neonoverlordandClaude Opus 5.5
c218a21183
build / build (push) Successful in 4m33s
Build 46222 failed at npm ci: 'Authentication failed for https://code.bawnet.io/mirror/sapper.git'. The ci account can read it (checked: 200); pass CI_USER/CI_TOKEN into the build container as env and declare a credential helper via GIT_CONFIG_* -- no creds in URLs or files. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
67 lines
3.4 KiB
YAML
67 lines
3.4 KiB
YAML
name: build
|
|
|
|
# Pinnacle CI -- psn-runner house pattern (see ops/psn-docker README "The CI").
|
|
# Toolchain from psn-base + deb.bawnet.io; dependency tree pinned by the
|
|
# committed package-lock.json; sapper comes from mirror/sapper on this node.
|
|
# Nothing in this build touches github.com or any registry outside the
|
|
# lockfile-pinned npm fetches.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: psn
|
|
steps:
|
|
- name: build pinnacle
|
|
run: |
|
|
set -e
|
|
. /etc/psn-ci.env
|
|
export CI_USER CI_TOKEN # the env file has no `export`; docker -e needs them exported
|
|
# cleanup in a trap: under `set -e` a failed build exits before a
|
|
# trailing rm and leaks the ~450MB checkout into /tmp (tmpfs = RAM).
|
|
# The container writes node_modules as root, so hand the tree back to
|
|
# the runner's uid first or the rm fails; both || true so cleanup can
|
|
# never change the step's verdict.
|
|
WORK=$(mktemp -d)
|
|
trap 'docker run --rm -v "$WORK":/w code.bawnet.io/ops/psn-base:latest chown -R "$(id -u):$(id -g)" /w >/dev/null 2>&1 || true; rm -rf "$WORK" || true' EXIT INT TERM
|
|
OUT=/var/tmp/psn-artifacts/pinnacle
|
|
git clone -q "https://$CI_USER:$CI_TOKEN@code.bawnet.io/bawnet/pinnacle" "$WORK"
|
|
echo "building pinnacle @ $(cd "$WORK" && git rev-parse --short HEAD)"
|
|
mkdir -p "$OUT"
|
|
|
|
# mirror/ is a PRIVATE org (anonymous clone = 401 since the org went
|
|
# private after the 2026-08-13 build), so npm's git fetch of
|
|
# mirror/sapper must authenticate. Creds ride ENV only -- a credential
|
|
# helper declared through GIT_CONFIG_* variables -- never a URL, never
|
|
# a file (feedback: creds in clone URLs land in .git/config).
|
|
docker run --rm -e CI_USER -e CI_TOKEN -v "$WORK":/src -v "$OUT":/out -w /src \
|
|
code.bawnet.io/ops/psn-base:latest \
|
|
bash -euo pipefail -c "
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y -qq --no-install-recommends \
|
|
nodejs npm git ca-certificates python3 make g++ >/dev/null
|
|
node --version; npm --version
|
|
export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=credential.https://code.bawnet.io.helper
|
|
export GIT_CONFIG_VALUE_0='!f() { echo username=\$CI_USER; echo password=\$CI_TOKEN; }; f'
|
|
npm ci --no-audit --no-fund
|
|
# build-nc: export basepathed under the NC app route (ops/features#30)
|
|
npm run build-nc
|
|
VERSION=\$(python3 -c \"import json;print(json.load(open('package.json'))['version'])\")
|
|
tar -czf /out/pinnacle-\$VERSION-export.tar.gz -C __sapper__ export
|
|
( cd /out && sha256sum pinnacle-\$VERSION-export.tar.gz | tee pinnacle-\$VERSION-export.tar.gz.sha256 )
|
|
# build-gts: the SAME source, exported under /pinnacle with the
|
|
# instance fixed to social.bawnet.io — the build that is bundled
|
|
# INTO the node GoToSocial image (ops/features#54)
|
|
rm -rf __sapper__/export
|
|
npm run build-gts
|
|
tar -czf /out/pinnacle-gts-\$VERSION-export.tar.gz -C __sapper__ export
|
|
( cd /out && sha256sum pinnacle-gts-\$VERSION-export.tar.gz | tee pinnacle-gts-\$VERSION-export.tar.gz.sha256 )
|
|
"
|
|
|
|
echo "artifact:"; ls -lh "$OUT"
|