feat: build Signage on its own from the published Ekklesia 0.2.0 packages

Signage no longer needs an Ekklesia checkout. A clean clone installs with `pnpm install --frozen-lockfile` and runs lint, typecheck, test, build, and validate by itself, taking Ekklesia's module-development packages from Ekklesia's public registry (ADRs 0053 and 0054). - Dependencies: every `workspace:*` becomes `^0.2.0`. @ekklesia/module-pack is added as a devDependency pinned exactly to 0.2.0, as ADR 0053 requires; it is not invoked yet. No @ekklesia/contracts dependency. drizzle-orm stays a direct dependency, satisfying the adapter's optional peer. - .npmrc points the @ekklesia scope at https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/ with no credential, because reading needs none. - pnpm-workspace.yaml holds this repository's pnpm settings only: - `allowBuilds: esbuild: true`, as the platform's standalone fixture does; - exact-version minimumReleaseAgeExclude entries for the 0.2.0 train, which pnpm 11 otherwise holds back on its release day; - the platform's narrowly scoped override for GHSA-67mh-4wv8-2f99 (esbuild via drizzle-kit), which Signage inherited while it built inside Ekklesia's workspace. - engines.node `>=24.11.0 <25` and packageManager `[email protected].0`, both from Ekklesia 0.2.0. Node 24.18.0 goes in .node-version for CI, as in Ekklesia. - biome.json carries the platform's Biome configuration, which `biome lint` used to pick up from the workspace root, so lint rules are unchanged. - pnpm-lock.yaml is Signage's own: registry tarballs with integrity hashes, and no workspace or file links. - `prepack` runs this package's own build instead of the workspace root's turbo. - `pnpm validate` (scripts/validate-module.mjs) checks the built package and its migrations with the published SDK parsers only: - the manifest, its identity, and its entrypoints; - that the built runtime's id, version, and database ABI match the manifest; - that the built schema metadata is plain, namespaced, and has module-internal foreign keys; - the SDK compatibility range; - that the migration journal and policy agree. Core's own `modules:validate` and `migrations:validate` are not published. What only an Ekklesia installation can check is named in the script. Removed: ci/assemble.sh, ci/platform.env, ci/pnpm-lock.yaml, ci/update-lock.sh. The lint, typecheck, test, and build jobs check out only this repository; build also runs `pnpm validate`. The integration job stays disabled. Its first step is now an explicit placeholder rather than the deleted assembly, and its explanation says it returns when Signage is a canonical linux-x64-glibc Module Package installed into Ekklesia's generic image. No source, behaviour, schema, or version change: Signage stays 0.1.2. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-08 20:49:17 -05:00
parent fefe34be03
commit 33bb146349
16 changed files with 2888 additions and 4731 deletions
@@ -1,8 +1,9 @@
 name: CI

-# Signage builds, tests, and runs only inside an Ekklesia workspace, so every job first assembles it
-# into the platform commit pinned in ci/platform.env (ci/assemble.sh) and installs that workspace
-# with --frozen-lockfile from ci/pnpm-lock.yaml.
+# Signage is a standalone repository: every job checks out only this repository, installs it with
+# --frozen-lockfile from its own pnpm-lock.yaml, and takes Ekklesia's module-development packages
+# (@ekklesia/*) from Ekklesia's public package registry (.npmrc; platform ADRs 0053 and 0054). No job
+# clones Ekklesia.
 #
 # The same trust rules as the platform's own CI (docs/development/security.md there):
 #   * every action is pinned by a full commit SHA;
@@ -11,10 +12,8 @@ name: CI
 #   * there is no `pull_request_target`;
 #   * the self-hosted runner executes trusted, reviewed code only.
 #
-# The server is Gitea 1.24, which ignores `permissions`, `concurrency`, and `timeout-minutes`
-# (https://docs.gitea.com/1.24/usage/actions/comparison). They are declared so the workflow is already
-# correct on a release that honours them; on 1.24 they bound nothing, and `permissions` does not
-# restrict the job token.
+# The server is Gitea 1.27, which honours `concurrency` cancellation; `permissions` and
+# `timeout-minutes` are declared so the workflow is correct wherever they are enforced.

 on:
  pull_request:
@@ -42,24 +41,21 @@ jobs:
          # in .git/config for a later step to read.
          persist-credentials: false

-      - name: Assemble Signage into the pinned platform
-        run: bash ci/assemble.sh
-
-      - name: Set up Node.js at the platform's version
+      - name: Set up Node.js at the repository's version
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: build/workspace/.node-version
+          node-version-file: .node-version

-      - name: Install the assembled workspace (frozen lockfile)
-        working-directory: build/workspace
+      # pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
+      # .npmrc: no token, and no Ekklesia checkout.
+      - name: Install (frozen lockfile)
        run: |
          corepack enable
          corepack install
          pnpm install --frozen-lockfile

      - name: Lint
-        working-directory: build/workspace
-        run: pnpm --filter @ekklesia/signage lint
+        run: pnpm lint

      - name: Check that CI cleans up every stack it starts
        run: bash ci/check-cleanup.sh
@@ -76,28 +72,21 @@ jobs:
          # in .git/config for a later step to read.
          persist-credentials: false

-      - name: Assemble Signage into the pinned platform
-        run: bash ci/assemble.sh
-
-      - name: Set up Node.js at the platform's version
+      - name: Set up Node.js at the repository's version
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: build/workspace/.node-version
+          node-version-file: .node-version

-      - name: Install the assembled workspace (frozen lockfile)
-        working-directory: build/workspace
+      # pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
+      # .npmrc: no token, and no Ekklesia checkout.
+      - name: Install (frozen lockfile)
        run: |
          corepack enable
          corepack install
          pnpm install --frozen-lockfile

-      - name: Build the platform packages Signage depends on
-        working-directory: build/workspace
-        run: pnpm exec turbo run build --filter='@ekklesia/signage^...'
-
      - name: Typecheck the server, browser, and browser-test projects
-        working-directory: build/workspace
-        run: pnpm --filter @ekklesia/signage typecheck
+        run: pnpm typecheck

  test:
    name: test
@@ -111,28 +100,21 @@ jobs:
          # in .git/config for a later step to read.
          persist-credentials: false

-      - name: Assemble Signage into the pinned platform
-        run: bash ci/assemble.sh
-
-      - name: Set up Node.js at the platform's version
+      - name: Set up Node.js at the repository's version
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: build/workspace/.node-version
+          node-version-file: .node-version

-      - name: Install the assembled workspace (frozen lockfile)
-        working-directory: build/workspace
+      # pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
+      # .npmrc: no token, and no Ekklesia checkout.
+      - name: Install (frozen lockfile)
        run: |
          corepack enable
          corepack install
          pnpm install --frozen-lockfile

-      - name: Build the platform packages Signage depends on
-        working-directory: build/workspace
-        run: pnpm exec turbo run build --filter='@ekklesia/signage^...'
-
      - name: Unit, browser, and display contract tests
-        working-directory: build/workspace
-        run: pnpm --filter @ekklesia/signage test
+        run: pnpm test

  build:
    name: build
@@ -146,48 +128,44 @@ jobs:
          # in .git/config for a later step to read.
          persist-credentials: false

-      - name: Assemble Signage into the pinned platform
-        run: bash ci/assemble.sh
-
-      - name: Set up Node.js at the platform's version
+      - name: Set up Node.js at the repository's version
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
-          node-version-file: build/workspace/.node-version
+          node-version-file: .node-version

-      - name: Install the assembled workspace (frozen lockfile)
-        working-directory: build/workspace
+      # pnpm at exactly the `packageManager` version, and @ekklesia/* from the public registry named in
+      # .npmrc: no token, and no Ekklesia checkout.
+      - name: Install (frozen lockfile)
        run: |
          corepack enable
          corepack install
          pnpm install --frozen-lockfile

-      # The same gates the platform's image build runs against exactly this module set: its boundary
-      # rules (which apply to modules), the manifest, and the migrations.
-      - name: Platform gates (boundaries, module manifest, migrations)
-        working-directory: build/workspace
-        run: |
-          pnpm boundaries
-          pnpm modules:validate
-          pnpm migrations:validate
+      - name: Build the server and both browser artifacts
+        run: pnpm build

-      - name: Build Signage and the platform it depends on
-        working-directory: build/workspace
-        run: pnpm exec turbo run build --filter='@ekklesia/signage...'
+      # The built package and its migrations, read the way the platform reads them, with only the
+      # published SDK parsers (scripts/validate-module.mjs says what only Ekklesia itself can check).
+      - name: Validate the built module and its migrations
+        run: pnpm validate

  # Signage inside Ekklesia, end to end, in a real browser: the platform's own Dockerfile builds the
  # deployment image with Signage in it, and the platform's split-topology deployment smoke runs
  # against it, pairing a kiosk display and running the scenarios in ci/display-scenarios. A
  # disposable database and object store with generated secrets; nothing is pushed or logged in to.
  #
-  # DISABLED while Signage is pinned to Ekklesia 0.2.0. From that release on, the platform's image is
-  # the one generic image (platform ADR 0048): deploy/Dockerfile keeps `modules/` out of its build
-  # context and refuses one that has it, and the deployment smoke installs modules only as canonical
-  # Module Packages (ADR 0049). Signage is not one yet: its static sharp dependency needs the native
-  # linux-x64-glibc package flow, which is deliberately not part of the 0.2.0 compatibility change.
-  # Run against 0.2.0, this job would build an image without Signage and drive the module template's
-  # display instead, so it is switched off rather than left reporting on something else. The job and
-  # ci/integration.sh stay as they are; the job returns once Signage is built as a Module Package and
-  # installed into the generic image, and `if: false` is removed in that change.
+  # DISABLED. From Ekklesia 0.2.0 on, the platform's image is the one generic image (platform ADR
+  # 0048): deploy/Dockerfile keeps `modules/` out of its build context and refuses one that has it,
+  # and the deployment smoke installs modules only as canonical Module Packages (ADR 0049). Signage is
+  # not one yet: its static sharp dependency needs the native linux-x64-glibc package flow. Run as it
+  # was, this job would build an image without Signage and drive the module template's display
+  # instead, so it is switched off rather than left reporting on something else.
+  #
+  # It returns when Signage is built as a canonical linux-x64-glibc Module Package and installed into
+  # Ekklesia's generic image; that change removes `if: false` and rewrites these steps. They still
+  # expect the platform tree ci/assemble.sh used to build at build/workspace, and that assembly is
+  # gone now that Signage builds on its own. The platform's deployment smoke and stack sweep will
+  # still come from Ekklesia, at the release Signage targets, because they are the platform's to run.
  integration:
    name: integration
    if: false
@@ -207,8 +185,10 @@ jobs:
        with:
          persist-credentials: false

-      - name: Assemble Signage into the pinned platform
-        run: bash ci/assemble.sh
+      - name: Fetch Ekklesia's deployment smoke and build Signage's Module Package
+        run: |
+          echo "integration: rewritten when Signage is a canonical linux-x64-glibc Module Package." >&2
+          exit 1

      # A job the runner killed (cancelled, or past the runner's own time limit) never ran its
      # cleanup. Anything a CI job left on this shared daemon more than three hours ago goes first.
@@ -218,8 +198,8 @@ jobs:
      - name: Build the image and run the display scenarios
        run: bash ci/integration.sh

-      # Whatever happened above, this job's own stacks do not outlive it. If assembly failed, nothing
-      # was started.
+      # Whatever happened above, this job's own stacks do not outlive it. If the first step failed,
+      # nothing was started.
      - name: Remove this job's CI stacks
        if: always()
        run: |