
| 123 | [[steps]] |
| 124 | name = "image" |
| 125 | engine_socket = true |
| 126 | timeout = 900 |
| 127 | run_sh = """ |
| 128 | cd project |
| 129 | mkdir -p ci-bin |
| 130 | cp "${CARGO_TARGET_DIR}/release/dovenest" ci-bin/dovenest |
| 131 | |
| 132 | echo "$REGISTRY_PASSWORD" | podman-remote login "${CI_REGISTRY%%/*}" -u admin --password-stdin |
| 133 | |
| 134 | # A remote build sends a seccomp profile path that the server opens. Alpine |
| 135 | # ships one at /etc/containers/seccomp.json and podman picks it over the |
| 136 | # /usr/share copy, but the server has only the latter. Ask the server for its |
| 137 | # own path. An empty answer means no profile can be named, so the build runs |
| 138 | # unconfined rather than failing. |
| 139 | prof=$(podman-remote info --format '{{.Host.Security.SECCOMPProfilePath}}' 2>/dev/null || true) |
| 140 | if [ -n "$prof" ]; then |
| 141 | seccomp="seccomp=$prof" |
| 142 | else |
| 143 | seccomp="seccomp=unconfined" |
| 144 | fi |
| 145 | |
| 146 | img="$CI_REGISTRY:$CI_COMMIT_SHORT_SHA" |
| 147 | podman-remote build --security-opt "$seccomp" \ |
| 148 | -f Containerfile -t "$img" --build-arg BIN_STAGE=prebuilt . |
| 149 | podman-remote push "$img" |
| 150 | |
| 151 | if [ -n "${CI_COMMIT_TAG:-}" ]; then |
| 152 | tags="$CI_COMMIT_TAG latest" |
| 153 | else |
| 154 | tags="edge" |
| 155 | fi |
| 156 | for t in $tags; do |
| 157 | podman-remote tag "$img" "$CI_REGISTRY:$t" |
| 158 | podman-remote push "$CI_REGISTRY:$t" |
| 159 | done |
| 160 | """ |
| 161 |