geointel/.gitea/workflows/release-gates.yml

name: GeoIntel release gates

on:
  pull_request:
  push:
    branches: [main, develop]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: geointel-release-${{ gitea.ref }}
  # A cancelled HTTP caller does not terminate the allowlisted controller
  # process that already owns the production lock. Queue a newer revision
  # instead of orphaning an in-flight backup or deploy.
  cancel-in-progress: false

jobs:
  quality:
    name: Compile, test, contracts and builds
    # Public fork code must never execute automatically on the private runner.
    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Secret scan
        run: >-
          docker run --rm
          --volume "$PWD:/repo:ro"
          trufflesecurity/trufflehog:3.79.0@sha256:7104dbb84d1ad2f5f6fa1134e92c6aa6f701f0a4ac2efd5a4c5c96225d899fe3
          filesystem /repo --only-verified --no-update
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: backend/requirements-ci.lock
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Install locked backend dependencies
        run: |
          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
          python -m pip install --disable-pip-version-check --no-deps -e backend
      - name: Install locked frontend dependencies
        working-directory: frontend
        run: npm ci
      - name: Verify dependency lock policy
        run: python scripts/verify_python_lock.py
      - name: Run complete release readiness gate
        env:
          PYTHON_BIN: python
        run: bash scripts/run_readiness_check.sh
      - name: Render migration and Compose evidence
        run: |
          mkdir -p artifacts
          cd backend
          python -m alembic upgrade head --sql > ../artifacts/alembic-upgrade.sql
          cd ..
          docker compose config > artifacts/docker-compose.resolved.yml
      - name: Publish quality evidence
        if: always()
        # Gitea Actions currently exposes the GHES-compatible artifact API;
        # upload-artifact v4 deliberately refuses that API.
        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
        with:
          name: quality-evidence
          path: |
            artifacts/alembic-upgrade.sql
            artifacts/docker-compose.resolved.yml
          if-no-files-found: warn
          retention-days: 30

  dependency-audit:
    name: Python and npm vulnerability policy
    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: backend/requirements-ci.lock
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - name: Audit locked Python dependencies
        run: |
          mkdir -p artifacts
          python -m pip install --disable-pip-version-check pip-audit==2.10.1
          bash scripts/audit_python_dependencies.sh
      - name: Audit locked frontend dependencies
        working-directory: frontend
        run: |
          npm ci
          npm audit --audit-level=high --json > ../artifacts/npm-audit.json
      - name: Publish dependency evidence
        if: always()
        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
        with:
          name: dependency-audits
          path: |
            artifacts/pip-audit-full.json
            artifacts/pip-audit-policy.json
            artifacts/npm-audit.json
          if-no-files-found: warn
          retention-days: 30

  container:
    name: Production AI image, SBOM and container scan
    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Build production AI release image
        env:
          RELEASE_SHA: ${{ gitea.sha }}
        run: |
          mkdir -p artifacts
          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          APP_VERSION="$(tr -d '[:space:]' < VERSION)"
          docker build \
            -f deploy/unraid/Dockerfile.all-in-one \
            --build-arg GEOINTEL_INSTALL_AI=true \
            --build-arg GEOINTEL_BUILD_SHA="$RELEASE_SHA" \
            --build-arg GEOINTEL_BUILD_TIME="$BUILD_TIME" \
            --build-arg GEOINTEL_APP_VERSION="$APP_VERSION" \
            -t "geointel-ci:$RELEASE_SHA-ai" \
            .
          IMAGE_ID="$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")"
          printf '%s\n' "$IMAGE_ID" > artifacts/image-id.txt
          docker image inspect "$IMAGE_ID" > artifacts/image-inspect.json
      - name: Generate SPDX SBOM
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar
          GEOINTEL_KEEP_IMAGE_ARCHIVE: "true"
          SYFT_PARALLELISM: "1"
        run: |
          IMAGE_ID="$(cat artifacts/image-id.txt)"
          test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
          bash scripts/generate_container_sbom.sh "$IMAGE_ID"
      - name: Enforce container vulnerability policy
        env:
          RELEASE_SHA: ${{ gitea.sha }}
          GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar
          GEOINTEL_KEEP_IMAGE_ARCHIVE: "true"
        run: |
          IMAGE_ID="$(cat artifacts/image-id.txt)"
          test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
          bash scripts/scan_container_image.sh "$IMAGE_ID"
          test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
      - name: Remove temporary image archive
        if: always()
        run: >-
          rm -f -- artifacts/geointel-image.tar
          artifacts/geointel-image.tar.image-id
          artifacts/geointel-image.tar.partial.*
      - name: Publish container evidence
        if: always()
        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
        with:
          name: container-evidence
          path: |
            artifacts/image-inspect.json
            artifacts/image-id.txt
            artifacts/geointel-sbom.spdx.json
            artifacts/geointel-container-vulnerabilities.json
          if-no-files-found: warn
          retention-days: 30

  deploy:
    name: Deploy exact gated revision to Unraid
    needs: [quality, dependency-audit, container]
    if: ${{ gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' }}
    runs-on: unraid-deploy
    # The first byte-complete storage snapshot can exceed 100 GiB. Keep the
    # gated caller attached for the full conservative backup/build window;
    # the controller and deploy script still serialize every mutation.
    timeout-minutes: 720
    steps:
      - name: Deploy only after every release gate is green
        run: |
          set -euo pipefail
          docker exec gitea-deploy-control \
            /opt/gitea-deploy/deploy.py deploy \
            "${{ gitea.repository }}" "${{ gitea.sha }}"