mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
24f23e09ae
Remove obsolete layout/migration prose and legacy gateway-alias references, reconcile the required-check policy, fix version-label/RBAC/workspace/channel drift, and de-duplicate the example and gateway docs. Rename the minimal manifest to 10-sandboxtemplate.yaml and mount the dsh-home PVC's workspace subPath at /workspace so the documented persistence is real. Enforce numbered top-level manifests in check-examples.sh. Verified with make check, yamllint, shellcheck, a Markdown link/anchor scan, and git diff --check. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
261 lines
9.3 KiB
YAML
261 lines
9.3 KiB
YAML
# Release pipeline. Pushing a tag that matches the identity in versions.env
|
|
# publishes both images (version + latest), creates the GitHub Release from
|
|
# git-cliff, and opens a PR that refreshes CHANGELOG.md on main.
|
|
#
|
|
# The tag must be dsh-vX.Y.Z or dsh-vX.Y.Z-rN and must match versions.env;
|
|
# tags are immutable, so a broken release is fixed with a new -rN revision.
|
|
name: Release
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "dsh-v*"
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: Existing tag to release (must match versions.env)
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: write
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
|
|
concurrency:
|
|
group: release-${{ github.ref }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
meta:
|
|
name: Validate release identity
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
outputs:
|
|
identity: ${{ steps.meta.outputs.identity }}
|
|
dsh_version: ${{ steps.meta.outputs.dsh_version }}
|
|
pnpm_version: ${{ steps.meta.outputs.pnpm_version }}
|
|
release_revision: ${{ steps.meta.outputs.release_revision }}
|
|
ghcr_image: ${{ steps.meta.outputs.ghcr_image }}
|
|
gateway_image: ${{ steps.meta.outputs.gateway_image }}
|
|
tag: ${{ steps.meta.outputs.tag }}
|
|
run_tests: ${{ steps.meta.outputs.run_tests }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Validate tag against versions.env
|
|
id: meta
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
set -a
|
|
# shellcheck disable=SC1091
|
|
source versions.env
|
|
set +a
|
|
tag="${{ inputs.tag || github.ref_name }}"
|
|
identity="$DSH_VERSION"
|
|
[ -z "$RELEASE_REVISION" ] || identity="$DSH_VERSION-$RELEASE_REVISION"
|
|
if [ "$tag" != "$identity" ]; then
|
|
echo "tag '$tag' does not match versions.env identity '$identity'" >&2
|
|
exit 1
|
|
fi
|
|
if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
|
|
git fetch origin main '+refs/heads/release/*:refs/remotes/origin/release/*'
|
|
commit=$(git rev-list -n1 "refs/tags/$tag")
|
|
allowed=0
|
|
for ref in origin/main origin/release/*; do
|
|
if git rev-parse -q --verify "$ref" >/dev/null && git merge-base --is-ancestor "$commit" "$ref"; then
|
|
allowed=1
|
|
break
|
|
fi
|
|
done
|
|
if [ "$allowed" -ne 1 ]; then
|
|
echo "tag commit $commit is not on main or a release branch" >&2
|
|
exit 1
|
|
fi
|
|
# Tests already ran in PR CI when the tag is on main; only re-run
|
|
# them for release-branch tags (where ci.yaml does not trigger).
|
|
run_tests=true
|
|
if git rev-parse -q --verify origin/main >/dev/null && git merge-base --is-ancestor "$commit" origin/main; then
|
|
run_tests=false
|
|
fi
|
|
else
|
|
echo "tag '$tag' does not exist in this repository" >&2
|
|
exit 1
|
|
fi
|
|
if ! git ls-remote --tags --exit-code "$DSH_REPO" "$DSH_VERSION" >/dev/null; then
|
|
echo "upstream ref '$DSH_VERSION' not found in $DSH_REPO" >&2
|
|
exit 1
|
|
fi
|
|
{
|
|
echo "identity=$identity"
|
|
echo "dsh_version=$DSH_VERSION"
|
|
echo "pnpm_version=$PNPM_VERSION"
|
|
echo "release_revision=$RELEASE_REVISION"
|
|
echo "ghcr_image=$GHCR_IMAGE"
|
|
echo "gateway_image=$GATEWAY_IMAGE"
|
|
echo "tag=$tag"
|
|
echo "run_tests=$run_tests"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Verify repository pins
|
|
run: ./scripts/check-versions.sh
|
|
|
|
tests:
|
|
name: Unit tests and lint
|
|
needs: meta
|
|
# The test steps are guarded individually rather than the whole job so a
|
|
# main-branch tag (run_tests=false) still leaves this job "successful" and
|
|
# does not cascade-skip build-main/build-gateway.
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
defaults:
|
|
run:
|
|
working-directory: examples/dsh-agents-as-a-service/gateway
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Set up Python
|
|
if: needs.meta.outputs.run_tests == 'true'
|
|
uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
|
|
with:
|
|
python-version: "3.12"
|
|
cache: pip
|
|
cache-dependency-path: |
|
|
examples/dsh-agents-as-a-service/gateway/requirements.txt
|
|
examples/dsh-agents-as-a-service/gateway/requirements-dev.txt
|
|
- name: Install dependencies
|
|
if: needs.meta.outputs.run_tests == 'true'
|
|
run: |
|
|
set -euo pipefail
|
|
python -m pip install --upgrade pip
|
|
pip install -r requirements.txt -r requirements-dev.txt
|
|
- name: Lint
|
|
if: needs.meta.outputs.run_tests == 'true'
|
|
run: |
|
|
set -euo pipefail
|
|
python -m ruff check .
|
|
python -m ruff format --check .
|
|
- name: Unit tests
|
|
if: needs.meta.outputs.run_tests == 'true'
|
|
run: python -m pytest -q
|
|
|
|
build-main:
|
|
name: Publish main image
|
|
needs: [meta, tests]
|
|
uses: ./.github/workflows/_build-image.yaml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
with:
|
|
image: ${{ needs.meta.outputs.ghcr_image }}
|
|
version: ${{ needs.meta.outputs.identity }}
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
build-args: |
|
|
DSH_VERSION=${{ needs.meta.outputs.dsh_version }}
|
|
RELEASE_REVISION=${{ needs.meta.outputs.release_revision }}
|
|
PNPM_VERSION=${{ needs.meta.outputs.pnpm_version }}
|
|
VCS_REF=${{ github.sha }}
|
|
tags: |
|
|
${{ needs.meta.outputs.ghcr_image }}:${{ needs.meta.outputs.identity }}
|
|
${{ needs.meta.outputs.ghcr_image }}:latest
|
|
|
|
build-gateway:
|
|
name: Publish gateway image
|
|
needs: [meta, tests]
|
|
uses: ./.github/workflows/_build-image.yaml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
with:
|
|
image: ${{ needs.meta.outputs.gateway_image }}
|
|
version: ${{ needs.meta.outputs.identity }}
|
|
context: examples/dsh-agents-as-a-service/gateway
|
|
dockerfile: Dockerfile
|
|
tags: |
|
|
${{ needs.meta.outputs.gateway_image }}:${{ needs.meta.outputs.identity }}
|
|
${{ needs.meta.outputs.gateway_image }}:latest
|
|
|
|
publish-release:
|
|
name: Changelog and GitHub Release
|
|
needs: [meta, build-main, build-gateway]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install git-cliff
|
|
env:
|
|
GIT_CLIFF_VERSION: v2.14.2
|
|
run: |
|
|
set -euo pipefail
|
|
version="${GIT_CLIFF_VERSION#v}"
|
|
curl -fsSL -o /tmp/git-cliff.tar.gz "https://github.com/orhun/git-cliff/releases/download/$GIT_CLIFF_VERSION/git-cliff-$version-x86_64-unknown-linux-gnu.tar.gz"
|
|
tar -xzf /tmp/git-cliff.tar.gz -C /tmp
|
|
install -m 0755 "/tmp/git-cliff-$version/git-cliff" /usr/local/bin/git-cliff
|
|
git-cliff --version
|
|
|
|
- name: Generate CHANGELOG and release notes
|
|
env:
|
|
IDENTITY: ${{ needs.meta.outputs.identity }}
|
|
run: |
|
|
set -euo pipefail
|
|
git-cliff --tag "$IDENTITY" --output CHANGELOG.md
|
|
git-cliff --tag "$IDENTITY" --latest --strip header --output /tmp/release-notes.md
|
|
echo "### Release $IDENTITY" >> "$GITHUB_STEP_SUMMARY"
|
|
head -n 40 /tmp/release-notes.md >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Create GitHub Release
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
IDENTITY: ${{ needs.meta.outputs.identity }}
|
|
run: |
|
|
set -euo pipefail
|
|
if gh release view "$IDENTITY" >/dev/null 2>&1; then
|
|
echo "release $IDENTITY already exists; skipping" >&2
|
|
else
|
|
gh release create "$IDENTITY" --title "$IDENTITY" --notes-file /tmp/release-notes.md --verify-tag
|
|
fi
|
|
|
|
- name: Open CHANGELOG pull request
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
IDENTITY: ${{ needs.meta.outputs.identity }}
|
|
continue-on-error: true
|
|
run: |
|
|
set -euo pipefail
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
if git diff --quiet -- CHANGELOG.md; then
|
|
echo "CHANGELOG.md already up to date"
|
|
exit 0
|
|
fi
|
|
branch="chore/changelog-$IDENTITY"
|
|
git switch -c "$branch"
|
|
git add CHANGELOG.md
|
|
git commit -m "chore(changelog): refresh for $IDENTITY"
|
|
git push origin "$branch"
|
|
gh pr create \
|
|
--base main \
|
|
--head "$branch" \
|
|
--title "chore(changelog): refresh for $IDENTITY" \
|
|
--body "Generated by git-cliff for $IDENTITY. Do not edit CHANGELOG.md by hand."
|