# Publishing / Releases # # Trigger: push to main — i.e. when any PR merges — EXCEPT pushes whose changed # files are confined to .gitea/** (CI/workflow edits) and/or .planning/** (GSD # planning docs, which push straight to main under the unprotected .planning/* # branch-protection pattern). Those never alter the shipped image (.dockerignore # already excludes .planning), so the paths-ignore filter below skips a wasted # build + re-push. A push that also touches code/Dockerfile/manifests still publishes. # Image: git.bergerhouse.net/luckberg/familysync-api # Tags: # :latest — moving pointer for easy pulls # :- — immutable, rollback-traceable (e.g. v1.1-98acff8) # # Required secret: REGISTRY_PAT — a Gitea Actions secret holding a PAT with write:package scope. # Named REGISTRY_PAT (not GITEA_*): Gitea reserves the GITEA_ prefix for secret names, so # GITEA_-prefixed names cannot be created. GITEA_TOKEN / GITHUB_TOKEN cannot push packages. # # Safety gate: branch protection on main, NOT a needs: dependency in this file. # The PR test jobs (fast-checks, api, harness, gate in ci.yml) run on pull_request — they # never run in the same workflow invocation as publish.yml. Tests gate the PR; main is # trusted to be green because direct push and force push are blocked and the two required # checks (CI / fast-checks, CI / gate) must pass before merge. CI / api and CI / harness # are conditionally skipped on doc-only PRs and are gated via the always-running CI / gate # aggregate rather than being required directly. # # To bump the milestone tag at a milestone boundary: edit MILESTONE below. name: Publish on: push: branches: [main] # Doc/CI-only pushes produce a byte-identical image — skip the build entirely. # paths-ignore skips the run only when EVERY changed file matches; a mixed # push (code + .planning) still publishes. paths-ignore: - '.gitea/**' - '.planning/**' env: MILESTONE: v1.1 jobs: publish: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 # Compute both image tags per D-04: # :latest — moving pointer for easy pulls # :- — immutable, rollback-traceable (e.g. v1.1-4303a1b) # GITHUB_SHA is confirmed available in Gitea Actions (probe P-13). # MILESTONE is read from the workflow-level env var (set to v1.1 above) — update at milestone boundaries. - name: Compute image tags id: tags run: | set -euo pipefail # Fail closed if GITHUB_SHA is empty/unset (Gitea runner env parity is not # guaranteed across versions). Without this guard SHORT_SHA degrades to "" # and the immutable tag silently becomes :v1.1- — a valid-but-wrong tag that # overwrites the milestone pointer and destroys rollback traceability (WR-03). : "${GITHUB_SHA:?GITHUB_SHA is empty — refusing to build a malformed image tag}" SHORT_SHA=${GITHUB_SHA:0:7} MILESTONE="${{ env.MILESTONE }}" echo "latest=git.bergerhouse.net/luckberg/familysync-api:latest" >> $GITHUB_OUTPUT echo "sha_tag=git.bergerhouse.net/luckberg/familysync-api:${MILESTONE}-${SHORT_SHA}" >> $GITHUB_OUTPUT # Pitfall 13 (load-bearing security step): PAT piped via stdin — never via -p/--password. # GITEA_TOKEN/GITHUB_TOKEN cannot push packages; a PAT with write:package scope is required # (confirmed: Gitea forum + registry docs). Token is masked by Gitea's secret-log scrubber # and never echoed elsewhere or set as a plain env var. # Secret is named REGISTRY_PAT (not GITEA_REGISTRY_PAT): Gitea reserves the GITEA_ prefix # for secret names, so the GITEA_-prefixed name cannot be created. - name: Docker login # Bind the secret through env: so it is never substituted into the rendered # script body. Read it as $REGISTRY_PAT and pipe with printf '%s' (echo is not # safe for arbitrary strings — a trailing newline or shell-significant char # would mangle the password into a confusing `unauthorized`) (WR-05). env: REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }} run: | set -euo pipefail printf '%s' "$REGISTRY_PAT" | \ docker login git.bergerhouse.net \ --username luckberg \ --password-stdin # Build from REPO ROOT (T-08-10): the Dockerfile copies the pnpm workspace manifest + # lockfile from the root context; building from apps/api/ would fail to find them. - name: Build production image # DOCKER_BUILDKIT=1 is required: the Dockerfile uses `RUN --mount=type=cache` # (BuildKit) to persist the pnpm store across builds. The legacy builder would # fail on that syntax. BuildKit is default on Docker 23+, set explicitly for safety. env: DOCKER_BUILDKIT: '1' run: | set -euo pipefail docker build --target production \ -f apps/api/Dockerfile \ -t ${{ steps.tags.outputs.latest }} \ -t ${{ steps.tags.outputs.sha_tag }} \ . # ── D-10 image hygiene assertions — run AFTER build, BEFORE push ─────────── # A failure here stops the job before any push, so a regressed image can # never be published (T-16-18 / T-16-19 / T-16-20). - name: Image hygiene — static assertions run: | set -euo pipefail # Assert .dockerignore exists if [ ! -f ".dockerignore" ]; then echo "FAIL: .dockerignore does not exist" exit 1 fi # Assert every forbidden pattern is an ACTIVE ignore rule (WR-05). # Strip comment lines first, then fixed-string match so a commented-out # "# .env was here" can't satisfy the check and "$pattern" is never # treated as a regex (e.g. ".env" matching "denv"). for pattern in ".env" "node_modules" "apps/api/scripts" ".git" \ ".planning" "apps/api/tests" "apps/pwa/e2e"; do if ! grep -v '^[[:space:]]*#' .dockerignore | grep -qF "$pattern"; then echo "FAIL: .dockerignore missing active rule: $pattern" exit 1 fi done # Assert this workflow still pins --target production (D-10 / T-16-19) if ! grep -q "\-\-target production" .gitea/workflows/publish.yml; then echo "FAIL: publish.yml does not build --target production" exit 1 fi echo "Static image hygiene assertions PASSED." # Boot-smoke: run the freshly-built production image with the forbidden # NODE_ENV=production + DEV_AUTH_BYPASS=true combo and assert it refuses to # boot — proving the D-08 guard (assertNotDevBypassInProduction) fires in # the ACTUAL shipped image (T-16-18 / T-16-21). # EXIT==0 → image started → guard NOT working → FAIL # EXIT==124 → timeout (15s) → guard not firing → FAIL # Any other non-zero exit → image refused boot → PASS - name: Image hygiene — boot-smoke (must refuse dev-bypass in production) run: | set -euo pipefail IMAGE="${{ steps.tags.outputs.sha_tag }}" # WR-02: capture docker's exit code DIRECTLY, not a pipeline exit. Piping # through `head -20` would let a chatty-but-booting regressed image emit # 20 lines, SIGPIPE docker (exit 141), and false-PASS. Capture all output # to a variable, then print a bounded slice for the log. set +e OUT=$(timeout 15 docker run --rm \ --env NODE_ENV=production \ --env DEV_AUTH_BYPASS=true \ "$IMAGE" 2>&1) EXIT=$? set -e echo "$OUT" | head -20 # 0 (clean start) and 124 (timeout) both mean the guard did NOT refuse boot. if [ "$EXIT" -eq 0 ] || [ "$EXIT" -eq 124 ]; then echo "FAIL: Production image did not refuse DEV_AUTH_BYPASS=true (exit $EXIT)" exit 1 fi # Belt-and-suspenders: require the FATAL guard marker, so a refusal for # some UNRELATED reason cannot masquerade as the guard working. if ! echo "$OUT" | grep -q "DEV_AUTH_BYPASS=true is set in a production environment"; then echo "FAIL: image refused boot (exit $EXIT) but NOT via the expected D-08 guard" exit 1 fi echo "PASS: Production image refused to start with DEV_AUTH_BYPASS=true (exit $EXIT)" # Push the IMMUTABLE :- tag FIRST. set -euo pipefail stops on # the first failed push, so :latest is only moved after the immutable, # rollback-traceable tag has landed — a failed second push can never leave # :latest advanced without a corresponding rollback tag (WR-04). - name: Push image run: | set -euo pipefail docker push ${{ steps.tags.outputs.sha_tag }} # immutable first (WR-04) docker push ${{ steps.tags.outputs.latest }} # move pointer only after immutable lands # Always drop the stored credential from the runner after push (defence in depth). - name: Docker logout if: always() run: docker logout git.bergerhouse.net || true