191121b542
Some checks failed
CI / test (push) Failing after 2m35s
CI / notebooks-smoke (push) Successful in 1m34s
Infra CI / zotero (push) Successful in 16s
Infra CI / api (push) Successful in 17s
Infra CI / mc (push) Failing after 32s
Infra CI / docs (push) Successful in 18s
Infra CI / notebooks (push) Successful in 56s
Infra CI / llm (push) Successful in 19s
CI / lint (pull_request) Successful in 35s
Infra CI / bcda (push) Successful in 1m37s
CI / notebooks-smoke (pull_request) Successful in 3m6s
CI / test (pull_request) Failing after 4m52s
Infra CI / zotero (pull_request) Successful in 20s
Infra CI / docs (pull_request) Successful in 21s
Infra CI / api (pull_request) Successful in 19s
Infra CI / mc (pull_request) Failing after 39s
Infra CI / notebooks (pull_request) Successful in 1m18s
Infra CI / bcda (pull_request) Successful in 18s
Infra CI / llm (pull_request) Successful in 17s
CI / lint (push) Successful in 35s
infra/images/bcda.Dockerfile follows api.Dockerfile (uv base, patched packages, curl for the healthcheck) with `uv sync --extra cli --extra bcda`; Streamlit's server settings live in infra/images/bcda/ streamlit.toml (headless, 0.0.0.0:8501, no usage stats, no file watcher); health is /_stcore/health. The compose service `bcda` sits on the gateway network, mounts ./data read-write (exports, aco.duckdb, replica publish) and ./dev read-only (vendored upstream, crosswalk seeds, vendor script), and takes BCDA_CLIENT_ID / BCDA_CLIENT_SECRET / BCDA_BASE_URL from .env with the public sandbox credentials as the default. Routed at bcda.<domain> behind git-sso with secure-headers, tiled on the dashboard, and added to [platform].subdomains (CoreDNS hosts and the SSO cert list follow) and [images] (deploy.yml builds, scans and pushes it on src/**, pyproject.toml or image-file changes; harden/rebuild-all/infra-ci regenerated accordingly). Built locally (2.15 GB), /_stcore/health -> ok, root -> 200; brought up on the host with compose. refs #1139
284 lines
9.2 KiB
YAML
284 lines
9.2 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Infra CI
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- 'notebooks/**'
|
|
- 'infra/marimo/**'
|
|
- 'infra/images/notebooks.Dockerfile'
|
|
- 'infra/images/zotero.Dockerfile'
|
|
- 'infra/images/zotero/**'
|
|
- 'docs/**'
|
|
- 'infra/images/docs.Dockerfile'
|
|
- 'infra/images/api.Dockerfile'
|
|
- 'src/**'
|
|
- 'pyproject.toml'
|
|
- 'infra/images/bcda.Dockerfile'
|
|
- 'infra/images/bcda/**'
|
|
- 'src/**'
|
|
- 'pyproject.toml'
|
|
- 'infra/images/llm.Dockerfile'
|
|
- 'src/**'
|
|
- 'pyproject.toml'
|
|
- 'infra/rustfs/**'
|
|
- 'infra/images/mc.Dockerfile'
|
|
pull_request:
|
|
paths:
|
|
- 'notebooks/**'
|
|
- 'infra/marimo/**'
|
|
- 'infra/images/notebooks.Dockerfile'
|
|
- 'infra/images/zotero.Dockerfile'
|
|
- 'infra/images/zotero/**'
|
|
- 'docs/**'
|
|
- 'infra/images/docs.Dockerfile'
|
|
- 'infra/images/api.Dockerfile'
|
|
- 'src/**'
|
|
- 'pyproject.toml'
|
|
- 'infra/images/bcda.Dockerfile'
|
|
- 'infra/images/bcda/**'
|
|
- 'src/**'
|
|
- 'pyproject.toml'
|
|
- 'infra/images/llm.Dockerfile'
|
|
- 'src/**'
|
|
- 'pyproject.toml'
|
|
- 'infra/rustfs/**'
|
|
- 'infra/images/mc.Dockerfile'
|
|
|
|
jobs:
|
|
notebooks:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Hadolint notebooks
|
|
uses: https://github.com/hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: infra/images/notebooks.Dockerfile
|
|
|
|
|
|
|
|
- name: Build notebooks
|
|
run: docker build -f infra/images/notebooks.Dockerfile -t local/notebooks:build .
|
|
|
|
- name: Frontend smoke gate
|
|
run: python3 dev/scripts/nb_fe_smoke.py --image local/notebooks:build --network ci
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Infra CI" --job "notebooks" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
zotero:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Hadolint zotero
|
|
uses: https://github.com/hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: infra/images/zotero.Dockerfile
|
|
|
|
|
|
|
|
- name: Build zotero
|
|
run: docker build -f infra/images/zotero.Dockerfile -t local/zotero:build .
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Infra CI" --job "zotero" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
docs:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Hadolint docs
|
|
uses: https://github.com/hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: infra/images/docs.Dockerfile
|
|
|
|
|
|
|
|
- name: Build docs
|
|
run: docker build -f infra/images/docs.Dockerfile -t local/docs:build .
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Infra CI" --job "docs" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
api:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Hadolint api
|
|
uses: https://github.com/hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: infra/images/api.Dockerfile
|
|
|
|
|
|
|
|
- name: Build api
|
|
run: docker build -f infra/images/api.Dockerfile -t local/api:build .
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Infra CI" --job "api" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
bcda:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Hadolint bcda
|
|
uses: https://github.com/hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: infra/images/bcda.Dockerfile
|
|
|
|
|
|
|
|
- name: Build bcda
|
|
run: docker build -f infra/images/bcda.Dockerfile -t local/bcda:build .
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Infra CI" --job "bcda" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
llm:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Hadolint llm
|
|
uses: https://github.com/hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: infra/images/llm.Dockerfile
|
|
|
|
|
|
|
|
- name: Build llm
|
|
run: docker build -f infra/images/llm.Dockerfile -t local/llm:build .
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Infra CI" --job "llm" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|
|
|
|
mc:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Hadolint mc
|
|
uses: https://github.com/hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: infra/images/mc.Dockerfile
|
|
|
|
|
|
|
|
- name: Build mc
|
|
run: docker build -f infra/images/mc.Dockerfile -t local/mc:build infra/rustfs/
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
# Jobs that never install uv (image builds, infra checks) still
|
|
# need it here — otherwise the filer dies with "uv: command not
|
|
# found" and the failure is never filed.
|
|
command -v uv >/dev/null 2>&1 || curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Infra CI" --job "mc" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|