ekklesiaandClaude Opus 5.5
cbf2a8ee39
The platform's rule (its ci-sweep.sh, docs/development/security.md), applied to the one Signage job that starts Docker stacks: - it has its own EKKLESIA_CI_JOB_KEY; - it sweeps stale CI stacks from the runner before it starts; - it removes its own stacks in a final `if: always()` step, which tolerates a failed assembly, since nothing was started then; - the image ci/integration.sh builds is named and labeled as a CI stack of this run and job, with the time CI built it, so the sweep finds it. ci/platform.env moves to the platform commit that adds the sweep (Ekklesia #60). The assembled lockfile is unchanged, and still passes a frozen install. Verified: SIGKILL of the integration script's whole process group mid-run left 11 resources (2 containers, 4 networks, 4 volumes and the image). `ci-sweep.sh --job` removed exactly those 11. A normal run passes, and the job sweep after it finds nothing. Co-Authored-By: Claude Opus 5.5 <[email protected]>
45 lines
2.0 KiB
Bash
Executable File
45 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Signage inside Ekklesia, end to end: builds the deployment image from the assembled workspace with
|
|
# the platform's own Dockerfile, then runs the platform's split-topology deployment smoke against it
|
|
# with the display-device scenarios listed in ci/display-scenarios. A disposable PostgreSQL and object
|
|
# store, generated secrets, and an explicit migration apply against that fresh database only; nothing
|
|
# is pushed, published, or logged in to. The image is removed afterwards.
|
|
#
|
|
# bash ci/integration.sh (after bash ci/assemble.sh)
|
|
set -Eeuo pipefail
|
|
|
|
root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
workspace="$root/build/workspace"
|
|
[[ -f "$workspace/deploy/Dockerfile" ]] || {
|
|
echo "integration: run bash ci/assemble.sh first." >&2
|
|
exit 1
|
|
}
|
|
|
|
# Named and labeled as a CI stack of this run and job (the platform's scripts/lib/ci-project.sh), so
|
|
# the workflow's final `ci-sweep.sh --job` removes it even if this script is killed before its trap.
|
|
# shellcheck source=/dev/null
|
|
source "$workspace/scripts/lib/ci-project.sh"
|
|
project="$(ci_project_name signage-image)"
|
|
image="${project}:latest"
|
|
trap 'docker image rm --force "$image" >/dev/null 2>&1 || true' EXIT
|
|
|
|
scenarios="$(sed -e 's/#.*//' -e '/^[[:space:]]*$/d' "$root/ci/display-scenarios" | tr '\n' ' ')"
|
|
[[ -n "${scenarios// /}" ]] || {
|
|
echo "integration: ci/display-scenarios lists no scenario." >&2
|
|
exit 1
|
|
}
|
|
|
|
DOCKER_BUILDKIT=1 docker build --quiet --file "$workspace/deploy/Dockerfile" --tag "$image" \
|
|
--label "${EKKLESIA_CI_LABEL}=${project}" --label "${EKKLESIA_CI_CREATED_LABEL}=$(date +%s)" \
|
|
"$workspace" >/dev/null
|
|
echo "integration: built the deployment image with Signage; scenarios: ${scenarios}"
|
|
|
|
cd "$workspace"
|
|
EKKLESIA_SMOKE_TOPOLOGY=split \
|
|
EKKLESIA_SMOKE_IMAGE="$image" \
|
|
EKKLESIA_SMOKE_DISPLAY_DEVICE=1 \
|
|
EKKLESIA_SMOKE_DISPLAY_SCENARIOS="$scenarios" \
|
|
EKKLESIA_SMOKE_WATCH_MS=120000 \
|
|
EKKLESIA_SMOKE_RECYCLE_WATCH_MS=120000 \
|
|
bash scripts/smoke-deploy.sh
|