feat: build Signage on its own from the published Ekklesia 0.2.0 packages
Signage no longer needs an Ekklesia checkout. A clean clone installs with `pnpm install --frozen-lockfile` and runs lint, typecheck, test, build, and validate by itself, taking Ekklesia's module-development packages from Ekklesia's public registry (ADRs 0053 and 0054). - Dependencies: every `workspace:*` becomes `^0.2.0`. @ekklesia/module-pack is added as a devDependency pinned exactly to 0.2.0, as ADR 0053 requires; it is not invoked yet. No @ekklesia/contracts dependency. drizzle-orm stays a direct dependency, satisfying the adapter's optional peer. - .npmrc points the @ekklesia scope at https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/ with no credential, because reading needs none. - pnpm-workspace.yaml holds this repository's pnpm settings only: - `allowBuilds: esbuild: true`, as the platform's standalone fixture does; - exact-version minimumReleaseAgeExclude entries for the 0.2.0 train, which pnpm 11 otherwise holds back on its release day; - the platform's narrowly scoped override for GHSA-67mh-4wv8-2f99 (esbuild via drizzle-kit), which Signage inherited while it built inside Ekklesia's workspace. - engines.node `>=24.11.0 <25` and packageManager `[email protected].0`, both from Ekklesia 0.2.0. Node 24.18.0 goes in .node-version for CI, as in Ekklesia. - biome.json carries the platform's Biome configuration, which `biome lint` used to pick up from the workspace root, so lint rules are unchanged. - pnpm-lock.yaml is Signage's own: registry tarballs with integrity hashes, and no workspace or file links. - `prepack` runs this package's own build instead of the workspace root's turbo. - `pnpm validate` (scripts/validate-module.mjs) checks the built package and its migrations with the published SDK parsers only: - the manifest, its identity, and its entrypoints; - that the built runtime's id, version, and database ABI match the manifest; - that the built schema metadata is plain, namespaced, and has module-internal foreign keys; - the SDK compatibility range; - that the migration journal and policy agree. Core's own `modules:validate` and `migrations:validate` are not published. What only an Ekklesia installation can check is named in the script. Removed: ci/assemble.sh, ci/platform.env, ci/pnpm-lock.yaml, ci/update-lock.sh. The lint, typecheck, test, and build jobs check out only this repository; build also runs `pnpm validate`. The integration job stays disabled. Its first step is now an explicit placeholder rather than the deleted assembly, and its explanation says it returns when Signage is a canonical linux-x64-glibc Module Package installed into Ekklesia's generic image. No source, behaviour, schema, or version change: Signage stays 0.1.2. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
ekklesia
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
fefe34be03
commit
33bb146349
@@ -1,72 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Assembles Signage into the Ekklesia platform it is tested against: the platform at the commit pinned
|
||||
# in ci/platform.env, this checkout at modules/signage, and ci/pnpm-lock.yaml as the workspace
|
||||
# lockfile. Signage cannot build or run outside an Ekklesia workspace, so every CI job starts here.
|
||||
#
|
||||
# bash ci/assemble.sh [--allow-missing-lock] [output directory]
|
||||
#
|
||||
# The output directory (default build/workspace) is deleted and recreated. The platform is fetched
|
||||
# by its `main` branch and the pinned commit must be on it, so CI only ever runs reviewed platform
|
||||
# code; the checkout is then by commit, so nothing after it depends on a ref the network can move.
|
||||
# Every .git directory is removed afterwards.
|
||||
#
|
||||
# --allow-missing-lock keeps the platform's own lockfile. Only ci/update-lock.sh uses it.
|
||||
set -Eeuo pipefail
|
||||
|
||||
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
allow_missing_lock=0
|
||||
if [[ "${1:-}" == "--allow-missing-lock" ]]; then
|
||||
allow_missing_lock=1
|
||||
shift
|
||||
fi
|
||||
out="${1:-$root/build/workspace}"
|
||||
|
||||
fail() {
|
||||
echo "assemble: $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
for command in git tar; do
|
||||
command -v "$command" >/dev/null || fail "$command is required."
|
||||
done
|
||||
|
||||
# Read the two pins without sourcing the file: it is data, not a script.
|
||||
pin() {
|
||||
local value
|
||||
value="$(sed -n "s/^$1=//p" "$root/ci/platform.env")"
|
||||
[[ -n "$value" ]] || fail "ci/platform.env has no $1."
|
||||
printf '%s' "$value"
|
||||
}
|
||||
repository="$(pin EKKLESIA_PLATFORM_REPOSITORY)"
|
||||
commit="$(pin EKKLESIA_PLATFORM_COMMIT)"
|
||||
[[ "$commit" =~ ^[0-9a-f]{40}$ ]] || fail "EKKLESIA_PLATFORM_COMMIT must be a full commit SHA."
|
||||
|
||||
rm -rf "$out"
|
||||
mkdir -p "$(dirname -- "$out")"
|
||||
git init --quiet "$out"
|
||||
git -C "$out" remote add origin "$repository"
|
||||
git -C "$out" fetch --quiet --no-tags origin "+refs/heads/main:refs/remotes/origin/main" ||
|
||||
fail "cannot fetch the platform's main from ${repository}."
|
||||
git -C "$out" cat-file -e "${commit}^{commit}" 2>/dev/null ||
|
||||
fail "the pinned platform commit ${commit} is not on the platform's main."
|
||||
git -C "$out" merge-base --is-ancestor "$commit" refs/remotes/origin/main ||
|
||||
fail "the pinned platform commit ${commit} is not on the platform's main."
|
||||
git -C "$out" -c advice.detachedHead=false checkout --quiet --detach "$commit"
|
||||
[[ "$(git -C "$out" rev-parse HEAD)" == "$commit" ]] || fail "the platform did not check out at ${commit}."
|
||||
rm -rf "$out/.git"
|
||||
echo "assemble: platform ${commit}"
|
||||
|
||||
[[ ! -e "$out/modules/signage" ]] || fail "the platform checkout already has modules/signage."
|
||||
mkdir -p "$out/modules/signage"
|
||||
# Exactly the files this checkout tracks, as committed or as changed in the working tree. Nothing
|
||||
# installed, built, or ignored, and not the CI scaffolding, which is not part of the module.
|
||||
git -C "$root" ls-files -z --cached --others --exclude-standard -- . ':!ci' ':!.gitea' |
|
||||
tar -C "$root" --null --files-from=- --create --file=- |
|
||||
tar -C "$out/modules/signage" --extract --file=-
|
||||
echo "assemble: signage $(git -C "$root" rev-parse HEAD 2>/dev/null || echo "(working tree)")"
|
||||
|
||||
if [[ -f "$root/ci/pnpm-lock.yaml" ]]; then
|
||||
cp "$root/ci/pnpm-lock.yaml" "$out/pnpm-lock.yaml"
|
||||
elif ((allow_missing_lock == 0)); then
|
||||
fail "ci/pnpm-lock.yaml is missing; run bash ci/update-lock.sh."
|
||||
fi
|
||||
+6
-2
@@ -5,13 +5,17 @@
|
||||
# store, generated secrets, and an explicit migration apply against that fresh database only; nothing
|
||||
# is pushed, published, or logged in to. The image is removed afterwards.
|
||||
#
|
||||
# bash ci/integration.sh (after bash ci/assemble.sh)
|
||||
# bash ci/integration.sh
|
||||
#
|
||||
# NOT RUN: the integration job is disabled (.gitea/workflows/ci.yml says why). This script still
|
||||
# expects Ekklesia's deployment tree at build/workspace, which the removed ci/assemble.sh used to
|
||||
# build; it is rewritten when Signage is installed into the generic image as a Module Package.
|
||||
set -Eeuo pipefail
|
||||
|
||||
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
workspace="$root/build/workspace"
|
||||
[[ -f "$workspace/deploy/Dockerfile" ]] || {
|
||||
echo "integration: run bash ci/assemble.sh first." >&2
|
||||
echo "integration: Ekklesia's deployment tree is not at build/workspace." >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
# The Ekklesia platform Signage's CI builds and tests against: one reviewed commit on the platform's
|
||||
# `main`, never a moving ref. ci/assemble.sh refuses a commit that is not on `main`.
|
||||
#
|
||||
# Move it deliberately: change the commit, run `bash ci/update-lock.sh`, and commit both.
|
||||
EKKLESIA_PLATFORM_REPOSITORY=https://git.riverofglorymn.org/River_of_Glory_Church/Ekklesia.git
|
||||
EKKLESIA_PLATFORM_COMMIT=1788d17f0ab618ebc41550728da865d14cdd7a75
|
||||
Generated
-4503
File diff suppressed because it is too large
Load Diff
@@ -1,21 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
# Regenerates ci/pnpm-lock.yaml: the lockfile of Signage assembled into the pinned platform. Run it
|
||||
# after changing Signage's dependencies or ci/platform.env, and commit the result. CI installs with
|
||||
# --frozen-lockfile, so a stale lockfile fails there rather than resolving anything new.
|
||||
#
|
||||
# bash ci/update-lock.sh
|
||||
#
|
||||
# Uses the platform's own pinned pnpm (its packageManager field) through Corepack.
|
||||
set -Eeuo pipefail
|
||||
|
||||
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
work="$(mktemp -d)"
|
||||
trap 'rm -rf "$work"' EXIT
|
||||
|
||||
bash "$root/ci/assemble.sh" --allow-missing-lock "$work/workspace"
|
||||
cd "$work/workspace"
|
||||
corepack enable >/dev/null 2>&1 || true
|
||||
corepack install >/dev/null
|
||||
pnpm install --lockfile-only
|
||||
cp pnpm-lock.yaml "$root/ci/pnpm-lock.yaml"
|
||||
echo "update-lock: wrote ci/pnpm-lock.yaml"
|
||||
Reference in New Issue
Block a user