From f6d2876a44756d59c84d037f9613ed622bc0223f Mon Sep 17 00:00:00 2001 From: Kamil Krzywda Date: Mon, 28 Sep 2026 15:56:18 +0000 Subject: [PATCH] ci: docker compose (prod + isolated e2e) and Gitea CI pipeline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prod compose: Traefik labels for space-wanderer.dev.kkhost.pl, ./db volume mount. CI compose: project space-wanderer-ci on external network space-wanderer-ci-e2e with the app pinned to static IP 172.39.0.10 (Flight-Ops mechanism verbatim, distinct network name so both stacks coexist on the shared dind daemon), fresh named DB volume per run. ci.yml: single 'build + unit + e2e' job — required status check name kept; flaky-uplink retry loops, dep/browser caches, dind cleanup + prune carried over. --- .gitea/workflows/ci.yml | 229 ++++++++++++++++++++++++++++++++++++++++ docker-compose.ci.yml | 29 +++++ docker-compose.yml | 17 +++ 3 files changed, 275 insertions(+) create mode 100644 .gitea/workflows/ci.yml create mode 100644 docker-compose.ci.yml create mode 100644 docker-compose.yml diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml new file mode 100644 index 0000000..a7e8079 --- /dev/null +++ b/.gitea/workflows/ci.yml @@ -0,0 +1,229 @@ +name: CI + +on: + push: + branches: [master] + pull_request: + branches: [master] + workflow_dispatch: + +jobs: + ci: + name: build + unit + e2e + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + # The runner provides a working docker CLI out of the box (full-dind) — no endpoint + # resolution needed. Job and app containers share the daemon, so put them on one + # user-defined network with a pinned subnet; the app gets a STATIC IP (172.39.0.10, + # declared in docker-compose.ci.yml) because Chromium got ERR_SSL_PROTOCOL_ERROR via + # the DNS alias while node-side HTTP to the same name worked — bypassing DNS removes + # that variable entirely. A stale network with a different subnet is recreated. + - name: Prepare e2e network + run: | + set -u + # Interrupted runs skip the end-of-run cleanup, leaking a USED DB volume into later + # runs (tests assume seeded state) — drop it so every run starts fresh. + docker volume rm space-wanderer-ci_space-wanderer-db 2>/dev/null || true + SUBNET=172.39.0.0/24 + if docker network inspect space-wanderer-ci-e2e >/dev/null 2>&1; then + cur=$(docker network inspect space-wanderer-ci-e2e --format '{{(index .IPAM.Config 0).Subnet}}') + if [ "$cur" != "$SUBNET" ]; then + echo "stale space-wanderer-ci-e2e with subnet $cur — recreating with $SUBNET" + docker network rm space-wanderer-ci-e2e || true + docker network create --subnet "$SUBNET" space-wanderer-ci-e2e + fi + else + docker network create --subnet "$SUBNET" space-wanderer-ci-e2e + fi + if ! docker network connect space-wanderer-ci-e2e "$(hostname)"; then + echo "::error::failed to attach job container '$(hostname)' to space-wanderer-ci-e2e — the job must run in a container on the shared daemon (check runner config)" >&2 + exit 1 + fi + docker network inspect space-wanderer-ci-e2e --format 'containers on space-wanderer-ci-e2e: {{range .Containers}}{{.Name}} {{end}}' + echo "E2E_BASE_URL=http://172.39.0.10:3000" >> "$GITHUB_ENV" + + - name: Setup Node + uses: actions/setup-node@v4 + with: + node-version: 22 + + # bun drives installs (repo ships bun.lock, no package-lock.json); pinned to 1.4.2. + # Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI). + - name: Install bun + run: | + set -u + ok=0 + for i in 1 2 3; do + if npm i -g bun@1.4.2; then ok=1; break; fi + echo "::warning::bun install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2 + sleep 5 + done + [ "$ok" = "1" ] || { echo "::error::bun install failed after 3 attempts" >&2; exit 1; } + bun --version + + # Job-level dep cache via the runner's built-in cache server. continue-on-error on + # both steps: an unreachable/broken cache server must never break the run. + - name: Restore deps cache + uses: actions/cache@v4 + continue-on-error: true + with: + path: | + node_modules + $HOME/.bun/install/cache + key: ${{ runner.os }}-deps-bun-${{ hashFiles('bun.lock') }} + + # Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI). + - name: Install dependencies + run: | + set -u + ok=0 + for i in 1 2 3; do + if bun install --frozen-lockfile; then ok=1; break; fi + echo "::warning::dependency install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2 + sleep 5 + done + [ "$ok" = "1" ] || { echo "::error::dependency install failed after 3 attempts" >&2; exit 1; } + + # No explicit save step: caches marked by the restore steps are uploaded automatically at job end. + + - name: Build + run: npm run build + + - name: Unit tests + run: npx vitest run + + # Browsers run locally in CI (PW_REMOTE_BROWSER=0 below): the shared remote browser + # server at 192.168.1.4 cannot reach a stack inside dind, and local chromium keeps + # the job self-contained. + # Browser binaries (~187 MiB) cached across runs: the runner's uplink is flaky and + # cdn.playwright.dev downloads time out mid-transfer; once seeded, installs skip the download. + - name: Restore browser cache + uses: actions/cache@v4 + continue-on-error: true + with: + path: $HOME/.cache/ms-playwright + key: ${{ runner.os }}-pw-browsers-${{ hashFiles('package.json') }} + + # Retried: cdn.playwright.dev is flaky from this runner — Playwright's internal 5-retry + # window (~40-90s) is often not enough, but runs get through with a longer one. Progress + # accumulates across attempts: playwright skips already-installed browsers. + - name: Install browsers (local) + run: | + set -u + ok=0 + for i in 1 2 3 4 5 6; do + if npx playwright install --with-deps chromium; then ok=1; break; fi + echo "::warning::browser install attempt $i/6 failed (flaky cdn.playwright.dev) — retrying in 5s" >&2 + sleep 5 + done + [ "$ok" = "1" ] || { echo "::error::browser install failed after 6 attempts" >&2; exit 1; } + + # Cache the base image on the shared daemon up front: a single loud failure here + # beats a 6-minute BuildKit "failed to solve" when the daemon's outbound net is down. + - name: Pull e2e base image + run: docker pull node:22-slim + + # Pre-build the e2e image with retries (flaky runner network); the E2E step's own + # build then becomes a fast no-op. Plain progress keeps BuildKit output visible. + - name: Build e2e image (retries) + run: | + set -u + ok=0 + for i in 1 2 3; do + if docker compose -f docker-compose.ci.yml -p space-wanderer-ci build --progress=plain; then ok=1; break; fi + echo "::warning::e2e image build attempt $i/3 failed (likely transient network) — retrying in 5s" >&2 + sleep 5 + done + [ "$ok" = "1" ] || { echo "::error::e2e image build failed after 3 attempts" >&2; exit 1; } + + # E2E against an isolated stack on the shared daemon — never the production instance. + # docker-compose.ci.yml joins the space-wanderer-ci-e2e network prepared above; project name + # space-wanderer-ci keeps it distinct from production. E2E_DEPLOY_CMD makes the config's + # webServer block deploy + wait for readiness (http://app:3000 via service DNS); + # E2E_COMPOSE_ARGS points state.spec.ts' mid-run `docker compose restart space-wanderer` at + # the same file + project. E2E_BASE_URL comes from GITHUB_ENV (Prepare e2e network). + - name: E2E (isolated stack in dind) + env: + PW_REMOTE_BROWSER: "0" + # Build separately with plain progress so BuildKit step output is visible in the + # job log (auto progress hides it). Playwright's webServer needs a long-running + # command — `up -d` returns immediately and triggers "exited early"; `logs -f` + # keeps it alive, streams app logs into CI output for debugging, and is killed with + # the job (an orphaned `logs -f` dies on its own when cleanup removes the container). + E2E_DEPLOY_CMD: "docker compose -f docker-compose.ci.yml -p space-wanderer-ci build --progress=plain && docker compose -f docker-compose.ci.yml -p space-wanderer-ci up -d && docker compose -f docker-compose.ci.yml -p space-wanderer-ci logs -f" + E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml -p space-wanderer-ci" + # Chromium honors proxy env vars on Linux (node-side HTTP does not) — keep the + # in-network app host out of any proxy path. + NO_PROXY: app,localhost,127.0.0.1,.kkhost.pl + no_proxy: app,localhost,127.0.0.1,.kkhost.pl + # Machine-readable e2e results for the job-summary step below (Playwright's built-in + # json reporter; without this env var it would dump to stdout). test-results/ is git-ignored. + PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/e2e.json + # Connectivity diagnostics now run post-deploy in e2e/ci-diagnostics.ts (globalSetup). + # --reporter=list prints each test as it completes (name + ✓/× + duration) for progress + # visibility in the job log; failure error context/snapshots are unchanged. The json + # reporter adds a machine-readable report (PLAYWRIGHT_JSON_OUTPUT_FILE above) — no + # execution behavior changes, reporters only observe. + run: npx playwright test --reporter=list,json + + # Appends e2e results to the job-summary panel — mirrors how unit tests get there + # (vitest's built-in github-actions reporter auto-appends $GITHUB_STEP_SUMMARY in CI). + # if: always() so a FAILED suite still gets summarized; non-fatal by design — a missing + # or malformed report must never mask the real e2e exit code. The script is single-quoted + # for bash, so it contains no apostrophes. + - name: E2E job summary + if: always() + run: | + node -e ' + const fs = require("fs"); + let report; + try { + report = JSON.parse(fs.readFileSync("test-results/e2e.json", "utf8")); + } catch { + process.exit(0); // e2e never ran (earlier step failed) or no report — nothing to summarize + } + let passed = 0, skipped = 0; + const failed = []; + const walk = (suite) => { + for (const spec of suite.specs ?? []) { + if (!spec.ok) failed.push(`${suite.title} › ${spec.title}`); + else if ((spec.tests ?? []).length && spec.tests.every((t) => t.expectedStatus === "skipped")) skipped++; + else passed++; + } + for (const sub of suite.suites ?? []) walk(sub); + }; + for (const s of report.suites ?? []) walk(s); + const lines = [ + "", "## E2E results", "", + `- Passed: ${passed}`, + `- Failed: ${failed.length}`, + `- Skipped: ${skipped}`, + ]; + if (failed.length) { + lines.push("", "### Failed specs"); + for (const f of failed) lines.push(`- \`${f}\``); + } + const summaryFile = process.env.GITHUB_STEP_SUMMARY; + if (summaryFile) fs.appendFileSync(summaryFile, lines.join("\n") + "\n"); + ' || true + + # The daemon is shared with production — never leave our stack or network behind. + # -v drops the named DB volume so every run seeds fresh (no schema drift between PRs). + - name: Cleanup e2e stack + network + if: always() + run: | + docker compose -f docker-compose.ci.yml -p space-wanderer-ci down --remove-orphans -v || true + docker network remove space-wanderer-ci-e2e 2>/dev/null || true + + # The shared runner dind still accumulates between runs what the steps above can't reach: + # dangling images/layers from the per-run space-wanderer-ci rebuilds, BuildKit cache, and job + # containers leaked by interrupted runs. Prune them here (after stack + network cleanup). + # Deliberately NO --volumes: the daemon is shared with production and named volumes may hold + # other workflows' persistent data — this project's own space-wanderer-ci_space-wanderer-db volume is already + # dropped by the steps above. Non-fatal so a prune failure can never mask or break the run. + - name: Prune runner dind leftovers + if: always() + run: docker system prune -af || echo "::warning::dind prune failed — see logs" diff --git a/docker-compose.ci.yml b/docker-compose.ci.yml new file mode 100644 index 0000000..b086377 --- /dev/null +++ b/docker-compose.ci.yml @@ -0,0 +1,29 @@ +# Isolated e2e stack for CI (.gitea/workflows/ci.yml) — runs on the runner's shared dind +# daemon under project name space-wanderer-ci (distinct from production). Joins the external +# network space-wanderer-ci-e2e that the workflow attaches the job container to; the app is reached +# at its STATIC IP http://172.39.0.10:3000 — DNS bypassed for the browser because Chromium +# got ERR_SSL_PROTOCOL_ERROR via the hostname while node-side HTTP worked (the `app` alias +# stays as a convenience). Single deterministic address; survives `docker compose restart space-wanderer`. +# The build context is tarred by the compose client in the job and sent over DOCKER_HOST, +# so nothing here needs to be visible from inside dind; game state lives in a named volume +# (fresh per run — CI cleanup removes it — survives `docker compose restart space-wanderer` for +# e2e/state.spec.ts). +services: + space-wanderer: + build: . + image: space-wanderer-ci + volumes: + - space-wanderer-db:/app/db + networks: + space-wanderer-ci-e2e: + aliases: + - app + ipv4_address: 172.39.0.10 + +networks: + space-wanderer-ci-e2e: + name: space-wanderer-ci-e2e + external: true + +volumes: + space-wanderer-db: diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..f6af7ff --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,17 @@ +services: + space-wanderer: + build: . + volumes: + # Game state SQLite: created on first run, must survive rebuilds. + - "./db:/app/db" + networks: + - dev_net + labels: + - "traefik.enable=true" + - "traefik.http.routers.space-wanderer.rule=Host(`space-wanderer.dev.kkhost.pl`)" + - "traefik.http.routers.space-wanderer.entrypoints=web" + - "traefik.http.services.space-wanderer.loadbalancer.server.port=3000" + +networks: + dev_net: + external: true