feat: build Signage on its own from the published Ekklesia 0.2.0 packages
Signage no longer needs an Ekklesia checkout. A clean clone installs with `pnpm install --frozen-lockfile` and runs lint, typecheck, test, build, and validate by itself, taking Ekklesia's module-development packages from Ekklesia's public registry (ADRs 0053 and 0054). - Dependencies: every `workspace:*` becomes `^0.2.0`. @ekklesia/module-pack is added as a devDependency pinned exactly to 0.2.0, as ADR 0053 requires; it is not invoked yet. No @ekklesia/contracts dependency. drizzle-orm stays a direct dependency, satisfying the adapter's optional peer. - .npmrc points the @ekklesia scope at https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/ with no credential, because reading needs none. - pnpm-workspace.yaml holds this repository's pnpm settings only: - `allowBuilds: esbuild: true`, as the platform's standalone fixture does; - exact-version minimumReleaseAgeExclude entries for the 0.2.0 train, which pnpm 11 otherwise holds back on its release day; - the platform's narrowly scoped override for GHSA-67mh-4wv8-2f99 (esbuild via drizzle-kit), which Signage inherited while it built inside Ekklesia's workspace. - engines.node `>=24.11.0 <25` and packageManager `[email protected].0`, both from Ekklesia 0.2.0. Node 24.18.0 goes in .node-version for CI, as in Ekklesia. - biome.json carries the platform's Biome configuration, which `biome lint` used to pick up from the workspace root, so lint rules are unchanged. - pnpm-lock.yaml is Signage's own: registry tarballs with integrity hashes, and no workspace or file links. - `prepack` runs this package's own build instead of the workspace root's turbo. - `pnpm validate` (scripts/validate-module.mjs) checks the built package and its migrations with the published SDK parsers only: - the manifest, its identity, and its entrypoints; - that the built runtime's id, version, and database ABI match the manifest; - that the built schema metadata is plain, namespaced, and has module-internal foreign keys; - the SDK compatibility range; - that the migration journal and policy agree. Core's own `modules:validate` and `migrations:validate` are not published. What only an Ekklesia installation can check is named in the script. Removed: ci/assemble.sh, ci/platform.env, ci/pnpm-lock.yaml, ci/update-lock.sh. The lint, typecheck, test, and build jobs check out only this repository; build also runs `pnpm validate`. The integration job stays disabled. Its first step is now an explicit placeholder rather than the deleted assembly, and its explanation says it returns when Signage is a canonical linux-x64-glibc Module Package installed into Ekklesia's generic image. No source, behaviour, schema, or version change: Signage stays 0.1.2. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
ekklesia
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
fefe34be03
commit
33bb146349
+53
-73
@@ -1,8 +1,9 @@
|
||||
name: CI
|
||||
|
||||
# Signage builds, tests, and runs only inside an Ekklesia workspace, so every job first assembles it
|
||||
# into the platform commit pinned in ci/platform.env (ci/assemble.sh) and installs that workspace
|
||||
# with --frozen-lockfile from ci/pnpm-lock.yaml.
|
||||
# Signage is a standalone repository: every job checks out only this repository, installs it with
|
||||
# --frozen-lockfile from its own pnpm-lock.yaml, and takes Ekklesia's module-development packages
|
||||
# (@ekklesia/*) from Ekklesia's public package registry (.npmrc; platform ADRs 0053 and 0054). No job
|
||||
# clones Ekklesia.
|
||||
#
|
||||
# The same trust rules as the platform's own CI (docs/development/security.md there):
|
||||
# * every action is pinned by a full commit SHA;
|
||||
@@ -11,10 +12,8 @@ name: CI
|
||||
# * there is no `pull_request_target`;
|
||||
# * the self-hosted runner executes trusted, reviewed code only.
|
||||
#
|
||||
# The server is Gitea 1.24, which ignores `permissions`, `concurrency`, and `timeout-minutes`
|
||||
# (https://docs.gitea.com/1.24/usage/actions/comparison). They are declared so the workflow is already
|
||||
# correct on a release that honours them; on 1.24 they bound nothing, and `permissions` does not
|
||||
# restrict the job token.
|
||||
# The server is Gitea 1.27, which honours `concurrency` cancellation; `permissions` and
|
||||
# `timeout-minutes` are declared so the workflow is correct wherever they are enforced.
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
@@ -42,24 +41,21 @@ jobs:
|
||||
# in .git/config for a later step to read.
|
||||
persist-credentials: false
|
||||
|
||||
- name: Assemble Signage into the pinned platform
|
||||
run: bash ci/assemble.sh
|
||||
|
||||
- name: Set up Node.js at the platform's version
|
||||
- name: Set up Node.js at the repository's version
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version-file: build/workspace/.node-version
|
||||
node-version-file: .node-version
|
||||
|
||||
- name: Install the assembled workspace (frozen lockfile)
|
||||
working-directory: build/workspace
|
||||
# pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
|
||||
# .npmrc: no token, and no Ekklesia checkout.
|
||||
- name: Install (frozen lockfile)
|
||||
run: |
|
||||
corepack enable
|
||||
corepack install
|
||||
pnpm install --frozen-lockfile
|
||||
|
||||
- name: Lint
|
||||
working-directory: build/workspace
|
||||
run: pnpm --filter @ekklesia/signage lint
|
||||
run: pnpm lint
|
||||
|
||||
- name: Check that CI cleans up every stack it starts
|
||||
run: bash ci/check-cleanup.sh
|
||||
@@ -76,28 +72,21 @@ jobs:
|
||||
# in .git/config for a later step to read.
|
||||
persist-credentials: false
|
||||
|
||||
- name: Assemble Signage into the pinned platform
|
||||
run: bash ci/assemble.sh
|
||||
|
||||
- name: Set up Node.js at the platform's version
|
||||
- name: Set up Node.js at the repository's version
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version-file: build/workspace/.node-version
|
||||
node-version-file: .node-version
|
||||
|
||||
- name: Install the assembled workspace (frozen lockfile)
|
||||
working-directory: build/workspace
|
||||
# pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
|
||||
# .npmrc: no token, and no Ekklesia checkout.
|
||||
- name: Install (frozen lockfile)
|
||||
run: |
|
||||
corepack enable
|
||||
corepack install
|
||||
pnpm install --frozen-lockfile
|
||||
|
||||
- name: Build the platform packages Signage depends on
|
||||
working-directory: build/workspace
|
||||
run: pnpm exec turbo run build --filter='@ekklesia/signage^...'
|
||||
|
||||
- name: Typecheck the server, browser, and browser-test projects
|
||||
working-directory: build/workspace
|
||||
run: pnpm --filter @ekklesia/signage typecheck
|
||||
run: pnpm typecheck
|
||||
|
||||
test:
|
||||
name: test
|
||||
@@ -111,28 +100,21 @@ jobs:
|
||||
# in .git/config for a later step to read.
|
||||
persist-credentials: false
|
||||
|
||||
- name: Assemble Signage into the pinned platform
|
||||
run: bash ci/assemble.sh
|
||||
|
||||
- name: Set up Node.js at the platform's version
|
||||
- name: Set up Node.js at the repository's version
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version-file: build/workspace/.node-version
|
||||
node-version-file: .node-version
|
||||
|
||||
- name: Install the assembled workspace (frozen lockfile)
|
||||
working-directory: build/workspace
|
||||
# pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
|
||||
# .npmrc: no token, and no Ekklesia checkout.
|
||||
- name: Install (frozen lockfile)
|
||||
run: |
|
||||
corepack enable
|
||||
corepack install
|
||||
pnpm install --frozen-lockfile
|
||||
|
||||
- name: Build the platform packages Signage depends on
|
||||
working-directory: build/workspace
|
||||
run: pnpm exec turbo run build --filter='@ekklesia/signage^...'
|
||||
|
||||
- name: Unit, browser, and display contract tests
|
||||
working-directory: build/workspace
|
||||
run: pnpm --filter @ekklesia/signage test
|
||||
run: pnpm test
|
||||
|
||||
build:
|
||||
name: build
|
||||
@@ -146,48 +128,44 @@ jobs:
|
||||
# in .git/config for a later step to read.
|
||||
persist-credentials: false
|
||||
|
||||
- name: Assemble Signage into the pinned platform
|
||||
run: bash ci/assemble.sh
|
||||
|
||||
- name: Set up Node.js at the platform's version
|
||||
- name: Set up Node.js at the repository's version
|
||||
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
||||
with:
|
||||
node-version-file: build/workspace/.node-version
|
||||
node-version-file: .node-version
|
||||
|
||||
- name: Install the assembled workspace (frozen lockfile)
|
||||
working-directory: build/workspace
|
||||
# pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
|
||||
# .npmrc: no token, and no Ekklesia checkout.
|
||||
- name: Install (frozen lockfile)
|
||||
run: |
|
||||
corepack enable
|
||||
corepack install
|
||||
pnpm install --frozen-lockfile
|
||||
|
||||
# The same gates the platform's image build runs against exactly this module set: its boundary
|
||||
# rules (which apply to modules), the manifest, and the migrations.
|
||||
- name: Platform gates (boundaries, module manifest, migrations)
|
||||
working-directory: build/workspace
|
||||
run: |
|
||||
pnpm boundaries
|
||||
pnpm modules:validate
|
||||
pnpm migrations:validate
|
||||
- name: Build the server and both browser artifacts
|
||||
run: pnpm build
|
||||
|
||||
- name: Build Signage and the platform it depends on
|
||||
working-directory: build/workspace
|
||||
run: pnpm exec turbo run build --filter='@ekklesia/signage...'
|
||||
# The built package and its migrations, read the way the platform reads them, with only the
|
||||
# published SDK parsers (scripts/validate-module.mjs says what only Ekklesia itself can check).
|
||||
- name: Validate the built module and its migrations
|
||||
run: pnpm validate
|
||||
|
||||
# Signage inside Ekklesia, end to end, in a real browser: the platform's own Dockerfile builds the
|
||||
# deployment image with Signage in it, and the platform's split-topology deployment smoke runs
|
||||
# against it, pairing a kiosk display and running the scenarios in ci/display-scenarios. A
|
||||
# disposable database and object store with generated secrets; nothing is pushed or logged in to.
|
||||
#
|
||||
# DISABLED while Signage is pinned to Ekklesia 0.2.0. From that release on, the platform's image is
|
||||
# the one generic image (platform ADR 0048): deploy/Dockerfile keeps `modules/` out of its build
|
||||
# context and refuses one that has it, and the deployment smoke installs modules only as canonical
|
||||
# Module Packages (ADR 0049). Signage is not one yet: its static sharp dependency needs the native
|
||||
# linux-x64-glibc package flow, which is deliberately not part of the 0.2.0 compatibility change.
|
||||
# Run against 0.2.0, this job would build an image without Signage and drive the module template's
|
||||
# display instead, so it is switched off rather than left reporting on something else. The job and
|
||||
# ci/integration.sh stay as they are; the job returns once Signage is built as a Module Package and
|
||||
# installed into the generic image, and `if: false` is removed in that change.
|
||||
# DISABLED. From Ekklesia 0.2.0 on, the platform's image is the one generic image (platform ADR
|
||||
# 0048): deploy/Dockerfile keeps `modules/` out of its build context and refuses one that has it,
|
||||
# and the deployment smoke installs modules only as canonical Module Packages (ADR 0049). Signage is
|
||||
# not one yet: its static sharp dependency needs the native linux-x64-glibc package flow. Run as it
|
||||
# was, this job would build an image without Signage and drive the module template's display
|
||||
# instead, so it is switched off rather than left reporting on something else.
|
||||
#
|
||||
# It returns when Signage is built as a canonical linux-x64-glibc Module Package and installed into
|
||||
# Ekklesia's generic image; that change removes `if: false` and rewrites these steps. They still
|
||||
# expect the platform tree ci/assemble.sh used to build at build/workspace, and that assembly is
|
||||
# gone now that Signage builds on its own. The platform's deployment smoke and stack sweep will
|
||||
# still come from Ekklesia, at the release Signage targets, because they are the platform's to run.
|
||||
integration:
|
||||
name: integration
|
||||
if: false
|
||||
@@ -207,8 +185,10 @@ jobs:
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Assemble Signage into the pinned platform
|
||||
run: bash ci/assemble.sh
|
||||
- name: Fetch Ekklesia's deployment smoke and build Signage's Module Package
|
||||
run: |
|
||||
echo "integration: rewritten when Signage is a canonical linux-x64-glibc Module Package." >&2
|
||||
exit 1
|
||||
|
||||
# A job the runner killed (cancelled, or past the runner's own time limit) never ran its
|
||||
# cleanup. Anything a CI job left on this shared daemon more than three hours ago goes first.
|
||||
@@ -218,8 +198,8 @@ jobs:
|
||||
- name: Build the image and run the display scenarios
|
||||
run: bash ci/integration.sh
|
||||
|
||||
# Whatever happened above, this job's own stacks do not outlive it. If assembly failed, nothing
|
||||
# was started.
|
||||
# Whatever happened above, this job's own stacks do not outlive it. If the first step failed,
|
||||
# nothing was started.
|
||||
- name: Remove this job's CI stacks
|
||||
if: always()
|
||||
run: |
|
||||
|
||||
Reference in New Issue
Block a user