ci: restore external package integration

.gitea/workflows/ci.yml

@@ -1,9 +1,10 @@
 name: CI
 
-# Signage is a standalone repository: every job checks out only this repository, installs it with
-# --frozen-lockfile from its own pnpm-lock.yaml, and takes Ekklesia's module-development packages
-# (@ekklesia/*) from Ekklesia's public package registry (.npmrc; platform ADRs 0053 and 0054). No job
-# clones Ekklesia.
+# Signage is a standalone repository: every job installs it with --frozen-lockfile from its own
+# pnpm-lock.yaml and takes Ekklesia's module-development packages (@ekklesia/*) from Ekklesia's
+# public package registry (.npmrc; platform ADRs 0053 and 0054). Only the integration job fetches
+# Core source: one immutable commit through the pinned Gitea pull ref in ci/platform.env, used as the
+# generic deployment harness and image source, never as a workspace dependency.
 #
 # The same trust rules as the platform's own CI (docs/development/security.md there):
 #   * every action is pinned by a full commit SHA;
@@ -149,26 +150,13 @@ jobs:
       - name: Validate the built module and its migrations
         run: pnpm validate
 
-  # Signage inside Ekklesia, end to end, in a real browser: the platform's own Dockerfile builds the
-  # deployment image with Signage in it, and the platform's split-topology deployment smoke runs
-  # against it, pairing a kiosk display and running the scenarios in ci/display-scenarios. A
-  # disposable database and object store with generated secrets; nothing is pushed or logged in to.
-  #
-  # DISABLED. From Ekklesia 0.2.0 on, the platform's image is the one generic image (platform ADR
-  # 0048): deploy/Dockerfile keeps `modules/` out of its build context and refuses one that has it,
-  # and the deployment smoke installs modules only as canonical Module Packages (ADR 0049). Signage is
-  # not one yet: its static sharp dependency needs the native linux-x64-glibc package flow. Run as it
-  # was, this job would build an image without Signage and drive the module template's display
-  # instead, so it is switched off rather than left reporting on something else.
-  #
-  # It returns when Signage is built as a canonical linux-x64-glibc Module Package and installed into
-  # Ekklesia's generic image; that change removes `if: false` and rewrites these steps. They still
-  # expect the platform tree ci/assemble.sh used to build at build/workspace, and that assembly is
-  # gone now that Signage builds on its own. The platform's deployment smoke and stack sweep will
-  # still come from Ekklesia, at the release Signage targets, because they are the platform's to run.
+  # The real linux-x64-glibc Signage Module Package inside Ekklesia, end to end. The pinned platform
+  # builds one generic image with no bundled module source, verifies and installs Signage into
+  # persistent module storage, applies its migrations, and drives its split-origin Dashboard and
+  # kiosk display in real browsers. It then checks process restart, container recreation, lifecycle
+  # disable/re-enable, removal, and reinstall against the same database and package.
   integration:
     name: integration
-    if: false
     needs:
       - test
       - build
@@ -185,17 +173,26 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Fetch Ekklesia's deployment smoke and build Signage's Module Package
+      - name: Set up Node.js at the repository's version
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: .node-version
+
+      - name: Install (frozen lockfile)
         run: |
-          echo "integration: rewritten when Signage is a canonical linux-x64-glibc Module Package." >&2
-          exit 1
+          corepack enable
+          corepack install
+          pnpm install --frozen-lockfile
+
+      - name: Fetch the pinned Ekklesia integration harness
+        run: bash ci/fetch-platform.sh
 
       # A job the runner killed (cancelled, or past the runner's own time limit) never ran its
       # cleanup. Anything a CI job left on this shared daemon more than three hours ago goes first.
       - name: Sweep stale CI stacks from the runner
-        run: bash build/workspace/scripts/ci-sweep.sh --stale
+        run: bash build/platform/scripts/ci-sweep.sh --stale
 
-      - name: Build the image and run the display scenarios
+      - name: Build, install, and run the external Signage package
         run: bash ci/integration.sh
 
       # Whatever happened above, this job's own stacks do not outlive it. If the first step failed,
@@ -203,6 +200,6 @@ jobs:
       - name: Remove this job's CI stacks
         if: always()
         run: |
-          if [ -f build/workspace/scripts/ci-sweep.sh ]; then
-            bash build/workspace/scripts/ci-sweep.sh --job
+          if [ -f build/platform/scripts/ci-sweep.sh ]; then
+            bash build/platform/scripts/ci-sweep.sh --job
           fi