Mirror mic-check's Gitea/GitHub CI-CD pipeline for novelly

Dual-engine workflow (.github/workflows/ci.yml, read by both GitHub Actions and Gitea Actions): build, test, coverage badge on every push; on Gitea main pushes only, build+push API/web images to the Gitea registry and redeploy the persistent LAN stack via the shared [self-hosted, qa] runner. Replaces the ad hoc docker-compose.deploy.yml manual workflow with deploy/qa/docker-compose.qa.yml, pulled by CI — data volume preserved across deploys (no -v on down), unlike mic-check's throwaway QA stack.
2026-08-18 18:25:01 -07:00
parent 56e64c6f06
commit 44f722019b
16 changed files with 493 additions and 28 deletions
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Compiles the API (Release) and builds the web SPA. Acts as the compile gate before
+# tests/image builds run.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+
+ensure_dotnet
+
+log "Restoring and publishing Novelly.Api (Release)"
+dotnet publish src/Novelly.Api/Novelly.Api.csproj -c Release
+
+log "Installing web dependencies (npm ci)"
+npm --prefix src/Novelly.Web ci
+
+log "Building the web client (vite build)"
+npm --prefix src/Novelly.Web run build
+
+log "build.sh complete"
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Turns the Cobertura output from test.sh into a badge + summary via reportgenerator,
+# prints it, appends a build-report summary when running under Actions, and refreshes
+# the coverage badge committed at badges/coverage.svg. Readme embeds that badge via a
+# relative path, which resolves on both GitHub and Gitea since the same repo content is
+# pushed to both remotes.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+
+ensure_dotnet
+ensure_reportgenerator
+
+REPORT_DIR="$CI_ROOT/coverage/report"
+
+log "Generating coverage report with reportgenerator"
+reportgenerator \
+  -reports:"coverage/dotnet/coverage.cobertura.xml" \
+  -targetdir:"$REPORT_DIR" \
+  -reporttypes:"Badges;MarkdownSummaryGithub;TextSummary"
+
+cat "$REPORT_DIR/Summary.txt"
+
+if [[ -n "${GITHUB_STEP_SUMMARY:-}" ]]; then
+  cat "$REPORT_DIR/SummaryGithub.md" >> "$GITHUB_STEP_SUMMARY"
+fi
+
+mkdir -p "$CI_ROOT/badges"
+cp "$REPORT_DIR/badge_linecoverage.svg" "$CI_ROOT/badges/coverage.svg"
+
+log "coverage.sh complete"
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Deploys the freshly-pushed :latest images to the persistent LAN novelly stack and
+# waits for the API to report healthy. Unlike a throwaway QA stack, `down` is run
+# without `-v` — the novelly-data volume (the author's actual novel) must survive
+# every redeploy. Recreating containers against an unchanged image is a no-op, so
+# this is safe to re-run.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+image_names
+registry_login
+
+export API_IMAGE WEB_IMAGE
+export ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY:-}"
+export WEB_PORT="${WEB_PORT:-6173}"
+
+COMPOSE="docker compose -f deploy/qa/docker-compose.qa.yml"
+
+log "Pulling latest :latest images"
+$COMPOSE pull
+
+log "Recreating the novelly stack (data volume preserved)"
+$COMPOSE down
+$COMPOSE up -d
+
+log "Waiting for the API health check"
+attempts=30
+until $COMPOSE exec -T api curl -fsS http://localhost:8080/api/health > /dev/null 2>&1; do
+  attempts=$((attempts - 1))
+  if [[ "$attempts" -le 0 ]]; then
+    fail "novelly stack did not become healthy in time"
+  fi
+  sleep 2
+done
+
+log "novelly deployed and healthy at http://localhost:${WEB_PORT}"
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Builds the API and web images and tags them with both the current git sha and
+# "latest" (the tag the deploy compose stack pulls). Both Dockerfiles are already
+# self-contained multi-stage builds (used directly by docker-compose.deploy.yml today),
+# so no separate CI-only Dockerfile variant is needed.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+image_names
+
+log "Building $API_IMAGE:$GIT_SHA / :latest"
+docker build \
+  -f src/Novelly.Api/Dockerfile \
+  -t "$API_IMAGE:$GIT_SHA" \
+  -t "$API_IMAGE:latest" \
+  .
+
+log "Building $WEB_IMAGE:$GIT_SHA / :latest"
+docker build \
+  -f src/Novelly.Web/Dockerfile \
+  -t "$WEB_IMAGE:$GIT_SHA" \
+  -t "$WEB_IMAGE:latest" \
+  src/Novelly.Web
+
+log "docker-build.sh complete"
@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Pushes the images built by docker-build.sh (git-sha and latest tags) to the Gitea
+# container registry.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+image_names
+registry_login
+
+for tag in "$GIT_SHA" latest; do
+  log "Pushing $API_IMAGE:$tag"
+  docker push "$API_IMAGE:$tag"
+  log "Pushing $WEB_IMAGE:$tag"
+  docker push "$WEB_IMAGE:$tag"
+done
+
+log "docker-push.sh complete"
@@ -25,6 +25,10 @@ DOTNET_CHANNEL="${DOTNET_CHANNEL:-10.0}"
 # one as a last resort, so a bare runner behaves the same as a dev machine.
 ensure_dotnet() {
  if command -v dotnet > /dev/null 2>&1; then
+    # DOTNET_ROOT is unset by default even when dotnet is already on PATH (e.g. a
+    # per-user install at ~/.dotnet) — apphost binaries like reportgenerator's fail to
+    # find the runtime without it.
+    export DOTNET_ROOT="${DOTNET_ROOT:-$(dirname "$(command -v dotnet)")}"
    return 0
  fi

@@ -51,3 +55,45 @@ ensure_dotnet() {
 ensure_node() {
  command -v npm > /dev/null 2>&1 || fail "npm not found on PATH; install Node.js to build the web client"
 }
+
+ensure_reportgenerator() {
+  if command -v reportgenerator > /dev/null 2>&1; then
+    return 0
+  fi
+
+  local tool_dir="$CI_ROOT/.dotnet-tools"
+  if [[ ! -x "$tool_dir/reportgenerator" ]]; then
+    log "reportgenerator not found on PATH; installing dotnet-reportgenerator-globaltool"
+    dotnet tool install dotnet-reportgenerator-globaltool --tool-path "$tool_dir"
+  fi
+  export PATH="$tool_dir:$PATH"
+}
+
+# Registry configuration. All values come from the environment (CI secrets or a
+# developer's shell) — nothing is hardcoded, per project convention.
+REGISTRY="${REGISTRY:-}"
+REGISTRY_OWNER="${REGISTRY_OWNER:-}"
+REGISTRY_USER="${REGISTRY_USER:-}"
+REGISTRY_TOKEN="${REGISTRY_TOKEN:-}"
+
+GIT_SHA="$(git -C "$CI_ROOT" rev-parse --short HEAD)"
+
+require_registry_vars() {
+  [[ -n "$REGISTRY" ]] || fail "REGISTRY env var is required (e.g. git.wampler.us)"
+  [[ -n "$REGISTRY_OWNER" ]] || fail "REGISTRY_OWNER env var is required (e.g. your gitea org/user)"
+}
+
+# Populates API_IMAGE / WEB_IMAGE, e.g. git.wampler.us/wamplerj/novelly-api
+image_names() {
+  require_registry_vars
+  API_IMAGE="$REGISTRY/$REGISTRY_OWNER/novelly-api"
+  WEB_IMAGE="$REGISTRY/$REGISTRY_OWNER/novelly-web"
+}
+
+registry_login() {
+  require_registry_vars
+  [[ -n "$REGISTRY_USER" ]] || fail "REGISTRY_USER env var is required to push images"
+  [[ -n "$REGISTRY_TOKEN" ]] || fail "REGISTRY_TOKEN env var is required to push images"
+  log "Logging in to $REGISTRY as $REGISTRY_USER"
+  echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin
+}
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Commits the coverage badge refreshed by coverage.sh straight back to the
+# branch that triggered this run, so readme.md's relative badges/coverage.svg
+# link stays current. GITHUB_SERVER_URL/GITHUB_REPOSITORY/GITHUB_REF_NAME are
+# default context env vars on both GitHub Actions and Gitea Actions (Gitea's
+# engine is GitHub-Actions-compatible); GITHUB_TOKEN must be passed in
+# explicitly from the workflow (${{ github.token }}) on both platforms.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+
+[[ -n "${GITHUB_TOKEN:-}" ]] || fail "GITHUB_TOKEN env var is required to push the badge commit"
+[[ -n "${GITHUB_SERVER_URL:-}" ]] || fail "GITHUB_SERVER_URL env var is required to push the badge commit"
+[[ -n "${GITHUB_REPOSITORY:-}" ]] || fail "GITHUB_REPOSITORY env var is required to push the badge commit"
+[[ -n "${GITHUB_REF_NAME:-}" ]] || fail "GITHUB_REF_NAME env var is required to push the badge commit"
+
+if git diff --quiet -- badges/coverage.svg; then
+  log "badges/coverage.svg unchanged; nothing to publish"
+  exit 0
+fi
+
+git config user.name "novelly-ci"
+git config user.email "ci@novelly.local"
+git add badges/coverage.svg
+git commit -m "chore: refresh coverage badge [skip ci]"
+
+remote_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+git -c http.extraheader="AUTHORIZATION: bearer ${GITHUB_TOKEN}" push "$remote_url" "HEAD:${GITHUB_REF_NAME}"
+
+log "publish-coverage-badge.sh complete"
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Runs Novelly.Api.Tests with coverage collection. No web test suite exists yet
+# (src/Novelly.Web/package.json has no "test" script) — nothing to run there.
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")" && source ./lib.sh
+cd "$CI_ROOT"
+
+ensure_dotnet
+
+# Coverlet doesn't clear prior output — on a runner that reuses its workspace
+# (self-hosted, unlike GitHub's ephemeral ones), stale coverage from past runs would
+# otherwise get merged in by coverage.sh and silently skew the combined percentage.
+rm -rf "$CI_ROOT/coverage/dotnet"
+
+log "Running Novelly.Api.Tests"
+dotnet test tests/Novelly.Api.Tests/Novelly.Api.Tests.csproj -c Release --logger trx \
+  /p:CollectCoverage=true /p:CoverletOutputFormat=cobertura \
+  /p:CoverletOutput="$CI_ROOT/coverage/dotnet/" \
+  /p:Exclude="[Novelly.ServiceDefaults]*" \
+  /p:ExcludeByFile="**/Data/Migrations/*.cs"
+
+log "test.sh complete"