pinnacle/.gitea/workflows/build.yml

name: build

# Pinnacle CI -- psn-runner house pattern (see ops/psn-docker README "The CI").
# Toolchain from psn-base + deb.bawnet.io; dependency tree pinned by the
# committed package-lock.json; sapper comes from mirror/sapper on this node.
# Nothing in this build touches github.com or any registry outside the
# lockfile-pinned npm fetches.

on:
  push:
    branches: [main]
    tags: ['v*']
  workflow_dispatch:

jobs:
  build:
    runs-on: psn
    steps:
      - name: build pinnacle
        run: |
          set -e
          . /etc/psn-ci.env
          export CI_USER CI_TOKEN   # the env file has no `export`; docker -e needs them exported
          # cleanup in a trap: under `set -e` a failed build exits before a
          # trailing rm and leaks the ~450MB checkout into /tmp (tmpfs = RAM).
          # The container writes node_modules as root, so hand the tree back to
          # the runner's uid first or the rm fails; both || true so cleanup can
          # never change the step's verdict.
          WORK=$(mktemp -d)
          trap 'docker run --rm -v "$WORK":/w code.bawnet.io/ops/psn-base:latest chown -R "$(id -u):$(id -g)" /w >/dev/null 2>&1 || true; rm -rf "$WORK" || true' EXIT INT TERM
          OUT=/var/tmp/psn-artifacts/pinnacle
          git clone -q "https://$CI_USER:$CI_TOKEN@code.bawnet.io/bawnet/pinnacle" "$WORK"
          echo "building pinnacle @ $(cd "$WORK" && git rev-parse --short HEAD)"
          mkdir -p "$OUT"

          # mirror/ is a PRIVATE org (anonymous clone = 401 since the org went
          # private after the 2026-08-13 build), so npm's git fetch of
          # mirror/sapper must authenticate. Creds ride ENV only -- a credential
          # helper declared through GIT_CONFIG_* variables -- never a URL, never
          # a file (feedback: creds in clone URLs land in .git/config).
          # the GTS build goes to its OWN dir: the NC app's build picks its input
          # with `ls -t pinnacle-*-export.tar.gz`, which a pinnacle-gts-* file in
          # $OUT would match (and win, being newer) -- found 2026-09-23 before
          # any NC build ran.
          OUT_GTS=/var/tmp/psn-artifacts/pinnacle-gts
          mkdir -p "$OUT_GTS"
          docker run --rm -e CI_USER -e CI_TOKEN -v "$WORK":/src -v "$OUT":/out -v "$OUT_GTS":/out-gts -w /src \
            code.bawnet.io/ops/psn-base:latest \
            bash -euo pipefail -c "
              export DEBIAN_FRONTEND=noninteractive
              apt-get update -qq
              apt-get install -y -qq --no-install-recommends \
                nodejs npm git ca-certificates python3 make g++ >/dev/null
              node --version; npm --version
              export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=credential.https://code.bawnet.io.helper
              export GIT_CONFIG_VALUE_0='!f() { echo username=\$CI_USER; echo password=\$CI_TOKEN; }; f'
              npm ci --no-audit --no-fund
              # build-nc: export basepathed under the NC app route (ops/features#30)
              npm run build-nc
              VERSION=\$(python3 -c \"import json;print(json.load(open('package.json'))['version'])\")
              tar -czf /out/pinnacle-\$VERSION-export.tar.gz -C __sapper__ export
              ( cd /out && sha256sum pinnacle-\$VERSION-export.tar.gz | tee pinnacle-\$VERSION-export.tar.gz.sha256 )
              # build-gts: the SAME source, exported under /pinnacle with the
              # instance fixed to social.bawnet.io — the build that is bundled
              # INTO the node GoToSocial image (ops/features#54)
              rm -rf __sapper__/export
              npm run build-gts
              mkdir -p /out-gts
              tar -czf /out-gts/pinnacle-gts-export.tar.gz -C __sapper__ export
              ( cd /out-gts && sha256sum pinnacle-gts-export.tar.gz | tee pinnacle-gts-export.tar.gz.sha256 )
            "

          echo "artifact:"; ls -lh "$OUT" "$OUT_GTS"

          # Publish the GTS build to OUR package registry (ops/features#54): the
          # node GoToSocial image pulls artifacts only from there (psn-docker
          # .artifact), pinned to an exact version, never from this runner's
          # disk (machines are ephemeral). Version = package.json version +
          # short sha, so every commit is a distinct, immutable artifact and
          # bumping GTS's copy is a deliberate one-line .artifact edit.
          # /etc/psn-builder.env = the registry push credential (write:package).
          if [ "${GITHUB_REF:-}" = "refs/heads/main" ] || [ "${GITHUB_REF#refs/tags/}" != "${GITHUB_REF:-}" ]; then
            set -a; . /etc/psn-builder.env; set +a
            PV=$(python3 -c "import json;print(json.load(open('$WORK/package.json'))['version'])")-$(git -C "$WORK" rev-parse --short=8 HEAD)
            REG=https://code.bawnet.io/api/packages/ops/generic/pinnacle-gts/$PV
            for f in pinnacle-gts-export.tar.gz pinnacle-gts-export.tar.gz.sha256; do
              code=$(curl -s -o /dev/null -w '%{http_code}' -u "$GITEA_USER:$GITEA_TOKEN" --upload-file "$OUT_GTS/$f" "$REG/$f")
              case "$code" in 201) echo "published pinnacle-gts $PV/$f" ;; 409) echo "already published: $PV/$f" ;; *) echo "PUBLISH FAILED ($code): $PV/$f"; exit 1 ;; esac
            done
            echo "GTS .artifact line:  pinnacle-gts:$PV:pinnacle-gts-export.tar.gz"
          fi