ci: docker compose (prod + isolated e2e) and Gitea CI pipeline
Prod compose: Traefik labels for space-wanderer.dev.kkhost.pl, ./db volume mount. CI compose: project space-wanderer-ci on external network space-wanderer-ci-e2e with the app pinned to static IP 172.39.0.10 (Flight-Ops mechanism verbatim, distinct network name so both stacks coexist on the shared dind daemon), fresh named DB volume per run. ci.yml: single 'build + unit + e2e' job — required status check name kept; flaky-uplink retry loops, dep/browser caches, dind cleanup + prune carried over.
This commit is contained in:
@@ -0,0 +1,229 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [master]
|
||||
pull_request:
|
||||
branches: [master]
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
ci:
|
||||
name: build + unit + e2e
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
# The runner provides a working docker CLI out of the box (full-dind) — no endpoint
|
||||
# resolution needed. Job and app containers share the daemon, so put them on one
|
||||
# user-defined network with a pinned subnet; the app gets a STATIC IP (172.39.0.10,
|
||||
# declared in docker-compose.ci.yml) because Chromium got ERR_SSL_PROTOCOL_ERROR via
|
||||
# the DNS alias while node-side HTTP to the same name worked — bypassing DNS removes
|
||||
# that variable entirely. A stale network with a different subnet is recreated.
|
||||
- name: Prepare e2e network
|
||||
run: |
|
||||
set -u
|
||||
# Interrupted runs skip the end-of-run cleanup, leaking a USED DB volume into later
|
||||
# runs (tests assume seeded state) — drop it so every run starts fresh.
|
||||
docker volume rm space-wanderer-ci_space-wanderer-db 2>/dev/null || true
|
||||
SUBNET=172.39.0.0/24
|
||||
if docker network inspect space-wanderer-ci-e2e >/dev/null 2>&1; then
|
||||
cur=$(docker network inspect space-wanderer-ci-e2e --format '{{(index .IPAM.Config 0).Subnet}}')
|
||||
if [ "$cur" != "$SUBNET" ]; then
|
||||
echo "stale space-wanderer-ci-e2e with subnet $cur — recreating with $SUBNET"
|
||||
docker network rm space-wanderer-ci-e2e || true
|
||||
docker network create --subnet "$SUBNET" space-wanderer-ci-e2e
|
||||
fi
|
||||
else
|
||||
docker network create --subnet "$SUBNET" space-wanderer-ci-e2e
|
||||
fi
|
||||
if ! docker network connect space-wanderer-ci-e2e "$(hostname)"; then
|
||||
echo "::error::failed to attach job container '$(hostname)' to space-wanderer-ci-e2e — the job must run in a container on the shared daemon (check runner config)" >&2
|
||||
exit 1
|
||||
fi
|
||||
docker network inspect space-wanderer-ci-e2e --format 'containers on space-wanderer-ci-e2e: {{range .Containers}}{{.Name}} {{end}}'
|
||||
echo "E2E_BASE_URL=http://172.39.0.10:3000" >> "$GITHUB_ENV"
|
||||
|
||||
- name: Setup Node
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 22
|
||||
|
||||
# bun drives installs (repo ships bun.lock, no package-lock.json); pinned to 1.4.2.
|
||||
# Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI).
|
||||
- name: Install bun
|
||||
run: |
|
||||
set -u
|
||||
ok=0
|
||||
for i in 1 2 3; do
|
||||
if npm i -g bun@1.4.2; then ok=1; break; fi
|
||||
echo "::warning::bun install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
|
||||
sleep 5
|
||||
done
|
||||
[ "$ok" = "1" ] || { echo "::error::bun install failed after 3 attempts" >&2; exit 1; }
|
||||
bun --version
|
||||
|
||||
# Job-level dep cache via the runner's built-in cache server. continue-on-error on
|
||||
# both steps: an unreachable/broken cache server must never break the run.
|
||||
- name: Restore deps cache
|
||||
uses: actions/cache@v4
|
||||
continue-on-error: true
|
||||
with:
|
||||
path: |
|
||||
node_modules
|
||||
$HOME/.bun/install/cache
|
||||
key: ${{ runner.os }}-deps-bun-${{ hashFiles('bun.lock') }}
|
||||
|
||||
# Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI).
|
||||
- name: Install dependencies
|
||||
run: |
|
||||
set -u
|
||||
ok=0
|
||||
for i in 1 2 3; do
|
||||
if bun install --frozen-lockfile; then ok=1; break; fi
|
||||
echo "::warning::dependency install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
|
||||
sleep 5
|
||||
done
|
||||
[ "$ok" = "1" ] || { echo "::error::dependency install failed after 3 attempts" >&2; exit 1; }
|
||||
|
||||
# No explicit save step: caches marked by the restore steps are uploaded automatically at job end.
|
||||
|
||||
- name: Build
|
||||
run: npm run build
|
||||
|
||||
- name: Unit tests
|
||||
run: npx vitest run
|
||||
|
||||
# Browsers run locally in CI (PW_REMOTE_BROWSER=0 below): the shared remote browser
|
||||
# server at 192.168.1.4 cannot reach a stack inside dind, and local chromium keeps
|
||||
# the job self-contained.
|
||||
# Browser binaries (~187 MiB) cached across runs: the runner's uplink is flaky and
|
||||
# cdn.playwright.dev downloads time out mid-transfer; once seeded, installs skip the download.
|
||||
- name: Restore browser cache
|
||||
uses: actions/cache@v4
|
||||
continue-on-error: true
|
||||
with:
|
||||
path: $HOME/.cache/ms-playwright
|
||||
key: ${{ runner.os }}-pw-browsers-${{ hashFiles('package.json') }}
|
||||
|
||||
# Retried: cdn.playwright.dev is flaky from this runner — Playwright's internal 5-retry
|
||||
# window (~40-90s) is often not enough, but runs get through with a longer one. Progress
|
||||
# accumulates across attempts: playwright skips already-installed browsers.
|
||||
- name: Install browsers (local)
|
||||
run: |
|
||||
set -u
|
||||
ok=0
|
||||
for i in 1 2 3 4 5 6; do
|
||||
if npx playwright install --with-deps chromium; then ok=1; break; fi
|
||||
echo "::warning::browser install attempt $i/6 failed (flaky cdn.playwright.dev) — retrying in 5s" >&2
|
||||
sleep 5
|
||||
done
|
||||
[ "$ok" = "1" ] || { echo "::error::browser install failed after 6 attempts" >&2; exit 1; }
|
||||
|
||||
# Cache the base image on the shared daemon up front: a single loud failure here
|
||||
# beats a 6-minute BuildKit "failed to solve" when the daemon's outbound net is down.
|
||||
- name: Pull e2e base image
|
||||
run: docker pull node:22-slim
|
||||
|
||||
# Pre-build the e2e image with retries (flaky runner network); the E2E step's own
|
||||
# build then becomes a fast no-op. Plain progress keeps BuildKit output visible.
|
||||
- name: Build e2e image (retries)
|
||||
run: |
|
||||
set -u
|
||||
ok=0
|
||||
for i in 1 2 3; do
|
||||
if docker compose -f docker-compose.ci.yml -p space-wanderer-ci build --progress=plain; then ok=1; break; fi
|
||||
echo "::warning::e2e image build attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
|
||||
sleep 5
|
||||
done
|
||||
[ "$ok" = "1" ] || { echo "::error::e2e image build failed after 3 attempts" >&2; exit 1; }
|
||||
|
||||
# E2E against an isolated stack on the shared daemon — never the production instance.
|
||||
# docker-compose.ci.yml joins the space-wanderer-ci-e2e network prepared above; project name
|
||||
# space-wanderer-ci keeps it distinct from production. E2E_DEPLOY_CMD makes the config's
|
||||
# webServer block deploy + wait for readiness (http://app:3000 via service DNS);
|
||||
# E2E_COMPOSE_ARGS points state.spec.ts' mid-run `docker compose restart space-wanderer` at
|
||||
# the same file + project. E2E_BASE_URL comes from GITHUB_ENV (Prepare e2e network).
|
||||
- name: E2E (isolated stack in dind)
|
||||
env:
|
||||
PW_REMOTE_BROWSER: "0"
|
||||
# Build separately with plain progress so BuildKit step output is visible in the
|
||||
# job log (auto progress hides it). Playwright's webServer needs a long-running
|
||||
# command — `up -d` returns immediately and triggers "exited early"; `logs -f`
|
||||
# keeps it alive, streams app logs into CI output for debugging, and is killed with
|
||||
# the job (an orphaned `logs -f` dies on its own when cleanup removes the container).
|
||||
E2E_DEPLOY_CMD: "docker compose -f docker-compose.ci.yml -p space-wanderer-ci build --progress=plain && docker compose -f docker-compose.ci.yml -p space-wanderer-ci up -d && docker compose -f docker-compose.ci.yml -p space-wanderer-ci logs -f"
|
||||
E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml -p space-wanderer-ci"
|
||||
# Chromium honors proxy env vars on Linux (node-side HTTP does not) — keep the
|
||||
# in-network app host out of any proxy path.
|
||||
NO_PROXY: app,localhost,127.0.0.1,.kkhost.pl
|
||||
no_proxy: app,localhost,127.0.0.1,.kkhost.pl
|
||||
# Machine-readable e2e results for the job-summary step below (Playwright's built-in
|
||||
# json reporter; without this env var it would dump to stdout). test-results/ is git-ignored.
|
||||
PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/e2e.json
|
||||
# Connectivity diagnostics now run post-deploy in e2e/ci-diagnostics.ts (globalSetup).
|
||||
# --reporter=list prints each test as it completes (name + ✓/× + duration) for progress
|
||||
# visibility in the job log; failure error context/snapshots are unchanged. The json
|
||||
# reporter adds a machine-readable report (PLAYWRIGHT_JSON_OUTPUT_FILE above) — no
|
||||
# execution behavior changes, reporters only observe.
|
||||
run: npx playwright test --reporter=list,json
|
||||
|
||||
# Appends e2e results to the job-summary panel — mirrors how unit tests get there
|
||||
# (vitest's built-in github-actions reporter auto-appends $GITHUB_STEP_SUMMARY in CI).
|
||||
# if: always() so a FAILED suite still gets summarized; non-fatal by design — a missing
|
||||
# or malformed report must never mask the real e2e exit code. The script is single-quoted
|
||||
# for bash, so it contains no apostrophes.
|
||||
- name: E2E job summary
|
||||
if: always()
|
||||
run: |
|
||||
node -e '
|
||||
const fs = require("fs");
|
||||
let report;
|
||||
try {
|
||||
report = JSON.parse(fs.readFileSync("test-results/e2e.json", "utf8"));
|
||||
} catch {
|
||||
process.exit(0); // e2e never ran (earlier step failed) or no report — nothing to summarize
|
||||
}
|
||||
let passed = 0, skipped = 0;
|
||||
const failed = [];
|
||||
const walk = (suite) => {
|
||||
for (const spec of suite.specs ?? []) {
|
||||
if (!spec.ok) failed.push(`${suite.title} › ${spec.title}`);
|
||||
else if ((spec.tests ?? []).length && spec.tests.every((t) => t.expectedStatus === "skipped")) skipped++;
|
||||
else passed++;
|
||||
}
|
||||
for (const sub of suite.suites ?? []) walk(sub);
|
||||
};
|
||||
for (const s of report.suites ?? []) walk(s);
|
||||
const lines = [
|
||||
"", "## E2E results", "",
|
||||
`- Passed: ${passed}`,
|
||||
`- Failed: ${failed.length}`,
|
||||
`- Skipped: ${skipped}`,
|
||||
];
|
||||
if (failed.length) {
|
||||
lines.push("", "### Failed specs");
|
||||
for (const f of failed) lines.push(`- \`${f}\``);
|
||||
}
|
||||
const summaryFile = process.env.GITHUB_STEP_SUMMARY;
|
||||
if (summaryFile) fs.appendFileSync(summaryFile, lines.join("\n") + "\n");
|
||||
' || true
|
||||
|
||||
# The daemon is shared with production — never leave our stack or network behind.
|
||||
# -v drops the named DB volume so every run seeds fresh (no schema drift between PRs).
|
||||
- name: Cleanup e2e stack + network
|
||||
if: always()
|
||||
run: |
|
||||
docker compose -f docker-compose.ci.yml -p space-wanderer-ci down --remove-orphans -v || true
|
||||
docker network remove space-wanderer-ci-e2e 2>/dev/null || true
|
||||
|
||||
# The shared runner dind still accumulates between runs what the steps above can't reach:
|
||||
# dangling images/layers from the per-run space-wanderer-ci rebuilds, BuildKit cache, and job
|
||||
# containers leaked by interrupted runs. Prune them here (after stack + network cleanup).
|
||||
# Deliberately NO --volumes: the daemon is shared with production and named volumes may hold
|
||||
# other workflows' persistent data — this project's own space-wanderer-ci_space-wanderer-db volume is already
|
||||
# dropped by the steps above. Non-fatal so a prune failure can never mask or break the run.
|
||||
- name: Prune runner dind leftovers
|
||||
if: always()
|
||||
run: docker system prune -af || echo "::warning::dind prune failed — see logs"
|
||||
Reference in New Issue
Block a user