agent_vscode
5f3f720d9a
Retrospective of 22.06-10.07 merges showed one recurring miss class: local logic verified, integration property never checked (#361, #353, #452, #172, #435). This lands four gates so each of those classes fails BEFORE the :develop image is pushed: 1. Image boot-smoke in the publish job (develop.yml + scripts/ci/image-smoke.sh): the exact image watchtower pulls is booted against postgres/redis services before the push — /api/health (startup migrator, #361-boot/#353), auth/setup, client dist served, hashed assets immutable + brotli (#452). 2. migration-order gate now also runs on push (test.yml): direct pushes used to bypass the PR-only gate; base = event.before, zero-SHA skips, force-push fails closed. 3. External-MCP tool allowlist fails closed (#172 class): corrupt stored value now reads as [] (deny-all) with an error log instead of null (allow-all); [] round-trips as jsonb [] via jsonbBind({preserveEmpty}) and means deny-all in the toolset filter. The settings form sends null for an empty tag field so existing "unrestricted" servers are not silently narrowed. 4. Property tests for the silent-degradation classes: converter fixpoint through the live server path (mcp e2e), and CollabSession cache-key stability under per-call fresh tokens (#435/#439 lesson) incl. a negative control with the token cache disabled. Closes #476 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
333 lines
11 KiB
YAML
333 lines
11 KiB
YAML
name: Develop
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- develop
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: develop-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
|
|
env:
|
|
IMAGE: ghcr.io/vvzvlad/gitmost
|
|
|
|
jobs:
|
|
# Run the reusable test suite. Together with the e2e jobs below it gates the
|
|
# publish job (the image push), not the build itself — build runs in parallel.
|
|
test:
|
|
uses: ./.github/workflows/test.yml
|
|
|
|
# Runs in parallel with the test/e2e jobs and only warms the buildx cache
|
|
# (GHA cache, scope develop-amd64). No push happens here — the publish job
|
|
# below is the only one that pushes the image.
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Resolve version
|
|
id: version
|
|
run: echo "value=$(git describe --tags --always)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build develop image (warm cache, no push)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64
|
|
build-args: |
|
|
APP_VERSION=${{ steps.version.outputs.value }}
|
|
AI_AGENT_ROLES_CATALOG_URL=https://raw.githubusercontent.com/vvzvlad/gitmost/develop/agent-roles-catalog
|
|
push: false
|
|
cache-from: type=gha,scope=develop-amd64
|
|
cache-to: type=gha,scope=develop-amd64,mode=max,ignore-error=true
|
|
|
|
# The gate: rebuilds from the cache the build job just wrote (near-instant on
|
|
# a cache hit; worst case — cache eviction — a full rebuild, which matches the
|
|
# old sequential timing) and pushes :develop only when unit tests AND both
|
|
# e2e suites AND the build are green.
|
|
publish:
|
|
needs: [test, e2e-server, e2e-mcp, build]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
# Image boot-smoke (issue #476): every other job tests code from the working
|
|
# tree, but the :develop IMAGE that watchtower pulls was never actually
|
|
# started anywhere (incident classes #353/#452/#361-boot: startup-migrator
|
|
# crash-loop, runtime module missing from the image, wrong static-asset
|
|
# headers). The services below back a smoke boot of the exact image right
|
|
# before it is pushed; a smoke failure blocks the push.
|
|
services:
|
|
postgres:
|
|
# via mirror.gcr.io (Docker Hub pull-through cache; avoids Hub anonymous
|
|
# pull rate-limit that randomly fails on shared GitHub runner IPs).
|
|
image: mirror.gcr.io/pgvector/pgvector:pg18
|
|
env:
|
|
POSTGRES_DB: docmost
|
|
POSTGRES_USER: docmost
|
|
POSTGRES_PASSWORD: docmost
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U docmost"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
redis:
|
|
# via mirror.gcr.io (see postgres note above).
|
|
image: mirror.gcr.io/library/redis:7
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Resolve version
|
|
id: version
|
|
run: echo "value=$(git describe --tags --always)" >> "$GITHUB_OUTPUT"
|
|
|
|
# Load the image into the local docker daemon so it can be booted (the
|
|
# push step below exports straight to the registry and leaves nothing
|
|
# runnable locally). CONVENTION: build-args here must stay TEXTUALLY
|
|
# IDENTICAL to the push step's build-args — same cache scope + same args
|
|
# means the layers are reused and the image we smoke IS the image we push.
|
|
- name: Build image for smoke (load, no push)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64
|
|
build-args: |
|
|
APP_VERSION=${{ steps.version.outputs.value }}
|
|
AI_AGENT_ROLES_CATALOG_URL=https://raw.githubusercontent.com/vvzvlad/gitmost/develop/agent-roles-catalog
|
|
load: true
|
|
push: false
|
|
tags: gitmost:smoke
|
|
cache-from: type=gha,scope=develop-amd64
|
|
|
|
# Boot-smoke the exact image against the job services (see the comment on
|
|
# `services:` above): health (startup migrator), auth/setup, client dist
|
|
# served, immutable + brotli asset headers. Fails the job (and therefore
|
|
# the push) on any miss.
|
|
- name: Smoke the built image
|
|
run: bash scripts/ci/image-smoke.sh gitmost:smoke
|
|
|
|
# The smoke script leaves the container running on failure precisely so
|
|
# the boot error (migration mismatch, stack trace) is diagnosable here.
|
|
- name: Dump smoke container log on failure
|
|
if: failure()
|
|
run: docker logs gitmost-smoke 2>&1 | tail -200 || true
|
|
|
|
- name: Build and push develop image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
platforms: linux/amd64
|
|
build-args: |
|
|
APP_VERSION=${{ steps.version.outputs.value }}
|
|
AI_AGENT_ROLES_CATALOG_URL=https://raw.githubusercontent.com/vvzvlad/gitmost/develop/agent-roles-catalog
|
|
push: true
|
|
tags: ${{ env.IMAGE }}:develop
|
|
cache-from: type=gha,scope=develop-amd64
|
|
|
|
# e2e jobs gate the publish (image push), not the build: the :develop image
|
|
# is pushed only when unit tests AND both e2e suites pass (publish.needs
|
|
# lists them all).
|
|
e2e-server:
|
|
runs-on: ubuntu-latest
|
|
# Hard cap: the full-AppModule e2e leaks open handles and hung jest to the 6h max.
|
|
timeout-minutes: 15
|
|
env:
|
|
DATABASE_URL: postgresql://docmost:docmost@localhost:5432/docmost
|
|
REDIS_URL: redis://localhost:6379
|
|
APP_SECRET: ci-e2e-secret-change-me-min-32-characters
|
|
APP_URL: http://localhost:3000
|
|
services:
|
|
postgres:
|
|
# via mirror.gcr.io (Docker Hub pull-through cache; avoids Hub anonymous
|
|
# pull rate-limit that randomly fails on shared GitHub runner IPs).
|
|
image: mirror.gcr.io/pgvector/pgvector:pg18
|
|
env:
|
|
POSTGRES_DB: docmost
|
|
POSTGRES_USER: docmost
|
|
POSTGRES_PASSWORD: docmost
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U docmost"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
redis:
|
|
# via mirror.gcr.io (see postgres note above).
|
|
image: mirror.gcr.io/library/redis:7
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build editor-ext
|
|
run: pnpm --filter @docmost/editor-ext build
|
|
|
|
# @docmost/prosemirror-markdown is an ESM workspace package the server
|
|
# imports at runtime; its build/ is gitignored and test:e2e has no pretest
|
|
# hook, so build it before the e2e run (mirrors the test.yml job).
|
|
- name: Build prosemirror-markdown
|
|
run: pnpm --filter @docmost/prosemirror-markdown build
|
|
|
|
# docmost-client.loader.ts type-imports from @docmost/mcp (issue #446); its
|
|
# build/ is gitignored and `test:e2e` type-checks, so build it here or tsc
|
|
# fails with TS2307 (mirrors the e2e-mcp / mcp-server-parity jobs).
|
|
- name: Build mcp
|
|
run: pnpm --filter @docmost/mcp build
|
|
|
|
- name: Run migrations
|
|
run: pnpm --filter ./apps/server migration:latest
|
|
|
|
- name: Run server e2e
|
|
run: pnpm --filter ./apps/server test:e2e
|
|
|
|
# Gates the publish too — see the comment above e2e-server.
|
|
e2e-mcp:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
env:
|
|
DATABASE_URL: postgresql://docmost:docmost@localhost:5432/docmost
|
|
REDIS_URL: redis://localhost:6379
|
|
APP_SECRET: ci-e2e-secret-change-me-min-32-characters
|
|
APP_URL: http://localhost:3000
|
|
NODE_ENV: production
|
|
services:
|
|
postgres:
|
|
# via mirror.gcr.io (Docker Hub pull-through cache; avoids Hub anonymous
|
|
# pull rate-limit that randomly fails on shared GitHub runner IPs).
|
|
image: mirror.gcr.io/pgvector/pgvector:pg18
|
|
env:
|
|
POSTGRES_DB: docmost
|
|
POSTGRES_USER: docmost
|
|
POSTGRES_PASSWORD: docmost
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U docmost"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
redis:
|
|
# via mirror.gcr.io (see postgres note above).
|
|
image: mirror.gcr.io/library/redis:7
|
|
ports:
|
|
- 6379:6379
|
|
options: >-
|
|
--health-cmd "redis-cli ping"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 20
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Build editor-ext
|
|
run: pnpm --filter @docmost/editor-ext build
|
|
|
|
- name: Build server
|
|
run: pnpm server:build
|
|
|
|
- name: Build mcp
|
|
run: pnpm --filter @docmost/mcp build
|
|
|
|
- name: Run migrations
|
|
run: pnpm --filter ./apps/server migration:latest
|
|
|
|
- name: Start server (prod)
|
|
# Capture stdout/stderr so a start-up crash (bind error, stack trace,
|
|
# migration mismatch) is diagnosable; without this the only signal is
|
|
# the generic health-loop timeout below, ~120s later.
|
|
run: pnpm --filter ./apps/server start:prod > /tmp/server.log 2>&1 &
|
|
|
|
- name: Wait for server health
|
|
run: |
|
|
for i in $(seq 1 60); do
|
|
if curl -fsS http://localhost:3000/api/health > /dev/null; then
|
|
echo "Server is healthy"
|
|
exit 0
|
|
fi
|
|
sleep 2
|
|
done
|
|
echo "Server did not become healthy in time"
|
|
exit 1
|
|
|
|
- name: Dump server log on failure
|
|
if: failure()
|
|
run: cat /tmp/server.log || true
|
|
|
|
- name: Seed admin
|
|
run: |
|
|
curl -fsS -X POST http://localhost:3000/api/auth/setup \
|
|
-H "Content-Type: application/json" \
|
|
-d '{"name":"E2E","email":"e2e@example.com","password":"E2ePassword123","workspaceName":"E2E"}'
|
|
|
|
- name: Run mcp e2e
|
|
env:
|
|
DOCMOST_API_URL: http://localhost:3000/api
|
|
DOCMOST_EMAIL: e2e@example.com
|
|
DOCMOST_PASSWORD: E2ePassword123
|
|
run: pnpm --filter @docmost/mcp test:e2e
|