P9 CI/CD unification: fix broken pipelines, harden deploy (fix #36, fix #37, fix #38, fix #39, fix #40, fix #41)

- Remove dead root .woodpecker.yml (#36) - deploy.yml: remove path filters that broke depends_on chain (#37) - deploy.yml: backup/restore .env around git reset --hard (#38) - ci.yml: separate coverage-badge into non-fatal step (#39) - rebuild-all.yml: fix shell loop YAML syntax, add depends_on (#40) - ci.yml: add depends_on lint to test step (#41)
2026-03-13 10:37:11 -04:00
parent e949a945d0
commit d97689abc0
4 changed files with 36 additions and 60 deletions
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -1,36 +0,0 @@
-steps:
-  lint:
-    image: ghcr.io/astral-sh/uv:python3.13-bookworm
-    commands:
-      - uv sync --frozen
-      - uv run ruff check src/ tests/ dev/
-      - uv run ruff format --check src/ tests/ dev/
-
-  test:
-    image: ghcr.io/astral-sh/uv:python3.13-bookworm
-    commands:
-      - uv sync --frozen
-      - uv run python -m pytest --cov=src --cov-report=term-missing --cov-fail-under=99 -q 2>&1 | tee pytest.out
-      - uv run python dev/scripts/coverage_badge.py < pytest.out > coverage.svg
-      - |
-        PCT=$(grep -oP 'TOTAL\s+\d+\s+\d+\s+\K\d+' pytest.out)
-        curl -sf -X POST \
-          -H "Authorization: token $GITEA_TOKEN" \
-          -H "Content-Type: application/json" \
-          -d "{\"state\":\"success\",\"description\":\"${PCT}% coverage\",\"context\":\"coverage\"}" \
-          "$GITEA_URL/api/v1/repos/homelab/stack/statuses/$CI_COMMIT_SHA"
-    secrets: [gitea_token, gitea_url]
-    depends_on:
-      - lint
-
-  notebooks:
-    image: ghcr.io/astral-sh/uv:python3.13-bookworm
-    commands:
-      - uv sync --frozen
-      - uv run marimo check notebooks/*.py
-    depends_on:
-      - lint
-
-when:
-  branch: main
-  event: [push, pull_request]
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -20,6 +20,21 @@ steps:

  - name: test
    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    environment:
+      UV_PYTHON_PREFERENCE: only-system
+      UV_LINK_MODE: copy
+    commands:
+      - uv python pin 3.13.11
+      - uv sync --dev
+      - uv pip install -e .
+      - uv run pytest tests/ --cov=src --cov-report=term-missing --cov-fail-under=99 -q 2>&1 | tee pytest.out
+      - uv run python dev/scripts/coverage_badge.py < pytest.out > coverage.svg
+    depends_on:
+      - lint
+
+  - name: coverage-badge
+    image: ghcr.io/astral-sh/uv:python3.13-bookworm-slim
+    failure: ignore
    environment:
      UV_PYTHON_PREFERENCE: only-system
      UV_LINK_MODE: copy
@@ -31,9 +46,9 @@ steps:
      - uv python pin 3.13.11
      - uv sync --dev
      - uv pip install -e .
-      - uv run pytest tests/ --cov=src --cov-report=term-missing --cov-fail-under=99 -q 2>&1 | tee pytest.out
-      - uv run python dev/scripts/coverage_badge.py < pytest.out > coverage.svg
      - uv run python dev/scripts/coverage_badge.py --post pytest.out
+    depends_on:
+      - test

  - name: validate-compose
    image: docker:cli
--- a/.woodpecker/deploy.yml
+++ b/.woodpecker/deploy.yml
@@ -47,8 +47,6 @@ steps:
      - TAG=${CI_COMMIT_SHA:0:8}
      - docker build -t fhirworx/notebooks:$TAG ./notebooks
      - docker tag fhirworx/notebooks:$TAG fhirworx/notebooks:latest
-    when:
-      - path: "notebooks/**"

  - name: scan-notebooks
    image: aquasec/trivy:latest
@@ -60,8 +58,6 @@ steps:
      - trivy image --severity HIGH,CRITICAL --format json -o notebooks-scan.json fhirworx/notebooks:$TAG
    depends_on:
      - build-notebooks
-    when:
-      - path: "notebooks/**"

  - name: push-notebooks
    image: docker:cli
@@ -81,8 +77,6 @@ steps:
      - docker push localhost:3000/fhirworx/notebooks:latest
    depends_on:
      - scan-notebooks
-    when:
-      - path: "notebooks/**"

  # ── Zotero image ────────────────────────────────────────────
  - name: build-zotero
@@ -93,8 +87,6 @@ steps:
      - TAG=${CI_COMMIT_SHA:0:8}
      - docker build -t fhirworx/zotero:$TAG ./zotero
      - docker tag fhirworx/zotero:$TAG fhirworx/zotero:latest
-    when:
-      - path: "zotero/**"

  - name: scan-zotero
    image: aquasec/trivy:latest
@@ -106,8 +98,6 @@ steps:
      - trivy image --severity HIGH,CRITICAL --format json -o zotero-scan.json fhirworx/zotero:$TAG
    depends_on:
      - build-zotero
-    when:
-      - path: "zotero/**"

  - name: push-zotero
    image: docker:cli
@@ -127,8 +117,6 @@ steps:
      - docker push localhost:3000/fhirworx/zotero:latest
    depends_on:
      - scan-zotero
-    when:
-      - path: "zotero/**"

  # ── Docs image ─────────────────────────────────────────────
  # No path filter — docstrings and bib data change with any src/ edit.
@@ -179,8 +167,6 @@ steps:
      path_style: true
    depends_on:
      - scan-notebooks
-    when:
-      - path: "notebooks/**"

  - name: upload-zotero-scan
    image: woodpeckerci/plugin-s3
@@ -196,8 +182,6 @@ steps:
      path_style: true
    depends_on:
      - scan-zotero
-    when:
-      - path: "zotero/**"

  # ── Deploy: pull latest code + restart services ────────────────
  - name: deploy
@@ -208,8 +192,10 @@ steps:
    commands:
      - apk add --no-cache git
      - cd /home/kert/stack
+      - cp .env .env.bak 2>/dev/null || true
      - git fetch http://gitea:3000/homelab/stack.git main
      - git reset --hard FETCH_HEAD
+      - cp .env.bak .env 2>/dev/null || true
      # Pin compose to the exact images just built
      - TAG=${CI_COMMIT_SHA:0:8}
      - sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env 2>/dev/null || echo "COMMIT_SHA=$TAG" >> .env
--- a/.woodpecker/rebuild-all.yml
+++ b/.woodpecker/rebuild-all.yml
@@ -38,6 +38,8 @@ steps:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/notebooks:${CI_COMMIT_SHA:0:8}
+    depends_on:
+      - build-notebooks

  - name: scan-zotero
    image: aquasec/trivy:latest
@@ -45,6 +47,8 @@ steps:
      - /run/user/1000/docker.sock:/var/run/docker.sock
    commands:
      - trivy image --severity HIGH,CRITICAL --exit-code 0 --format table fhirworx/zotero:${CI_COMMIT_SHA:0:8}
+    depends_on:
+      - build-zotero

  - name: push-images
    image: docker:cli
@@ -58,12 +62,17 @@ steps:
    commands:
      - TAG=${CI_COMMIT_SHA:0:8}
      - echo "$REGISTRY_PASS" | docker login localhost:3000 -u "$REGISTRY_USER" --password-stdin
-      - for SVC in notebooks zotero docs; do
-      -   docker tag fhirworx/$SVC:$TAG localhost:3000/fhirworx/$SVC:$TAG
-      -   docker push localhost:3000/fhirworx/$SVC:$TAG
-      -   docker tag fhirworx/$SVC:latest localhost:3000/fhirworx/$SVC:latest
-      -   docker push localhost:3000/fhirworx/$SVC:latest
-      - done
+      - |
+        for SVC in notebooks zotero docs; do
+          docker tag fhirworx/$SVC:$TAG localhost:3000/fhirworx/$SVC:$TAG
+          docker push localhost:3000/fhirworx/$SVC:$TAG
+          docker tag fhirworx/$SVC:latest localhost:3000/fhirworx/$SVC:latest
+          docker push localhost:3000/fhirworx/$SVC:latest
+        done
+    depends_on:
+      - scan-notebooks
+      - scan-zotero
+      - build-docs

  - name: deploy
    image: docker:cli
@@ -75,3 +84,5 @@ steps:
      - TAG=${CI_COMMIT_SHA:0:8}
      - sed -i "s/^COMMIT_SHA=.*/COMMIT_SHA=$TAG/" .env 2>/dev/null || echo "COMMIT_SHA=$TAG" >> .env
      - docker compose up -d --remove-orphans
+    depends_on:
+      - push-images