ekklesiaandClaude Opus 5.5
35ef31df9f
CI / verify (pull_request) Successful in 57s
CI / infrastructure-smoke (pull_request) Successful in 35s
CI / migration-smoke (pull_request) Successful in 1m42s
CI / image-build (pull_request) Successful in 29s
CI / deploy-smoke (same-origin) (pull_request) Successful in 51s
CI / deploy-smoke (split) (pull_request) Failing after 54s
A separately versioned module is now distributed as one deterministic .tar.gz and its SHA-256, produced by an Ekklesia-owned packager and checked by Core before anything is installed. This slice implements the portable `any` target, with the module template as the end-to-end proof. ADR 0049 is accepted. @ekklesia/contracts: the Module Package v1 contract. The strict ekklesia.package.json schema (packageFormat 1, identity, target, runtime, provenance, incorporated Ekklesia packages, strict transitional facts, an exact byte-wise-sorted file list with size and SHA-256), target names, and the generated runtime package.json. @ekklesia/module-pack (new, tooling): `ekklesia-pack-module --module <dir> --target any --out <dir> --source-revision <commit>`. - Bundles server, schema, and jobs with esbuild, SDK, contracts, and Drizzle included; only Node built-ins remain imports. Any warning, unresolved import, external dependency, or native or platform-specific package fails. - Copies browser artifacts as built, after proving them current, and the migrations; generates package.json and ekklesia.package.json; never ships src, tests, declarations, source maps, or workspace ranges. - THIRD_PARTY_NOTICES: every third-party package traced from the bundles' own inputs, credited once with its declared licence and every licence, copying, copyright, and notice file it ships. A missing licence fails; a missing text fails unless its standard text is complete without copyright lines (Apache-2.0, vendored, needed by drizzle-orm). - Deterministic ustar and gzip: sorted paths, uid/gid 0, empty names, mtime 0, 0755/0644, no links. Byte-identical across runs and machines. - Writes only the archive and its .sha256; never deploys, links, or installs, so the workspace's install state is untouched. Core: verifyModulePackage and `verify-module-package.js <archive> [--sha256 | --sha256-file] [--extract-to <new dir>]`. Reads the archive in memory and refuses links, special entries, setuid/setgid/sticky modes, unsafe or escaping paths, and a second top-level directory; checks metadata, every file, identity, target, Node.js range, SDK, and the transitional Drizzle agreement; runs the platform's module and migration discovery; loads the backend once in a forked process with an empty environment; only then extracts, with normalized modes, into a new directory. Errors are sanitized. @ekklesia/module-ui-build: analyzeModuleUi reports each artifact's inputs and whether the built file is current. The nested stylesheet build now works from the module directory, so artifacts no longer depend on the caller's working directory. The split deploy smoke builds the package with the canonical packager (scripts/lib/build-module-package.Dockerfile replaces the test-only pnpm deploy packaging), verifies it with the same generic image, installs the verified tree, removes it, and reinstalls the exact same archive. Co-Authored-By: Claude Opus 5.5 <[email protected]>
32 lines
1.5 KiB
Docker
32 lines
1.5 KiB
Docker
# Builds the repository's module template and packages it with the canonical Ekklesia packager
|
|
# (`@ekklesia/module-pack`, ADR 0049), in a clean container from a clean copy of the checkout. The
|
|
# deploy smoke test uses it because a CI job that drives Docker has no Node.js of its own. The
|
|
# packaging itself is exactly what a module's CI runs; this file only provides the environment.
|
|
#
|
|
# DOCKER_BUILDKIT=1 docker build --file scripts/lib/build-module-package.Dockerfile \
|
|
# --build-arg SOURCE_REVISION=<full commit id> --output type=local,dest=<directory> .
|
|
#
|
|
# writes <directory>/example-<version>-any.tar.gz and its .sha256 line. No image is produced.
|
|
#
|
|
# The same pinned Node.js base as deploy/Dockerfile, so the package is built by the runtime it is
|
|
# installed into.
|
|
FROM node:24.18.0-trixie-slim@sha256:ae91dcc111a68c9d2d81ff2a17bda61be126426176fde6fe7d08ab13b7f50573 AS build
|
|
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0 \
|
|
PNPM_HOME=/pnpm \
|
|
TURBO_TELEMETRY_DISABLED=1 \
|
|
DO_NOT_TRACK=1
|
|
WORKDIR /opt/source
|
|
COPY package.json ./
|
|
RUN corepack enable && corepack install
|
|
COPY . .
|
|
RUN --mount=type=cache,id=ekklesia-pnpm-store,target=/pnpm/store \
|
|
pnpm install --frozen-lockfile --store-dir /pnpm/store
|
|
RUN pnpm exec turbo run build --filter=@ekklesia/module-template --filter=@ekklesia/module-pack
|
|
ARG SOURCE_REVISION
|
|
RUN test -n "$SOURCE_REVISION" && \
|
|
node packages/module-pack/bin/ekklesia-pack-module.mjs --module templates/module --target any \
|
|
--out /package --source-revision "$SOURCE_REVISION"
|
|
|
|
FROM scratch AS package
|
|
COPY --from=build /package/ /
|