julian
8155ff456b
Containerize the two non-desktop apps for the booth appliance. The desktop app stays on its own tag-only release.yml. - apps/server/Dockerfile: multi-stage node:22-alpine. `pnpm deploy --legacy --prod` (NOT prune — the monorepo native better-sqlite3 won't resolve under a root prune) yields a self-contained bundle; build stage adds node-gyp toolchain, runtime adds libstdc++; non-root, healthcheck. Migrates the mounted DB on boot via a drizzle-kit- free runtime migrator (packages/db/scripts/migrate-runtime.mjs) — drizzle-kit is a devDep, pruned from prod. - apps/server/src/static-spa.ts: Fastify serves the built React SPA (one container serves API + UI). GET-only fallback to index.html, excludes /api + /health so it never shadows the backend; a no-op in dev (no dist). Registered last in server.ts. - apps/vision/Dockerfile: uv base, --extra alpr, model weights PRE-WARMED into the image as the runtime user so fast_alpr boots offline (0 downloads at runtime). Engine env- selected (VISION_RECOGNIZER stub|fast_alpr). - Branch-aware: docker-compose.yml (base) + .dev.yml (build local, stub, ports) + .prod.yml (pull pinned, fast_alpr, vision internal, restart always); REGISTRY/TAG from env so a branch deploy pulls that branch's image. - .gitea/workflows/build-images.yml: on push to dev/main, run the full turbo build+lint+ test gate, then buildx push both images to git.infra.msai.al/mca/parking_solution with branch + branch-<sha> tags (registry cache; optional Komodo webhook behind KOMODO_ENABLED). - .dockerignore excludes **/parking.sqlite* so the signed ledger is NEVER baked. Verified locally (Docker 29): server image migrates + serves API+SPA (/health 200, / + /booth HTML, /api/nope JSON 404, no sqlite outside /data); vision image boots fast_alpr with 0 runtime downloads; compose stack healthy with server→vision over the private network. Wiki: new container-deployment.md; vision-service-packaging open Qs resolved; index + log. Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
118 lines
4.1 KiB
YAML
118 lines
4.1 KiB
YAML
name: Build & push images
|
|
|
|
# Build the SERVER (API + SPA) and VISION (ANPR) container images and push them to the
|
|
# house Gitea registry, tagged by BRANCH + short SHA (branch-aware: dev→:dev, main→:main).
|
|
# Separate from ci.yml (checks-only) and release.yml (tag-only desktop bundle). Mirrors the
|
|
# house pattern (cf. trm/processor build.yml). See wiki/decisions/container-deployment.md.
|
|
|
|
on:
|
|
push:
|
|
branches: [dev, main]
|
|
paths:
|
|
- 'apps/server/**'
|
|
- 'apps/web/**'
|
|
- 'apps/vision/**'
|
|
- 'packages/**'
|
|
- 'package.json'
|
|
- 'pnpm-lock.yaml'
|
|
- 'pnpm-workspace.yaml'
|
|
- 'turbo.json'
|
|
- 'docker-compose*.yml'
|
|
- '.dockerignore'
|
|
- '.gitea/workflows/build-images.yml'
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
REGISTRY: git.infra.msai.al/mca/parking_solution
|
|
|
|
jobs:
|
|
images:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Node 22
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
|
|
- name: Enable pnpm
|
|
run: corepack enable && corepack prepare pnpm@10.24.0 --activate
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Set up uv (for @parking/vision checks)
|
|
uses: astral-sh/setup-uv@v5
|
|
|
|
- name: Sync vision deps
|
|
working-directory: apps/vision
|
|
run: uv sync --frozen
|
|
|
|
# Don't publish a broken image — run the same checks as ci.yml first.
|
|
- name: Build + lint + test (Turbo)
|
|
run: pnpm turbo run build lint test
|
|
|
|
- name: Compute tags
|
|
id: meta
|
|
# BRANCH = the pushed branch (dev|main); SHA = short commit. Two tags per image:
|
|
# the moving branch tag + an immutable branch-SHA tag.
|
|
run: |
|
|
BRANCH="${GITHUB_REF_NAME}"
|
|
SHA="$(echo "${GITHUB_SHA}" | cut -c1-7)"
|
|
echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
|
|
echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
with:
|
|
driver: docker-container
|
|
|
|
- name: Login to Gitea Registry
|
|
uses: docker/login-action@v3
|
|
with:
|
|
registry: git.infra.msai.al
|
|
username: ${{ secrets.REGISTRY_USERNAME }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
- name: Build & push SERVER (API + SPA)
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: apps/server/Dockerfile
|
|
push: true
|
|
tags: |
|
|
${{ env.REGISTRY }}/parking-server:${{ steps.meta.outputs.branch }}
|
|
${{ env.REGISTRY }}/parking-server:${{ steps.meta.outputs.branch }}-${{ steps.meta.outputs.sha }}
|
|
cache-from: type=registry,ref=${{ env.REGISTRY }}/parking-server:buildcache
|
|
cache-to: type=registry,ref=${{ env.REGISTRY }}/parking-server:buildcache,mode=max
|
|
|
|
- name: Build & push VISION (ANPR)
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: apps/vision
|
|
file: apps/vision/Dockerfile
|
|
push: true
|
|
tags: |
|
|
${{ env.REGISTRY }}/parking-vision:${{ steps.meta.outputs.branch }}
|
|
${{ env.REGISTRY }}/parking-vision:${{ steps.meta.outputs.branch }}-${{ steps.meta.outputs.sha }}
|
|
cache-from: type=registry,ref=${{ env.REGISTRY }}/parking-vision:buildcache
|
|
cache-to: type=registry,ref=${{ env.REGISTRY }}/parking-vision:buildcache,mode=max
|
|
|
|
# Optional: trigger a Komodo stack redeploy (cf. trm/processor). Enable by setting the
|
|
# KOMODO_* secrets; left guarded so it no-ops until the parking stack is wired.
|
|
- name: Trigger Komodo redeploy
|
|
if: success() && vars.KOMODO_ENABLED == 'true'
|
|
env:
|
|
URL: ${{ secrets.KOMODO_STACK_WEBHOOK_URL }}
|
|
SECRET: ${{ secrets.KOMODO_WEBHOOK_SECRET }}
|
|
run: |
|
|
body="{\"ref\":\"refs/heads/${GITHUB_REF_NAME}\"}"
|
|
sig=$(printf '%s' "$body" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')
|
|
curl -fsS -X POST \
|
|
-H 'Content-Type: application/json' \
|
|
-H "X-Hub-Signature-256: sha256=$sig" \
|
|
-d "$body" \
|
|
"$URL"
|