Neon Overlord
b42ee00125
build / build (push) Successful in 5m31s
The build container runs as root and writes node_modules and vendor into the bind-mounted work dir; the runner is gitea-ci and cannot delete them, so rm -rf failed and sank runs 5 and 6 after the artifact was already written. The failure only exists on the success path, which is why it never showed while earlier bugs were failing the job inside the container. chown the tree to the runner's uid from a throwaway container, then rm. Assisted-by: Claude Code:claude-fable-5
73 lines
3.5 KiB
YAML
73 lines
3.5 KiB
YAML
name: build
|
|
|
|
# Builds the Nextcloud app archive on the psn runner, following the same shape
|
|
# as ops/psn-docker: run directly on the runner, clone by hand with credentials
|
|
# from /etc/psn-ci.env, and shell out to docker. No marketplace actions and no
|
|
# `container:` key -- neither is available here.
|
|
#
|
|
# The toolchain comes from psn-base + deb.bawnet.io, notably composer: upstream's
|
|
# `make composer` falls back to piping getcomposer.org/installer into php when
|
|
# composer is absent, and this node does not run pipe-to-shell installers.
|
|
#
|
|
# `npm ci` fetching from the public registry is the one non-sovereign hop.
|
|
# package-lock.json pins every dependency with an integrity hash.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: psn
|
|
steps:
|
|
- name: build app archive
|
|
run: |
|
|
set -e
|
|
. /etc/psn-ci.env
|
|
WORK=$(mktemp -d)
|
|
OUT=/var/tmp/psn-artifacts/integration_gotosocial
|
|
git clone -q "https://$CI_USER:$CI_TOKEN@code.bawnet.io/bawnet/integration_gotosocial" "$WORK"
|
|
VERSION=$(sed -n 's:.*<version>\(.*\)</version>.*:\1:p' "$WORK/appinfo/info.xml" | head -1)
|
|
echo "building integration_gotosocial $VERSION from $(cd "$WORK" && git rev-parse --short HEAD)"
|
|
mkdir -p "$OUT"
|
|
|
|
docker run --rm -v "$WORK":/src -v "$OUT":/out -w /src \
|
|
code.bawnet.io/ops/psn-base:latest \
|
|
bash -euo pipefail -c "
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y -qq --no-install-recommends \
|
|
nodejs npm php-cli php-xml php-mbstring php-zip \
|
|
composer git make rsync sudo ca-certificates >/dev/null
|
|
node --version; npm --version
|
|
command -v composer >/dev/null || {
|
|
echo 'FATAL: composer absent - makefile would pipe an installer to php'; exit 1; }
|
|
|
|
composer install --prefer-dist --no-interaction --no-progress -q
|
|
npm ci --no-audit --no-fund
|
|
npm run build
|
|
|
|
# every PHP file must parse before we package it
|
|
find lib -name '*.php' -exec php -l {} \; | grep -v 'No syntax errors' && exit 1
|
|
|
|
# widget IDs are global in Nextcloud: they must not collide with
|
|
# integration_mastodon, and the JS registrations must match the PHP
|
|
php_ids=\$(grep -ho \"return 'gotosocial_[a-z_]*'\" lib/Dashboard/*.php | sed \"s/return '//;s/'//\" | sort)
|
|
js_ids=\$(grep -ho \"OCA.Dashboard.register('[^']*'\" src/dashboard.js src/dashboardHome.js | sed \"s/.*register('//;s/'//\" | sort)
|
|
[ \"\$php_ids\" = \"\$js_ids\" ] || { echo \"FATAL: widget ID mismatch\"; echo \"php: \$php_ids\"; echo \"js: \$js_ids\"; exit 1; }
|
|
grep -rq \"return 'mastodon_\" lib/Dashboard/ && { echo 'FATAL: upstream widget ID would collide'; exit 1; }
|
|
|
|
make appstore version=$VERSION
|
|
cp /tmp/build/integration_gotosocial-$VERSION.tar.gz /out/
|
|
cd /out && sha256sum integration_gotosocial-$VERSION.tar.gz \
|
|
| tee integration_gotosocial-$VERSION.tar.gz.sha256
|
|
"
|
|
|
|
# the container wrote node_modules/vendor as root; hand the tree back
|
|
# to the runner's uid or rm -rf fails and sinks an otherwise green run
|
|
docker run --rm -v "$WORK":/w code.bawnet.io/ops/psn-base:latest chown -R "$(id -u):$(id -g)" /w
|
|
rm -rf "$WORK"
|
|
echo "artifact:"; ls -lh "$OUT"
|