115 lines
3.7 KiB
YAML
115 lines
3.7 KiB
YAML
name: Build pinned Cloud PWA
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
nekonest_commit:
|
|
description: Immutable 40-character NekoNest commit SHA
|
|
required: true
|
|
type: string
|
|
connect_origin:
|
|
description: Stable HTTPS Connect origin
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: cloud-pwa-${{ inputs.nekonest_commit }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Validate immutable inputs
|
|
shell: pwsh
|
|
env:
|
|
NEKONEST_COMMIT: ${{ inputs.nekonest_commit }}
|
|
CONNECT_ORIGIN: ${{ inputs.connect_origin }}
|
|
run: |
|
|
if ($env:NEKONEST_COMMIT -notmatch '^[0-9a-f]{40}$') {
|
|
throw 'nekonest_commit must be a full immutable SHA'
|
|
}
|
|
$origin = [Uri]$env:CONNECT_ORIGIN
|
|
if ($origin.Scheme -ne 'https' -or $origin.AbsoluteUri.TrimEnd('/') -ne $env:CONNECT_ORIGIN.TrimEnd('/')) {
|
|
throw 'connect_origin must be an exact HTTPS origin'
|
|
}
|
|
if ($origin.UserInfo -or $origin.PathAndQuery -ne '/' -or $origin.Fragment) {
|
|
throw 'connect_origin must not contain credentials, path, query, or fragment'
|
|
}
|
|
|
|
- name: Check out exact NekoNest source
|
|
uses: actions/checkout@v7
|
|
with:
|
|
repository: klarkxy/nekonest
|
|
ref: ${{ inputs.nekonest_commit }}
|
|
fetch-depth: 0
|
|
path: nekonest
|
|
|
|
- name: Verify checked-out source did not move
|
|
shell: pwsh
|
|
working-directory: nekonest
|
|
env:
|
|
EXPECTED_SHA: ${{ inputs.nekonest_commit }}
|
|
run: |
|
|
$actual = (git rev-parse HEAD).Trim()
|
|
if ($actual -ne $env:EXPECTED_SHA) { throw "expected $env:EXPECTED_SHA, got $actual" }
|
|
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 10.29.2
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: '24'
|
|
cache: pnpm
|
|
cache-dependency-path: nekonest/pwa/pnpm-lock.yaml
|
|
|
|
- name: Install, test, and build managed PWA
|
|
working-directory: nekonest/pwa
|
|
env:
|
|
VITE_NEKONEST_MANAGED: 'true'
|
|
run: |
|
|
pnpm install --frozen-lockfile
|
|
pnpm test
|
|
pnpm type-check
|
|
pnpm build
|
|
|
|
- name: Write deploy-time stable endpoint config
|
|
shell: pwsh
|
|
env:
|
|
CONNECT_ORIGIN: ${{ inputs.connect_origin }}
|
|
run: |
|
|
$config = [ordered]@{
|
|
api_base = $env:CONNECT_ORIGIN.TrimEnd('/')
|
|
ws_base = $env:CONNECT_ORIGIN.TrimEnd('/').Replace('https://', 'wss://')
|
|
attachment_base = $env:CONNECT_ORIGIN.TrimEnd('/')
|
|
push_base = $env:CONNECT_ORIGIN.TrimEnd('/')
|
|
managed = $true
|
|
handoff_exchange_path = '/api/pwa/handoff/exchange'
|
|
}
|
|
$config | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM nekonest/pwa/dist/runtime-config.json
|
|
|
|
- name: Record source provenance
|
|
shell: pwsh
|
|
env:
|
|
SOURCE_SHA: ${{ inputs.nekonest_commit }}
|
|
run: |
|
|
[ordered]@{
|
|
repository = 'https://github.com/klarkxy/nekonest'
|
|
commit = $env:SOURCE_SHA
|
|
built_at = (Get-Date).ToUniversalTime().ToString('o')
|
|
} | ConvertTo-Json -Compress | Set-Content -Encoding utf8NoBOM nekonest/pwa/dist/source-provenance.json
|
|
|
|
- name: Upload exact-build artifact
|
|
uses: actions/upload-artifact@v7
|
|
with:
|
|
name: nekonest-cloud-pwa-${{ inputs.nekonest_commit }}
|
|
path: nekonest/pwa/dist
|
|
if-no-files-found: error
|
|
retention-days: 7
|