kamilkrzywda
f6d2876a44
Prod compose: Traefik labels for space-wanderer.dev.kkhost.pl, ./db volume mount. CI compose: project space-wanderer-ci on external network space-wanderer-ci-e2e with the app pinned to static IP 172.39.0.10 (Flight-Ops mechanism verbatim, distinct network name so both stacks coexist on the shared dind daemon), fresh named DB volume per run. ci.yml: single 'build + unit + e2e' job — required status check name kept; flaky-uplink retry loops, dep/browser caches, dind cleanup + prune carried over.
230 lines
12 KiB
YAML
230 lines
12 KiB
YAML
name: CI
|
||
|
||
on:
|
||
push:
|
||
branches: [master]
|
||
pull_request:
|
||
branches: [master]
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
ci:
|
||
name: build + unit + e2e
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Checkout
|
||
uses: actions/checkout@v4
|
||
|
||
# The runner provides a working docker CLI out of the box (full-dind) — no endpoint
|
||
# resolution needed. Job and app containers share the daemon, so put them on one
|
||
# user-defined network with a pinned subnet; the app gets a STATIC IP (172.39.0.10,
|
||
# declared in docker-compose.ci.yml) because Chromium got ERR_SSL_PROTOCOL_ERROR via
|
||
# the DNS alias while node-side HTTP to the same name worked — bypassing DNS removes
|
||
# that variable entirely. A stale network with a different subnet is recreated.
|
||
- name: Prepare e2e network
|
||
run: |
|
||
set -u
|
||
# Interrupted runs skip the end-of-run cleanup, leaking a USED DB volume into later
|
||
# runs (tests assume seeded state) — drop it so every run starts fresh.
|
||
docker volume rm space-wanderer-ci_space-wanderer-db 2>/dev/null || true
|
||
SUBNET=172.39.0.0/24
|
||
if docker network inspect space-wanderer-ci-e2e >/dev/null 2>&1; then
|
||
cur=$(docker network inspect space-wanderer-ci-e2e --format '{{(index .IPAM.Config 0).Subnet}}')
|
||
if [ "$cur" != "$SUBNET" ]; then
|
||
echo "stale space-wanderer-ci-e2e with subnet $cur — recreating with $SUBNET"
|
||
docker network rm space-wanderer-ci-e2e || true
|
||
docker network create --subnet "$SUBNET" space-wanderer-ci-e2e
|
||
fi
|
||
else
|
||
docker network create --subnet "$SUBNET" space-wanderer-ci-e2e
|
||
fi
|
||
if ! docker network connect space-wanderer-ci-e2e "$(hostname)"; then
|
||
echo "::error::failed to attach job container '$(hostname)' to space-wanderer-ci-e2e — the job must run in a container on the shared daemon (check runner config)" >&2
|
||
exit 1
|
||
fi
|
||
docker network inspect space-wanderer-ci-e2e --format 'containers on space-wanderer-ci-e2e: {{range .Containers}}{{.Name}} {{end}}'
|
||
echo "E2E_BASE_URL=http://172.39.0.10:3000" >> "$GITHUB_ENV"
|
||
|
||
- name: Setup Node
|
||
uses: actions/setup-node@v4
|
||
with:
|
||
node-version: 22
|
||
|
||
# bun drives installs (repo ships bun.lock, no package-lock.json); pinned to 1.4.2.
|
||
# Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI).
|
||
- name: Install bun
|
||
run: |
|
||
set -u
|
||
ok=0
|
||
for i in 1 2 3; do
|
||
if npm i -g bun@1.4.2; then ok=1; break; fi
|
||
echo "::warning::bun install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
|
||
sleep 5
|
||
done
|
||
[ "$ok" = "1" ] || { echo "::error::bun install failed after 3 attempts" >&2; exit 1; }
|
||
bun --version
|
||
|
||
# Job-level dep cache via the runner's built-in cache server. continue-on-error on
|
||
# both steps: an unreachable/broken cache server must never break the run.
|
||
- name: Restore deps cache
|
||
uses: actions/cache@v4
|
||
continue-on-error: true
|
||
with:
|
||
path: |
|
||
node_modules
|
||
$HOME/.bun/install/cache
|
||
key: ${{ runner.os }}-deps-bun-${{ hashFiles('bun.lock') }}
|
||
|
||
# Retried: the runner's outbound network/DNS is flaky (transient EAI_AGAIN seen in CI).
|
||
- name: Install dependencies
|
||
run: |
|
||
set -u
|
||
ok=0
|
||
for i in 1 2 3; do
|
||
if bun install --frozen-lockfile; then ok=1; break; fi
|
||
echo "::warning::dependency install attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
|
||
sleep 5
|
||
done
|
||
[ "$ok" = "1" ] || { echo "::error::dependency install failed after 3 attempts" >&2; exit 1; }
|
||
|
||
# No explicit save step: caches marked by the restore steps are uploaded automatically at job end.
|
||
|
||
- name: Build
|
||
run: npm run build
|
||
|
||
- name: Unit tests
|
||
run: npx vitest run
|
||
|
||
# Browsers run locally in CI (PW_REMOTE_BROWSER=0 below): the shared remote browser
|
||
# server at 192.168.1.4 cannot reach a stack inside dind, and local chromium keeps
|
||
# the job self-contained.
|
||
# Browser binaries (~187 MiB) cached across runs: the runner's uplink is flaky and
|
||
# cdn.playwright.dev downloads time out mid-transfer; once seeded, installs skip the download.
|
||
- name: Restore browser cache
|
||
uses: actions/cache@v4
|
||
continue-on-error: true
|
||
with:
|
||
path: $HOME/.cache/ms-playwright
|
||
key: ${{ runner.os }}-pw-browsers-${{ hashFiles('package.json') }}
|
||
|
||
# Retried: cdn.playwright.dev is flaky from this runner — Playwright's internal 5-retry
|
||
# window (~40-90s) is often not enough, but runs get through with a longer one. Progress
|
||
# accumulates across attempts: playwright skips already-installed browsers.
|
||
- name: Install browsers (local)
|
||
run: |
|
||
set -u
|
||
ok=0
|
||
for i in 1 2 3 4 5 6; do
|
||
if npx playwright install --with-deps chromium; then ok=1; break; fi
|
||
echo "::warning::browser install attempt $i/6 failed (flaky cdn.playwright.dev) — retrying in 5s" >&2
|
||
sleep 5
|
||
done
|
||
[ "$ok" = "1" ] || { echo "::error::browser install failed after 6 attempts" >&2; exit 1; }
|
||
|
||
# Cache the base image on the shared daemon up front: a single loud failure here
|
||
# beats a 6-minute BuildKit "failed to solve" when the daemon's outbound net is down.
|
||
- name: Pull e2e base image
|
||
run: docker pull node:22-slim
|
||
|
||
# Pre-build the e2e image with retries (flaky runner network); the E2E step's own
|
||
# build then becomes a fast no-op. Plain progress keeps BuildKit output visible.
|
||
- name: Build e2e image (retries)
|
||
run: |
|
||
set -u
|
||
ok=0
|
||
for i in 1 2 3; do
|
||
if docker compose -f docker-compose.ci.yml -p space-wanderer-ci build --progress=plain; then ok=1; break; fi
|
||
echo "::warning::e2e image build attempt $i/3 failed (likely transient network) — retrying in 5s" >&2
|
||
sleep 5
|
||
done
|
||
[ "$ok" = "1" ] || { echo "::error::e2e image build failed after 3 attempts" >&2; exit 1; }
|
||
|
||
# E2E against an isolated stack on the shared daemon — never the production instance.
|
||
# docker-compose.ci.yml joins the space-wanderer-ci-e2e network prepared above; project name
|
||
# space-wanderer-ci keeps it distinct from production. E2E_DEPLOY_CMD makes the config's
|
||
# webServer block deploy + wait for readiness (http://app:3000 via service DNS);
|
||
# E2E_COMPOSE_ARGS points state.spec.ts' mid-run `docker compose restart space-wanderer` at
|
||
# the same file + project. E2E_BASE_URL comes from GITHUB_ENV (Prepare e2e network).
|
||
- name: E2E (isolated stack in dind)
|
||
env:
|
||
PW_REMOTE_BROWSER: "0"
|
||
# Build separately with plain progress so BuildKit step output is visible in the
|
||
# job log (auto progress hides it). Playwright's webServer needs a long-running
|
||
# command — `up -d` returns immediately and triggers "exited early"; `logs -f`
|
||
# keeps it alive, streams app logs into CI output for debugging, and is killed with
|
||
# the job (an orphaned `logs -f` dies on its own when cleanup removes the container).
|
||
E2E_DEPLOY_CMD: "docker compose -f docker-compose.ci.yml -p space-wanderer-ci build --progress=plain && docker compose -f docker-compose.ci.yml -p space-wanderer-ci up -d && docker compose -f docker-compose.ci.yml -p space-wanderer-ci logs -f"
|
||
E2E_COMPOSE_ARGS: "-f docker-compose.ci.yml -p space-wanderer-ci"
|
||
# Chromium honors proxy env vars on Linux (node-side HTTP does not) — keep the
|
||
# in-network app host out of any proxy path.
|
||
NO_PROXY: app,localhost,127.0.0.1,.kkhost.pl
|
||
no_proxy: app,localhost,127.0.0.1,.kkhost.pl
|
||
# Machine-readable e2e results for the job-summary step below (Playwright's built-in
|
||
# json reporter; without this env var it would dump to stdout). test-results/ is git-ignored.
|
||
PLAYWRIGHT_JSON_OUTPUT_FILE: test-results/e2e.json
|
||
# Connectivity diagnostics now run post-deploy in e2e/ci-diagnostics.ts (globalSetup).
|
||
# --reporter=list prints each test as it completes (name + ✓/× + duration) for progress
|
||
# visibility in the job log; failure error context/snapshots are unchanged. The json
|
||
# reporter adds a machine-readable report (PLAYWRIGHT_JSON_OUTPUT_FILE above) — no
|
||
# execution behavior changes, reporters only observe.
|
||
run: npx playwright test --reporter=list,json
|
||
|
||
# Appends e2e results to the job-summary panel — mirrors how unit tests get there
|
||
# (vitest's built-in github-actions reporter auto-appends $GITHUB_STEP_SUMMARY in CI).
|
||
# if: always() so a FAILED suite still gets summarized; non-fatal by design — a missing
|
||
# or malformed report must never mask the real e2e exit code. The script is single-quoted
|
||
# for bash, so it contains no apostrophes.
|
||
- name: E2E job summary
|
||
if: always()
|
||
run: |
|
||
node -e '
|
||
const fs = require("fs");
|
||
let report;
|
||
try {
|
||
report = JSON.parse(fs.readFileSync("test-results/e2e.json", "utf8"));
|
||
} catch {
|
||
process.exit(0); // e2e never ran (earlier step failed) or no report — nothing to summarize
|
||
}
|
||
let passed = 0, skipped = 0;
|
||
const failed = [];
|
||
const walk = (suite) => {
|
||
for (const spec of suite.specs ?? []) {
|
||
if (!spec.ok) failed.push(`${suite.title} › ${spec.title}`);
|
||
else if ((spec.tests ?? []).length && spec.tests.every((t) => t.expectedStatus === "skipped")) skipped++;
|
||
else passed++;
|
||
}
|
||
for (const sub of suite.suites ?? []) walk(sub);
|
||
};
|
||
for (const s of report.suites ?? []) walk(s);
|
||
const lines = [
|
||
"", "## E2E results", "",
|
||
`- Passed: ${passed}`,
|
||
`- Failed: ${failed.length}`,
|
||
`- Skipped: ${skipped}`,
|
||
];
|
||
if (failed.length) {
|
||
lines.push("", "### Failed specs");
|
||
for (const f of failed) lines.push(`- \`${f}\``);
|
||
}
|
||
const summaryFile = process.env.GITHUB_STEP_SUMMARY;
|
||
if (summaryFile) fs.appendFileSync(summaryFile, lines.join("\n") + "\n");
|
||
' || true
|
||
|
||
# The daemon is shared with production — never leave our stack or network behind.
|
||
# -v drops the named DB volume so every run seeds fresh (no schema drift between PRs).
|
||
- name: Cleanup e2e stack + network
|
||
if: always()
|
||
run: |
|
||
docker compose -f docker-compose.ci.yml -p space-wanderer-ci down --remove-orphans -v || true
|
||
docker network remove space-wanderer-ci-e2e 2>/dev/null || true
|
||
|
||
# The shared runner dind still accumulates between runs what the steps above can't reach:
|
||
# dangling images/layers from the per-run space-wanderer-ci rebuilds, BuildKit cache, and job
|
||
# containers leaked by interrupted runs. Prune them here (after stack + network cleanup).
|
||
# Deliberately NO --volumes: the daemon is shared with production and named volumes may hold
|
||
# other workflows' persistent data — this project's own space-wanderer-ci_space-wanderer-db volume is already
|
||
# dropped by the steps above. Non-fatal so a prune failure can never mask or break the run.
|
||
- name: Prune runner dind leftovers
|
||
if: always()
|
||
run: docker system prune -af || echo "::warning::dind prune failed — see logs"
|