feat: establish NekoNest Cloud control and relay
This commit is contained in:
@@ -0,0 +1,114 @@
|
||||
name: Build pinned Cloud PWA
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
nekonest_commit:
|
||||
description: Immutable 40-character NekoNest commit SHA
|
||||
required: true
|
||||
type: string
|
||||
connect_origin:
|
||||
description: Stable HTTPS Connect origin
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: cloud-pwa-${{ inputs.nekonest_commit }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Validate immutable inputs
|
||||
shell: pwsh
|
||||
env:
|
||||
NEKONEST_COMMIT: ${{ inputs.nekonest_commit }}
|
||||
CONNECT_ORIGIN: ${{ inputs.connect_origin }}
|
||||
run: |
|
||||
if ($env:NEKONEST_COMMIT -notmatch '^[0-9a-f]{40}$') {
|
||||
throw 'nekonest_commit must be a full immutable SHA'
|
||||
}
|
||||
$origin = [Uri]$env:CONNECT_ORIGIN
|
||||
if ($origin.Scheme -ne 'https' -or $origin.AbsoluteUri.TrimEnd('/') -ne $env:CONNECT_ORIGIN.TrimEnd('/')) {
|
||||
throw 'connect_origin must be an exact HTTPS origin'
|
||||
}
|
||||
if ($origin.UserInfo -or $origin.PathAndQuery -ne '/' -or $origin.Fragment) {
|
||||
throw 'connect_origin must not contain credentials, path, query, or fragment'
|
||||
}
|
||||
|
||||
- name: Check out exact NekoNest source
|
||||
uses: actions/checkout@v7
|
||||
with:
|
||||
repository: klarkxy/nekonest
|
||||
ref: ${{ inputs.nekonest_commit }}
|
||||
fetch-depth: 0
|
||||
path: nekonest
|
||||
|
||||
- name: Verify checked-out source did not move
|
||||
shell: pwsh
|
||||
working-directory: nekonest
|
||||
env:
|
||||
EXPECTED_SHA: ${{ inputs.nekonest_commit }}
|
||||
run: |
|
||||
$actual = (git rev-parse HEAD).Trim()
|
||||
if ($actual -ne $env:EXPECTED_SHA) { throw "expected $env:EXPECTED_SHA, got $actual" }
|
||||
|
||||
- name: Set up pnpm
|
||||
uses: pnpm/action-setup@v6
|
||||
with:
|
||||
version: 10.29.2
|
||||
|
||||
- name: Set up Node
|
||||
uses: actions/setup-node@v6
|
||||
with:
|
||||
node-version: '24'
|
||||
cache: pnpm
|
||||
cache-dependency-path: nekonest/pwa/pnpm-lock.yaml
|
||||
|
||||
- name: Install, test, and build managed PWA
|
||||
working-directory: nekonest/pwa
|
||||
env:
|
||||
VITE_NEKONEST_MANAGED: 'true'
|
||||
run: |
|
||||
pnpm install --frozen-lockfile
|
||||
pnpm test
|
||||
pnpm type-check
|
||||
pnpm build
|
||||
|
||||
- name: Write deploy-time stable endpoint config
|
||||
shell: pwsh
|
||||
env:
|
||||
CONNECT_ORIGIN: ${{ inputs.connect_origin }}
|
||||
run: |
|
||||
$config = [ordered]@{
|
||||
api_base = $env:CONNECT_ORIGIN.TrimEnd('/')
|
||||
ws_base = $env:CONNECT_ORIGIN.TrimEnd('/').Replace('https://', 'wss://')
|
||||
attachment_base = $env:CONNECT_ORIGIN.TrimEnd('/')
|
||||
push_base = $env:CONNECT_ORIGIN.TrimEnd('/')
|
||||
managed = $true
|
||||
handoff_exchange_path = '/api/pwa/handoff/exchange'
|
||||
}
|
||||
$config | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM nekonest/pwa/dist/runtime-config.json
|
||||
|
||||
- name: Record source provenance
|
||||
shell: pwsh
|
||||
env:
|
||||
SOURCE_SHA: ${{ inputs.nekonest_commit }}
|
||||
run: |
|
||||
[ordered]@{
|
||||
repository = 'https://github.com/klarkxy/nekonest'
|
||||
commit = $env:SOURCE_SHA
|
||||
built_at = (Get-Date).ToUniversalTime().ToString('o')
|
||||
} | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM nekonest/pwa/dist/source-provenance.json
|
||||
|
||||
- name: Upload exact-build artifact
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: nekonest-cloud-pwa-${{ inputs.nekonest_commit }}
|
||||
path: nekonest/pwa/dist
|
||||
if-no-files-found: error
|
||||
retention-days: 7
|
||||
@@ -0,0 +1,81 @@
|
||||
name: Verify pinned Cloud Relay
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
relay_core_tag:
|
||||
description: Exact published Relay Core tag, for example relaycore/v0.1.0
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: cloud-relay-${{ inputs.relay_core_tag }}
|
||||
cancel-in-progress: false
|
||||
|
||||
jobs:
|
||||
verify:
|
||||
runs-on: ubuntu-latest
|
||||
defaults:
|
||||
run:
|
||||
working-directory: relay
|
||||
env:
|
||||
GOWORK: 'off'
|
||||
CGO_ENABLED: '1'
|
||||
steps:
|
||||
- uses: actions/checkout@v7
|
||||
|
||||
- uses: actions/setup-go@v6
|
||||
with:
|
||||
go-version-file: relay/go.mod
|
||||
cache-dependency-path: relay/go.sum
|
||||
|
||||
- name: Require an immutable released Relay Core dependency
|
||||
shell: pwsh
|
||||
env:
|
||||
RELAY_CORE_TAG: ${{ inputs.relay_core_tag }}
|
||||
run: |
|
||||
if ($env:RELAY_CORE_TAG -notmatch '^relaycore/v[0-9]+\.[0-9]+\.[0-9]+$') {
|
||||
throw 'relay_core_tag must be an exact relaycore/vX.Y.Z tag'
|
||||
}
|
||||
if (Select-String -Path go.mod -Pattern '^replace\s' -Quiet) {
|
||||
throw 'Cloud Relay go.mod must not contain replace directives'
|
||||
}
|
||||
$expected = $env:RELAY_CORE_TAG.Substring('relaycore/'.Length)
|
||||
$actual = (go list -m -f '{{.Version}}' github.com/klarkxy/nekonest/relaycore).Trim()
|
||||
if ($actual -ne $expected) {
|
||||
throw "go.mod requires $actual but workflow requested $expected"
|
||||
}
|
||||
go mod download
|
||||
|
||||
- name: Test, vet, race, and build
|
||||
run: |
|
||||
go test -count=1 ./...
|
||||
go vet ./...
|
||||
go test -race -count=1 ./...
|
||||
go build -trimpath -o ../release/nekonest-cloud-relay ./cmd/relay
|
||||
|
||||
- name: Record source provenance
|
||||
shell: pwsh
|
||||
env:
|
||||
RELAY_CORE_TAG: ${{ inputs.relay_core_tag }}
|
||||
run: |
|
||||
$cloudCommit = (git -C .. rev-parse HEAD).Trim()
|
||||
$binaryHash = (Get-FileHash ../release/nekonest-cloud-relay -Algorithm SHA256).Hash.ToLowerInvariant()
|
||||
[ordered]@{
|
||||
cloud_commit = $cloudCommit
|
||||
relay_core_tag = $env:RELAY_CORE_TAG
|
||||
binary_sha256 = $binaryHash
|
||||
built_at = (Get-Date).ToUniversalTime().ToString('o')
|
||||
} | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM ../release/cloud-relay-provenance.json
|
||||
|
||||
- uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: nekonest-cloud-relay-${{ github.run_id }}
|
||||
path: |
|
||||
release/nekonest-cloud-relay
|
||||
release/cloud-relay-provenance.json
|
||||
if-no-files-found: error
|
||||
retention-days: 7
|
||||
Reference in New Issue
Block a user