Initial public release

.gitea/workflows/managed-validation.yml

@@ -0,0 +1,87 @@
+name: Managed validation
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: Allowlisted validation profile
+        required: true
+        default: full
+        type: choice
+        options: [test, lint, typecheck, build, security, full]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  full:
+    # Gitea Actions does not consistently evaluate the GitHub-style `||`
+    # expression for pull-request runs without workflow inputs.
+    name: Managed repository validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: backend/requirements-ci.lock
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Validate the requested profile against the real projects
+        shell: bash
+        env:
+          REQUESTED_PROFILE: ${{ inputs.profile }}
+        run: |
+          set -euo pipefail
+          profile="${REQUESTED_PROFILE:-full}"
+          case "${profile}" in
+            test|lint|typecheck|build|security|full) ;;
+            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
+          esac
+
+          git diff --check
+          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
+            echo "Unresolved merge markers detected" >&2
+            exit 1
+          fi
+          python scripts/verify_repository_layout.py
+
+          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
+          python -m pip install --disable-pip-version-check --no-deps -e backend
+          (cd frontend && npm ci)
+
+          case "${profile}" in
+            test)
+              (cd backend && python -m pytest -W error::DeprecationWarning)
+              (cd frontend && npm run test:unit)
+              ;;
+            lint)
+              python -m ruff check backend scripts tests
+              (cd frontend && npm run lint --if-present)
+              ;;
+            typecheck)
+              (cd frontend && npm run typecheck)
+              ;;
+            build)
+              python -m compileall backend/app
+              (cd frontend && npm run build)
+              ;;
+            security)
+              python -m pip install --disable-pip-version-check pip-audit==2.10.1
+              bash scripts/audit_python_dependencies.sh
+              (cd frontend && npm audit --audit-level=high)
+              ;;
+            full)
+              PYTHON_BIN=python bash scripts/run_readiness_check.sh
+              ;;
+          esac

.gitea/workflows/release-gates.yml

@@ -0,0 +1,191 @@
+name: GeoIntel release gates
+
+on:
+  pull_request:
+  push:
+    branches: [main, develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: geointel-release-${{ gitea.ref }}
+  # A cancelled HTTP caller does not terminate the allowlisted controller
+  # process that already owns the production lock. Queue a newer revision
+  # instead of orphaning an in-flight backup or deploy.
+  cancel-in-progress: false
+
+jobs:
+  quality:
+    name: Compile, test, contracts and builds
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Secret scan
+        run: >-
+          docker run --rm
+          --volume "$PWD:/repo:ro"
+          trufflesecurity/trufflehog:3.79.0@sha256:7104dbb84d1ad2f5f6fa1134e92c6aa6f701f0a4ac2efd5a4c5c96225d899fe3
+          filesystem /repo --only-verified --no-update
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: backend/requirements-ci.lock
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install locked backend dependencies
+        run: |
+          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
+          python -m pip install --disable-pip-version-check --no-deps -e backend
+      - name: Install locked frontend dependencies
+        working-directory: frontend
+        run: npm ci
+      - name: Verify dependency lock policy
+        run: python scripts/verify_python_lock.py
+      - name: Run complete release readiness gate
+        env:
+          PYTHON_BIN: python
+        run: bash scripts/run_readiness_check.sh
+      - name: Render migration and Compose evidence
+        run: |
+          mkdir -p artifacts
+          cd backend
+          python -m alembic upgrade head --sql > ../artifacts/alembic-upgrade.sql
+          cd ..
+          docker compose config > artifacts/docker-compose.resolved.yml
+      - name: Publish quality evidence
+        if: always()
+        # Gitea Actions currently exposes the GHES-compatible artifact API;
+        # upload-artifact v4 deliberately refuses that API.
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
+        with:
+          name: quality-evidence
+          path: |
+            artifacts/alembic-upgrade.sql
+            artifacts/docker-compose.resolved.yml
+          if-no-files-found: warn
+          retention-days: 30
+
+  dependency-audit:
+    name: Python and npm vulnerability policy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: backend/requirements-ci.lock
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Audit locked Python dependencies
+        run: |
+          mkdir -p artifacts
+          python -m pip install --disable-pip-version-check pip-audit==2.10.1
+          bash scripts/audit_python_dependencies.sh
+      - name: Audit locked frontend dependencies
+        working-directory: frontend
+        run: |
+          npm ci
+          npm audit --audit-level=high --json > ../artifacts/npm-audit.json
+      - name: Publish dependency evidence
+        if: always()
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
+        with:
+          name: dependency-audits
+          path: |
+            artifacts/pip-audit-full.json
+            artifacts/pip-audit-policy.json
+            artifacts/npm-audit.json
+          if-no-files-found: warn
+          retention-days: 30
+
+  container:
+    name: Production AI image, SBOM and container scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Build production AI release image
+        env:
+          RELEASE_SHA: ${{ gitea.sha }}
+        run: |
+          mkdir -p artifacts
+          BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+          APP_VERSION="$(tr -d '[:space:]' < VERSION)"
+          docker build \
+            -f deploy/unraid/Dockerfile.all-in-one \
+            --build-arg GEOINTEL_INSTALL_AI=true \
+            --build-arg GEOINTEL_BUILD_SHA="$RELEASE_SHA" \
+            --build-arg GEOINTEL_BUILD_TIME="$BUILD_TIME" \
+            --build-arg GEOINTEL_APP_VERSION="$APP_VERSION" \
+            -t "geointel-ci:$RELEASE_SHA-ai" \
+            .
+          IMAGE_ID="$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")"
+          printf '%s\n' "$IMAGE_ID" > artifacts/image-id.txt
+          docker image inspect "$IMAGE_ID" > artifacts/image-inspect.json
+      - name: Generate SPDX SBOM
+        env:
+          RELEASE_SHA: ${{ gitea.sha }}
+          GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar
+          GEOINTEL_KEEP_IMAGE_ARCHIVE: "true"
+          SYFT_PARALLELISM: "1"
+        run: |
+          IMAGE_ID="$(cat artifacts/image-id.txt)"
+          test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
+          bash scripts/generate_container_sbom.sh "$IMAGE_ID"
+      - name: Enforce container vulnerability policy
+        env:
+          RELEASE_SHA: ${{ gitea.sha }}
+          GEOINTEL_IMAGE_ARCHIVE: artifacts/geointel-image.tar
+          GEOINTEL_KEEP_IMAGE_ARCHIVE: "true"
+        run: |
+          IMAGE_ID="$(cat artifacts/image-id.txt)"
+          test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
+          bash scripts/scan_container_image.sh "$IMAGE_ID"
+          test "$(docker image inspect --format '{{.Id}}' "geointel-ci:$RELEASE_SHA-ai")" = "$IMAGE_ID"
+      - name: Remove temporary image archive
+        if: always()
+        run: >-
+          rm -f -- artifacts/geointel-image.tar
+          artifacts/geointel-image.tar.image-id
+          artifacts/geointel-image.tar.partial.*
+      - name: Publish container evidence
+        if: always()
+        uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
+        with:
+          name: container-evidence
+          path: |
+            artifacts/image-inspect.json
+            artifacts/image-id.txt
+            artifacts/geointel-sbom.spdx.json
+            artifacts/geointel-container-vulnerabilities.json
+          if-no-files-found: warn
+          retention-days: 30
+
+  deploy:
+    name: Deploy exact gated revision to Unraid
+    needs: [quality, dependency-audit, container]
+    if: ${{ gitea.event_name == 'push' && gitea.ref == 'refs/heads/main' }}
+    runs-on: unraid-deploy
+    # The first byte-complete storage snapshot can exceed 100 GiB. Keep the
+    # gated caller attached for the full conservative backup/build window;
+    # the controller and deploy script still serialize every mutation.
+    timeout-minutes: 720
+    steps:
+      - name: Deploy only after every release gate is green
+        run: |
+          set -euo pipefail
+          docker exec gitea-deploy-control \
+            /opt/gitea-deploy/deploy.py deploy \
+            "${{ gitea.repository }}" "${{ gitea.sha }}"