ee3e3a5cfc
The live checkout sat on feat/bcda-v3, so everything merged to main
today (UI fixes, Traefik theme change) only reached the running
services by hand-copied files. It now tracks main; this brings the
branch's 18 commits (BCDA v3 client, crosswalk-driven flatteners,
vendored upstream, institutional provider universe, sandbox notebook)
along with it.
Conflicts:
- .gitea/workflows/{harden,rebuild-all}.yml: regenerated with
gen_config.py from the merged stack.toml + backends/gitea.py — bcda
joins the per-image build → scan → push Harden job, pinned trivy/crane.
- tests/dev/test_gen_config_deploy.py: both sides fixed the GIT_* env
leak; kept main's shared _clean_env() (also used by the detector run).
- uv.lock auto-merged; `uv lock --locked` passes, a relock changes no
version, and trivy finds 0 vulnerabilities in the merged lock.
Two bcda tests needed fixing on the merged tree:
- test_completed_jobs used dated fixtures against completed_jobs()'s
default 24 h window, so it failed a day after it was written; it
now asks for max_age_hours=None (it tests ordering + version filter).
- test_ui_metrics matched whole Prometheus lines; the OTel exporter
(0.66, from the CVE bump) adds otel_scope_* labels to every series,
so it now matches on the labels the stack owns.
Full suite on the merged tree: 15,856 passed before those two fixes;
tests/bcda 426/426 after.
500 lines
19 KiB
YAML
500 lines
19 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Deploy
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
changes:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
notebooks: ${{ steps.filter.outputs.notebooks }}
|
|
zotero: ${{ steps.filter.outputs.zotero }}
|
|
docs: ${{ steps.filter.outputs.docs }}
|
|
api: ${{ steps.filter.outputs.api }}
|
|
bcda: ${{ steps.filter.outputs.bcda }}
|
|
llm: ${{ steps.filter.outputs.llm }}
|
|
mc: ${{ steps.filter.outputs.mc }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Detect changed paths
|
|
id: filter
|
|
env:
|
|
BEFORE: ${{ github.event.before }}
|
|
run: |
|
|
# `github.event.head_commit.modified` only describes the tip commit
|
|
# and is empty for merge commits, so a PR merged with a merge commit
|
|
# never matched any path filter. Diff the pushed range instead:
|
|
# the branch tip before the push against the new one. When that
|
|
# previous tip is unknown or unfetchable (first push, history
|
|
# rewrite) build everything rather than nothing.
|
|
changed=__all__
|
|
if [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ] \
|
|
&& git fetch --quiet --depth=1 origin "$BEFORE"; then
|
|
changed="$(git diff --name-only "$BEFORE" "$GITHUB_SHA")" || changed=__all__
|
|
fi
|
|
echo "changed since $BEFORE:"
|
|
printf '%s\n' "$changed"
|
|
match() {
|
|
name="$1"; shift
|
|
hit=false
|
|
if [ "$changed" = __all__ ]; then
|
|
hit=true
|
|
else
|
|
while IFS= read -r f; do
|
|
[ -n "$f" ] || continue
|
|
for g in "$@"; do
|
|
case "$f" in $g) hit=true ;; esac
|
|
done
|
|
done <<< "$changed"
|
|
fi
|
|
echo "$name=$hit" >> "$GITHUB_OUTPUT"
|
|
echo "$name: $hit"
|
|
}
|
|
match notebooks 'notebooks/*' 'infra/marimo/*' 'infra/images/notebooks.Dockerfile'
|
|
match zotero 'infra/images/zotero.Dockerfile' 'infra/images/zotero/*'
|
|
match docs 'docs/*' 'infra/images/docs.Dockerfile'
|
|
match api 'infra/images/api.Dockerfile' 'src/*' 'pyproject.toml'
|
|
match bcda 'infra/images/bcda.Dockerfile' 'infra/images/bcda/*' 'src/*' 'pyproject.toml'
|
|
match llm 'infra/images/llm.Dockerfile' 'src/*' 'pyproject.toml'
|
|
match mc 'infra/rustfs/*' 'infra/images/mc.Dockerfile'
|
|
|
|
notebooks:
|
|
runs-on: ubuntu-latest
|
|
needs: [changes]
|
|
if: needs.changes.outputs.notebooks == 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: |
|
|
cd /tmp
|
|
base=https://github.com/google/go-containerregistry/releases/download/v0.22.1
|
|
tgz=go-containerregistry_Linux_x86_64.tar.gz
|
|
curl -fsSLO "$base/$tgz"
|
|
curl -fsSL "$base/checksums.txt" | grep -F " $tgz" | sha256sum -c -
|
|
tar xzf "$tgz" -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
|
|
|
|
- name: Scan notebooks
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o notebooks-scan.json local/notebooks:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build notebooks
|
|
run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build .
|
|
|
|
- name: Push notebooks
|
|
run: |
|
|
docker save local/notebooks:build -o /tmp/notebooks.tar
|
|
crane push /tmp/notebooks.tar git:3000/homelab/stack/notebooks:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/notebooks.tar git:3000/homelab/stack/notebooks:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "notebooks" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
zotero:
|
|
runs-on: ubuntu-latest
|
|
needs: [changes]
|
|
if: needs.changes.outputs.zotero == 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: |
|
|
cd /tmp
|
|
base=https://github.com/google/go-containerregistry/releases/download/v0.22.1
|
|
tgz=go-containerregistry_Linux_x86_64.tar.gz
|
|
curl -fsSLO "$base/$tgz"
|
|
curl -fsSL "$base/checksums.txt" | grep -F " $tgz" | sha256sum -c -
|
|
tar xzf "$tgz" -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
|
|
|
|
- name: Scan zotero
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o zotero-scan.json local/zotero:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build zotero
|
|
run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build .
|
|
|
|
- name: Push zotero
|
|
run: |
|
|
docker save local/zotero:build -o /tmp/zotero.tar
|
|
crane push /tmp/zotero.tar git:3000/homelab/stack/zotero:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/zotero.tar git:3000/homelab/stack/zotero:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "zotero" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
docs:
|
|
runs-on: ubuntu-latest
|
|
needs: [changes]
|
|
if: needs.changes.outputs.docs == 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: |
|
|
cd /tmp
|
|
base=https://github.com/google/go-containerregistry/releases/download/v0.22.1
|
|
tgz=go-containerregistry_Linux_x86_64.tar.gz
|
|
curl -fsSLO "$base/$tgz"
|
|
curl -fsSL "$base/checksums.txt" | grep -F " $tgz" | sha256sum -c -
|
|
tar xzf "$tgz" -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
|
|
|
|
- name: Scan docs
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o docs-scan.json local/docs:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build docs
|
|
run: docker build -f infra/images/docs.Dockerfile -t local/docs:build .
|
|
|
|
- name: Push docs
|
|
run: |
|
|
docker save local/docs:build -o /tmp/docs.tar
|
|
crane push /tmp/docs.tar git:3000/homelab/stack/docs:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/docs.tar git:3000/homelab/stack/docs:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "docs" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
api:
|
|
runs-on: ubuntu-latest
|
|
needs: [changes]
|
|
if: needs.changes.outputs.api == 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: |
|
|
cd /tmp
|
|
base=https://github.com/google/go-containerregistry/releases/download/v0.22.1
|
|
tgz=go-containerregistry_Linux_x86_64.tar.gz
|
|
curl -fsSLO "$base/$tgz"
|
|
curl -fsSL "$base/checksums.txt" | grep -F " $tgz" | sha256sum -c -
|
|
tar xzf "$tgz" -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
|
|
|
|
- name: Scan api
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o api-scan.json local/api:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build api
|
|
run: docker build -f infra/images/api.Dockerfile -t local/api:build .
|
|
|
|
- name: Push api
|
|
run: |
|
|
docker save local/api:build -o /tmp/api.tar
|
|
crane push /tmp/api.tar git:3000/homelab/stack/api:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/api.tar git:3000/homelab/stack/api:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "api" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
bcda:
|
|
runs-on: ubuntu-latest
|
|
needs: [changes]
|
|
if: needs.changes.outputs.bcda == 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: |
|
|
cd /tmp
|
|
base=https://github.com/google/go-containerregistry/releases/download/v0.22.1
|
|
tgz=go-containerregistry_Linux_x86_64.tar.gz
|
|
curl -fsSLO "$base/$tgz"
|
|
curl -fsSL "$base/checksums.txt" | grep -F " $tgz" | sha256sum -c -
|
|
tar xzf "$tgz" -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
|
|
|
|
- name: Scan bcda
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o bcda-scan.json local/bcda:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build bcda
|
|
run: docker build -f infra/images/bcda.Dockerfile -t local/bcda:build .
|
|
|
|
- name: Push bcda
|
|
run: |
|
|
docker save local/bcda:build -o /tmp/bcda.tar
|
|
crane push /tmp/bcda.tar git:3000/homelab/stack/bcda:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/bcda.tar git:3000/homelab/stack/bcda:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "bcda" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
llm:
|
|
runs-on: ubuntu-latest
|
|
needs: [changes]
|
|
if: needs.changes.outputs.llm == 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: |
|
|
cd /tmp
|
|
base=https://github.com/google/go-containerregistry/releases/download/v0.22.1
|
|
tgz=go-containerregistry_Linux_x86_64.tar.gz
|
|
curl -fsSLO "$base/$tgz"
|
|
curl -fsSL "$base/checksums.txt" | grep -F " $tgz" | sha256sum -c -
|
|
tar xzf "$tgz" -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
|
|
|
|
- name: Scan llm
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o llm-scan.json local/llm:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build llm
|
|
run: docker build -f infra/images/llm.Dockerfile -t local/llm:build .
|
|
|
|
- name: Push llm
|
|
run: |
|
|
docker save local/llm:build -o /tmp/llm.tar
|
|
crane push /tmp/llm.tar git:3000/homelab/stack/llm:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/llm.tar git:3000/homelab/stack/llm:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "llm" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
mc:
|
|
runs-on: ubuntu-latest
|
|
needs: [changes]
|
|
if: needs.changes.outputs.mc == 'true'
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Install crane
|
|
run: |
|
|
cd /tmp
|
|
base=https://github.com/google/go-containerregistry/releases/download/v0.22.1
|
|
tgz=go-containerregistry_Linux_x86_64.tar.gz
|
|
curl -fsSLO "$base/$tgz"
|
|
curl -fsSL "$base/checksums.txt" | grep -F " $tgz" | sha256sum -c -
|
|
tar xzf "$tgz" -C /usr/local/bin crane
|
|
|
|
- name: Log in to registry
|
|
run: crane auth login git:3000 -u "${{ secrets.REGISTRY_USER }}" -p "${{ secrets.REGISTRY_TOKEN }}"
|
|
env:
|
|
CRANE_INSECURE: "true"
|
|
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
|
|
|
|
- name: Scan mc
|
|
run: trivy image --severity HIGH,CRITICAL --exit-code 0 --format json -o mc-scan.json local/mc:build
|
|
|
|
- name: Compute short SHA
|
|
run: echo "SHORT_SHA=$(echo $GITHUB_SHA | head -c 8)" >> "$GITHUB_ENV"
|
|
|
|
- name: Build mc
|
|
run: docker build -f infra/images/mc.Dockerfile -t local/mc:build infra/rustfs/
|
|
|
|
- name: Push mc
|
|
run: |
|
|
docker save local/mc:build -o /tmp/mc.tar
|
|
crane push /tmp/mc.tar git:3000/homelab/stack/mc:${{ env.SHORT_SHA }} --insecure
|
|
crane push /tmp/mc.tar git:3000/homelab/stack/mc:latest --insecure
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "mc" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
report:
|
|
runs-on: ubuntu-latest
|
|
needs: [changes, notebooks, zotero, docs, api, bcda, llm, mc]
|
|
if: always() && !cancelled()
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Set up uv
|
|
run: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
env:
|
|
UV_INSTALL_DIR: /usr/local/bin
|
|
|
|
- name: Report
|
|
# Only file an issue if at least one upstream build job failed.
|
|
# Without this gate api.diag.ci runs unconditionally and files
|
|
# a fake "failed" issue on every successful Deploy run.
|
|
if: contains(needs.*.result, 'failure')
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Deploy" --job "report" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|