neonoverlordandClaude Fable 5
15026cb517
build / build (push) Successful in 3m24s
Under `set -e` any failure between mktemp and the trailing rm -rf exits the step first and leaks the checkout into /tmp — which is tmpfs on srv, so the leak is RAM. 44 leaked dirs / 4.1G had accumulated by 2026-08-13 (node-identity.yml additionally never removed $WORK at all). Same trap idiom psn-base/bootstrap.sh and the ops/bawnet workflows already use. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
52 lines
2.2 KiB
YAML
52 lines
2.2 KiB
YAML
name: build
|
|
|
|
# Pinnacle CI -- psn-runner house pattern (see ops/psn-docker README "The CI").
|
|
# Toolchain from psn-base + deb.bawnet.io; dependency tree pinned by the
|
|
# committed package-lock.json; sapper comes from mirror/sapper on this node.
|
|
# Nothing in this build touches github.com or any registry outside the
|
|
# lockfile-pinned npm fetches.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ['v*']
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: psn
|
|
steps:
|
|
- name: build pinnacle
|
|
run: |
|
|
set -e
|
|
. /etc/psn-ci.env
|
|
# cleanup in a trap: under `set -e` a failed build exits before a
|
|
# trailing rm and leaks the ~450MB checkout into /tmp (tmpfs = RAM).
|
|
# The container writes node_modules as root, so hand the tree back to
|
|
# the runner's uid first or the rm fails; both || true so cleanup can
|
|
# never change the step's verdict.
|
|
WORK=$(mktemp -d)
|
|
trap 'docker run --rm -v "$WORK":/w code.bawnet.io/ops/psn-base:latest chown -R "$(id -u):$(id -g)" /w >/dev/null 2>&1 || true; rm -rf "$WORK" || true' EXIT INT TERM
|
|
OUT=/var/tmp/psn-artifacts/pinnacle
|
|
git clone -q "https://$CI_USER:$CI_TOKEN@code.bawnet.io/bawnet/pinnacle" "$WORK"
|
|
echo "building pinnacle @ $(cd "$WORK" && git rev-parse --short HEAD)"
|
|
mkdir -p "$OUT"
|
|
|
|
docker run --rm -v "$WORK":/src -v "$OUT":/out -w /src \
|
|
code.bawnet.io/ops/psn-base:latest \
|
|
bash -euo pipefail -c "
|
|
export DEBIAN_FRONTEND=noninteractive
|
|
apt-get update -qq
|
|
apt-get install -y -qq --no-install-recommends \
|
|
nodejs npm git ca-certificates python3 make g++ >/dev/null
|
|
node --version; npm --version
|
|
npm ci --no-audit --no-fund
|
|
# build-nc: export basepathed under the NC app route (ops/features#30)
|
|
npm run build-nc
|
|
VERSION=\$(python3 -c \"import json;print(json.load(open('package.json'))['version'])\")
|
|
tar -czf /out/pinnacle-\$VERSION-export.tar.gz -C __sapper__ export
|
|
cd /out && sha256sum pinnacle-\$VERSION-export.tar.gz | tee pinnacle-\$VERSION-export.tar.gz.sha256
|
|
"
|
|
|
|
echo "artifact:"; ls -lh "$OUT"
|