Jens/geointel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(release): make deployment backup and rollback immutable

Browse Source
This commit is contained in:
Jens
2026-08-30 06:00:43 +02:00
parent a0884d64c9
commit c272220277
47 changed files with 3035 additions and 430 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/release-gates.yml
+46 -19
View File
@@ -1,6 +1,7 @@
name: GeoIntel release gates
on:
pull_request:
push:
branches: [main, develop]
workflow_dispatch:
@@ -16,21 +17,21 @@ jobs:
quality:
name: Compile, test, contracts and builds
runs-on: ubuntu-latest
timeout-minutes: 45
timeout-minutes: 60
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Secret scan
run: >-
docker run --rm
--volume "$PWD:/repo:ro"
trufflesecurity/trufflehog:3.79.0@sha256:7104dbb84d1ad2f5f6fa1134e92c6aa6f701f0a4ac2efd5a4c5c96225d899fe3
filesystem /repo --only-verified --no-update
- uses: actions/setup-python@v5
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.11"
cache: pip
cache-dependency-path: backend/requirements-ci.lock
- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: "20"
cache: npm
@@ -57,7 +58,7 @@ jobs:
docker compose config > artifacts/docker-compose.resolved.yml
- name: Publish quality evidence
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: quality-evidence
path: |
@@ -71,13 +72,13 @@ jobs:
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: "3.11"
cache: pip
cache-dependency-path: backend/requirements-ci.lock
- uses: actions/setup-node@v4
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: "20"
cache: npm
@@ -94,7 +95,7 @@ jobs:
npm audit --audit-level=high --json > ../artifacts/npm-audit.json
- name: Publish dependency evidence
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: dependency-audits
path: |
@@ -105,41 +106,67 @@ jobs:
retention-days: 30
container:
name: GIS image, SBOM and container scan
name: Production AI image, SBOM and container scan
runs-on: ubuntu-latest
timeout-minutes: 60
timeout-minutes: 120
steps:
- uses: actions/checkout@v4
- name: Build non-AI release image
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Build production AI release image
env:
RELEASE_SHA: ${{ gitea.sha }}
run: |
mkdir -p artifacts
BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
APP_VERSION="$(tr -d '[:space:]' < VERSION)"
docker build \
-f deploy/unraid/Dockerfile.all-in-one \
--build-arg GEOINTEL_INSTALL_AI=false \
--build-arg GEOINTEL_INSTALL_AI=true \
--build-arg GEOINTEL_BUILD_SHA="$RELEASE_SHA" \
--build-arg GEOINTEL_BUILD_TIME="$BUILD_TIME" \
-t "geointel-ci:$RELEASE_SHA-gis" \
--build-arg GEOINTEL_APP_VERSION="$APP_VERSION" \
-t "geointel-ci:$RELEASE_SHA-ai" \
.
docker image inspect "geointel-ci:$RELEASE_SHA-gis" > artifacts/image-inspect.json
IMAGE_ID="$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")"
printf '%s\n' "$IMAGE_ID" > artifacts/image-id.txt
docker image inspect "$IMAGE_ID" > artifacts/image-inspect.json
- name: Generate SPDX SBOM
env:
RELEASE_SHA: ${{ gitea.sha }}
run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-gis"
run: |
IMAGE_ID="$(cat artifacts/image-id.txt)"
test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
bash scripts/generate_container_sbom.sh "$IMAGE_ID"
- name: Enforce container vulnerability policy
env:
RELEASE_SHA: ${{ gitea.sha }}
run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-gis"
run: |
IMAGE_ID="$(cat artifacts/image-id.txt)"
test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
bash scripts/scan_container_image.sh "$IMAGE_ID"
test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
- name: Publish container evidence
if: always()
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: container-evidence
path: |
artifacts/image-inspect.json
artifacts/image-id.txt
artifacts/geointel-sbom.spdx.json
artifacts/geointel-container-vulnerabilities.json
if-no-files-found: warn
retention-days: 30
deploy:
name: Deploy exact gated revision to Unraid
needs: [quality, dependency-audit, container]
if: ${{ gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' }}
runs-on: unraid-deploy
timeout-minutes: 180
steps:
- name: Deploy only after every release gate is green
run: |
set -euo pipefail
docker exec gitea-deploy-control \
/opt/gitea-deploy/deploy.py deploy \
"${{ gitea.repository }}" "${{ gitea.sha }}"