fix(deploy): close container final review

2026-07-12 00:44:39 +02:00
parent 0ca6346f75
commit a3a266fd81
30 changed files with 526 additions and 37 deletions
@@ -0,0 +1,50 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+
+platform=${PLATFORM:-linux/arm64}
+slug=$(printf '%s' "$platform" | tr '/:' '--')
+core_image="thothii-core:verify-$slug"
+frontend_image="thothii-frontend:verify-$slug"
+inventory_dir=${CONTAINER_INVENTORY_DIR:-.artifacts/container-images/$slug}
+
+mkdir -p "$inventory_dir"
+
+docker buildx build --platform "$platform" --load \
+  -f docker/core.Dockerfile -t "$core_image" .
+docker buildx build --platform "$platform" --load \
+  -f docker/frontend.Dockerfile -t "$frontend_image" .
+
+docker run --rm --platform "$platform" --entrypoint /app/docker/smoke/core-smoke.sh \
+  "$core_image"
+docker run --rm --platform "$platform" -e BACKEND_BASE_URL=/api \
+  "$frontend_image" frontend-config-smoke
+docker run --rm --platform "$platform" -e BACKEND_BASE_URL= \
+  "$frontend_image" frontend-config-smoke
+
+if docker run --rm --platform "$platform" -e BACKEND_BASE_URL=/backend \
+    "$frontend_image" frontend-config-smoke >/dev/null 2>&1; then
+  echo "frontend accepted an unsupported BACKEND_BASE_URL" >&2
+  exit 1
+fi
+if docker run --rm --platform "$platform" -e THOTH_PUBLIC_EXPOSURE=true -e AUTH_MODE=none \
+    "$core_image" server >/dev/null 2>&1; then
+  echo "core accepted public exposure without upstream authentication" >&2
+  exit 1
+fi
+
+docker image inspect "$core_image" >"$inventory_dir/core-image-inspect.json"
+docker image inspect "$frontend_image" >"$inventory_dir/frontend-image-inspect.json"
+docker run --rm --platform "$platform" --entrypoint sh "$core_image" -c \
+  'dpkg-query -W; /opt/venv/bin/pip freeze; /opt/venv/bin/python -c '"'"'import glob,json; rows=set();
+for path in glob.glob("/app/backend/node_modules/**/package.json", recursive=True):
+    try:
+        package=json.load(open(path)); rows.add((package.get("name","?"), package.get("version","?")))
+    except (OSError, ValueError): pass
+print("\n".join(f"{name}=={version}" for name,version in sorted(rows)))'"'"'' \
+  >"$inventory_dir/core-packages.txt"
+docker run --rm --platform "$platform" --entrypoint sh "$frontend_image" -c 'apk info -vv' \
+  >"$inventory_dir/frontend-packages.txt"
+
+echo "container verification and inventory complete for $platform"