dovenest

.hearthforge-ci.toml

1	# Steps run in file order, in one container, sharing /ci/build.
2	# Alpine, so the published binary is the same static musl build the
3	# Containerfile ships.
4
5	image = "docker.io/rust:1.90-alpine3.22"
6	work_dir = "/ci/build"
7	clone_project_to = "/ci/build/project"
8
9	# busybox ash, which does support `set -o pipefail`.
10	shell = ["/bin/sh", "-c"]
11
12	# CARGO_TARGET_DIR must stay outside clone_project_to: the checkout is
13	# extracted over that directory, so a cache inside it would be overwritten.
14	shell_setup = """
15	set -euo pipefail
16	export CARGO_TARGET_DIR=/ci/cache/target
17	"""
18
19	timeout = 5400
20	memory_limit = "6g"
21
22	# Caps are a safety valve against unbounded growth, not a budget: hitting one
23	# costs a full rebuild. Sized roughly twice the working set. A local target
24	# holding all three profiles measures 26G, of which debug is 22G.
25	cache = [
26	{ path = "/ci/cache/target", max_size = "20g" },
27	{ path = "/usr/local/cargo/registry", max_size = "4g" },
28	{ path = "/root/.bun/install/cache", max_size = "2g" },
29	]
30
31	[on]
32	push = ["master"]
33	tag = true
34
35	# bun publishes no musl installer, so take the binary from the official image.
36	# This mirrors the Containerfile's COPY --from. The -alpine tag is required:
37	# the glibc build will not run here. bun also needs libstdc++, which setup
38	# installs before anything executes it.
39	[[copy]]
40	image = "docker.io/oven/bun:1.4.0-alpine"
41	from = "/usr/local/bin/bun"
42	to = "/usr/local/bin"
43
44	[variables]
45
46	[variables.TRUNK_VERSION]
47	default = "0.21.14"
48	description = "Trunk release that builds the wasm frontend. Matches the Containerfile."
49
50	# ── toolchain ────────────────────────────────────────────────────────────────
51	# binaryen supplies wasm-opt. Without it trunk downloads a glibc build that
52	# cannot run on musl. just comes from apk here, so no install script.
53	[[steps]]
54	name = "setup"
55	timeout = 900
56	run_sh = """
57	apk add --no-cache musl-dev binaryen just curl libstdc++ podman-remote
58
59	# The official rust images use rustup's minimal profile, so rustfmt and
60	# clippy are absent. `just lint` needs both.
61	rustup component add rustfmt clippy
62	rustup target add wasm32-unknown-unknown
63
64	url="https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-musl.tar.gz"
65	curl -fsSL -o /tmp/trunk.tar.gz "$url"
66	curl -fsSL "$url.sha256" \| awk '{print $1 " /tmp/trunk.tar.gz"}' \| sha256sum -c -
67	tar xzf /tmp/trunk.tar.gz -C /usr/local/bin
68	rm -f /tmp/trunk.tar.gz
69
70	just --version && bun --version && trunk --version
71	cargo fmt --version && cargo clippy --version
72	"""
73
74	# ── checks ───────────────────────────────────────────────────────────────────
75	# Formatting and clippy findings are reported, not gated. The CI toolchain is
76	# 1.90 and local machines run newer, so clippy disagrees across versions.
77	[[steps]]
78	name = "lint"
79	run_sh = "cd project && just lint"
80	warn_on_fail = true
81
82	# `just test` covers server and api-types only, hence the extra web run.
83	[[steps]]
84	name = "test"
85	run_sh = "cd project && just test && cargo test -p web"
86
87	# ── build ────────────────────────────────────────────────────────────────────
88	[[steps]]
89	name = "build"
90	timeout = 2400
91	run_sh = "cd project && just build"
92	publish_file = ["/ci/cache/target/release/filebrowser-ng"]
93
94	# `just e2e` would rebuild the frontend. The build step already staged
95	# server/dist, so run the embedded suite against it directly.
96	[[steps]]
97	name = "e2e"
98	run_sh = "cd project && cargo test -p server --features embedded"
99
100	# ── release ──────────────────────────────────────────────────────────────────
101	[[steps]]
102	name = "release"
103	run_if = 'test -n "${CI_COMMIT_TAG}"'
104	run_sh = """
105	cd project
106	install -Dm755 "${CARGO_TARGET_DIR}/release/filebrowser-ng" \
107	"dist/filebrowser-ng-${CI_COMMIT_TAG}-x86_64-linux-musl"
108	"""
109	publish_gzip = ["/ci/build/project/dist/"]
110
111	# ── image ────────────────────────────────────────────────────────────────────
112	# Packages the binary the build step made, so the image ships exactly what
113	# e2e tested. The Containerfile's build stage is skipped via BIN_STAGE.
114	# engine_socket hands this step the host engine, which is Podman on this
115	# server (needs CI_ENGINE_SOCKET=1). REGISTRY_PASSWORD is a CI secret with the
116	# admin password. CI_REGISTRY is "<host>/<repo>" on the built-in registry.
117	# Tags: every run pushes the short sha and "edge"; a tag run also pushes the
118	# tag and "latest".
119	[[steps]]
120	name = "image"
121	engine_socket = true
122	timeout = 900
123	run_sh = """
124	cd project
125	mkdir -p ci-bin
126	cp "${CARGO_TARGET_DIR}/release/filebrowser-ng" ci-bin/filebrowser-ng
127
128	echo "$REGISTRY_PASSWORD" \| podman-remote login "${CI_REGISTRY%%/*}" -u admin --password-stdin
129	img="$CI_REGISTRY:$CI_COMMIT_SHORT_SHA"
130	podman-remote build -f Containerfile -t "$img" --build-arg BIN_STAGE=prebuilt .
131	podman-remote push "$img"
132
133	if [ -n "${CI_COMMIT_TAG:-}" ]; then
134	tags="$CI_COMMIT_TAG latest"
135	else
136	tags="edge"
137	fi
138	for t in $tags; do
139	podman-remote tag "$img" "$CI_REGISTRY:$t"
140	podman-remote push "$CI_REGISTRY:$t"
141	done
142	"""
143