dovenest

.hearthforge-ci.toml

1	# Steps run in file order, in one container, sharing /ci/build.
2	# Alpine, so the published binary is the same static musl build the
3	# Containerfile ships.
4
5	image = "docker.io/rust:1.98-alpine3.24"
6	work_dir = "/ci/build"
7	clone_project_to = "/ci/build/project"
8
9	# busybox ash, which does support `set -o pipefail`.
10	shell = ["/bin/sh", "-c"]
11
12	# CARGO_TARGET_DIR must stay outside clone_project_to: the checkout is
13	# extracted over that directory, so a cache inside it would be overwritten.
14	shell_setup = """
15	set -euo pipefail
16	export CARGO_TARGET_DIR=/ci/cache/target
17	"""
18
19	timeout = 5400
20	memory_limit = "6g"
21
22	# Caps are a safety valve against unbounded growth, not a budget: hitting one
23	# costs a full rebuild. Sized roughly twice the working set. A local target
24	# holding all three profiles measures 26G, of which debug is 22G.
25	cache = [
26	{ path = "/ci/cache/target", max_size = "20g" },
27	{ path = "/usr/local/cargo/registry", max_size = "4g" },
28	{ path = "/root/.bun/install/cache", max_size = "2g" },
29	]
30
31	[on]
32	push = ["master"]
33	tag = true
34
35	# bun publishes no musl installer, so take the binary from the official image.
36	# This mirrors the Containerfile's COPY --from. The -alpine tag is required:
37	# the glibc build will not run here. bun also needs libstdc++, which setup
38	# installs before anything executes it.
39	[[copy]]
40	image = "docker.io/oven/bun:1.4.2-alpine"
41	from = "/usr/local/bin/bun"
42	to = "/usr/local/bin"
43
44	[variables]
45
46	[variables.TRUNK_VERSION]
47	default = "0.21.14"
48	description = "Trunk release that builds the wasm frontend. Matches the Containerfile."
49
50	# ── toolchain ────────────────────────────────────────────────────────────────
51	# binaryen supplies wasm-opt. Without it trunk downloads a glibc build that
52	# cannot run on musl. just comes from apk here, so no install script.
53	[[steps]]
54	name = "setup"
55	timeout = 900
56	run_sh = """
57	# openssl-dev + openssl-libs-static: webauthn-rs links OpenSSL, and this is
58	# a static musl build. make builds jemalloc. Mirrors the Containerfile's
59	# build stage.
60	apk add --no-cache musl-dev binaryen just curl libstdc++ make \
61	openssl-dev openssl-libs-static pkgconfig
62
63	# The official rust images use rustup's minimal profile, so rustfmt and
64	# clippy are absent. `just lint` needs both.
65	rustup component add rustfmt clippy
66	rustup target add wasm32-unknown-unknown
67
68	url="https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-musl.tar.gz"
69	curl -fsSL -o /tmp/trunk.tar.gz "$url"
70	curl -fsSL "$url.sha256" \| awk '{print $1 " /tmp/trunk.tar.gz"}' \| sha256sum -c -
71	tar xzf /tmp/trunk.tar.gz -C /usr/local/bin
72	rm -f /tmp/trunk.tar.gz
73
74	just --version && bun --version && trunk --version
75	cargo fmt --version && cargo clippy --version
76	"""
77
78	# ── checks ───────────────────────────────────────────────────────────────────
79	# Formatting and clippy findings are reported, not gated. The pinned CI
80	# toolchain can lag local machines, and clippy disagrees across versions.
81	[[steps]]
82	name = "lint"
83	run_sh = "cd project && just lint"
84	warn_on_fail = true
85
86	[[steps]]
87	name = "test"
88	run_sh = "cd project && just test"
89
90	# ── build ────────────────────────────────────────────────────────────────────
91	[[steps]]
92	name = "build"
93	timeout = 2400
94	run_sh = "cd project && just build"
95	publish_file = ["/ci/cache/target/release/dovenest"]
96
97	# `just e2e` would rebuild the frontend. The build step already staged
98	# server/dist, so run the embedded suite against it directly.
99	[[steps]]
100	name = "e2e"
101	run_sh = "cd project && cargo test -p server --features embedded --test api embedded"
102
103	# ── release ──────────────────────────────────────────────────────────────────
104	[[steps]]
105	name = "release"
106	run_if = 'test -n "${CI_COMMIT_TAG}"'
107	run_sh = """
108	cd project
109	install -Dm755 "${CARGO_TARGET_DIR}/release/dovenest" \
110	"dist/dovenest-${CI_COMMIT_TAG}-x86_64-linux-musl"
111	"""
112	publish_gzip = ["/ci/build/project/dist/"]
113
114	# ── image ────────────────────────────────────────────────────────────────────
115	# Packages the binary the build step made, so the image ships exactly what
116	# e2e tested. The Containerfile's build stage is skipped via BIN_STAGE.
117	# build_image builds it in a VM on the server and pushes it to this repo's
118	# registry. A branch run pushes the short sha and "edge". A tag run pushes
119	# the short sha, the tag and "latest". Tags cannot depend on the trigger, so
120	# run_if picks one of two image steps.
121	[[steps]]
122	name = "image-files"
123	run_sh = """
124	cd project
125	mkdir -p ci-bin
126	cp "${CARGO_TARGET_DIR}/release/dovenest" ci-bin/dovenest
127	"""
128
129	[[steps]]
130	name = "image"
131	run_if = 'test -z "${CI_COMMIT_TAG}"'
132	timeout = 900
133	[steps.build_image]
134	args = { BIN_STAGE = "prebuilt" }
135	tags = ["$CI_COMMIT_SHORT_SHA", "edge"]
136
137	[[steps]]
138	name = "image-release"
139	run_if = 'test -n "${CI_COMMIT_TAG}"'
140	timeout = 900
141	[steps.build_image]
142	args = { BIN_STAGE = "prebuilt" }
143	tags = ["$CI_COMMIT_SHORT_SHA", "$CI_COMMIT_TAG", "latest"]
144