test: gate unified compose deployment

2026-08-05 13:41:33 +02:00
parent b44a1b9ad9
commit 2ae89c075e
6 changed files with 1313 additions and 0 deletions
@@ -0,0 +1,98 @@
+name: Deployment release gate
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: deployment-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deterministic:
+    name: LF, Compose, docs, and TypeScript
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24.16.0"
+          package-manager-cache: false
+      - name: Verify shell syntax and LF policy
+        run: |
+          git ls-files -z '*.sh' | xargs -0 -n1 bash -n
+          bash scripts/verify-line-endings.sh
+      - name: Verify Compose and installation contracts
+        run: |
+          bash scripts/test-unified-compose.sh
+          bash scripts/test-compose-secret-policy.sh
+          bash scripts/test-no-deployment-coupling.sh
+          bash scripts/test-verify-workspace-install-docs.sh
+          bash scripts/unified-deployment-smoke.sh --self-test
+          git diff --check
+      - name: Install backend dependencies
+        working-directory: backend
+        run: npm ci
+      - name: Test and type-check backend
+        working-directory: backend
+        run: |
+          npx vitest run
+          npx tsc --noEmit -p .
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci
+      - name: Test and type-check frontend
+        working-directory: frontend
+        run: |
+          npx vitest run
+          npx tsc -b
+
+  linux-docker:
+    name: Linux Docker deployment and rollback
+    runs-on: ubuntu-24.04
+    timeout-minutes: 70
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Run unified deployment smoke
+        run: timeout --signal=TERM --kill-after=45s 30m bash scripts/unified-deployment-smoke.sh
+      - name: Run thothctl update smoke
+        run: timeout --signal=TERM --kill-after=45s 30m bash scripts/thothctl-update-smoke.sh
+
+  windows-clone:
+    name: Windows clone and Compose contract
+    runs-on: windows-2025
+    timeout-minutes: 20
+    steps:
+      - name: Check out source
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: "1.26.5"
+          cache-dependency-path: tools/thothctl/go.sum
+      - name: Build native Windows thothctl
+        working-directory: tools/thothctl
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path ../../dist/thothctl | Out-Null
+          go build -trimpath -o ../../dist/thothctl/thothctl-windows-amd64.exe ./cmd/thothctl
+      - name: Verify Windows clone contract
+        shell: pwsh
+        run: >-
+          ./scripts/test-windows-clone-contract.ps1
+          -ThothctlPath "$PWD/dist/thothctl/thothctl-windows-amd64.exe"