HH-439: harden production artifact pipeline (#86)

* HH-439: harden production artifact pipeline * fix(HH-439): address production compose review * fix(HH-439): preserve previous JWT secrets in production --------- Co-authored-by: Rogee <rogee@ipao.vip>
2026-08-21 20:20:00 +08:00
parent 7e3872170f
commit 7a9fec33c5
11 changed files with 436 additions and 153 deletions
@@ -5,10 +5,15 @@ on:
    branches: [main]
  push:
    branches: [main]
+    tags: ['v*.*.*']

 permissions:
  contents: read

+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
 jobs:
  backend:
    name: Backend (SQLite)
@@ -153,3 +158,110 @@ jobs:
      - name: Prettier representative JS/TS/Vue files
        run: pnpm --dir frontend exec prettier --check app/javascript/dashboard/components-next/captain/assistant/AssistantPlayground.spec.js app/javascript/dashboard/components-next/captain/assistant/AssistantPlayground.vue vite.config.ts app/javascript/histoire.setup.ts
      - run: pnpm --dir frontend build
+
+  production-smoke:
+    name: Production image smoke
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    env:
+      GOCHAT_IMAGE_REF: gochat:production-smoke
+      GOCHAT_PORT: "38080"
+      GOCHAT_SERVER_CORS_ALLOWED_ORIGINS: https://chat.example.test
+      POSTGRES_PASSWORD: ci-postgres-secret
+      REDIS_PASSWORD: ci-redis-secret
+      MEILI_MASTER_KEY: ci-meili-secret-16
+      GOCHAT_JWT_SECRET: ci-smoke-jwt-secret-at-least-32-characters
+      GOCHAT_JWT_PREVIOUS_SECRETS: ci-previous-jwt-secret-at-least-32-characters
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build production images from repository root
+        run: |
+          docker build -t "$GOCHAT_IMAGE_REF" -f deploy/docker/Dockerfile .
+          docker build -t shangwutong:production-smoke -f channels/shangwutong/Dockerfile .
+          docker run -d --name gochat-ci-registry -p 127.0.0.1:5000:5000 registry:2
+          timeout 30 sh -c 'until curl -fsS http://127.0.0.1:5000/v2/; do sleep 1; done'
+          docker tag "$GOCHAT_IMAGE_REF" localhost:5000/gochat:production-smoke
+          docker tag shangwutong:production-smoke localhost:5000/shangwutong:production-smoke
+          docker push localhost:5000/gochat:production-smoke
+          docker push localhost:5000/shangwutong:production-smoke
+          echo "GOCHAT_IMAGE_REF=$(docker inspect --format '{{index .RepoDigests 0}}' localhost:5000/gochat:production-smoke)" >> "$GITHUB_ENV"
+          echo "SHANGWUTONG_IMAGE_REF=$(docker inspect --format '{{index .RepoDigests 0}}' localhost:5000/shangwutong:production-smoke)" >> "$GITHUB_ENV"
+      - name: Verify artifact contents
+        run: >-
+          docker run --rm --entrypoint sh "$GOCHAT_IMAGE_REF" -c
+          'test -s /app/configs/config.production.yaml &&
+          test -d /app/migrations &&
+          test -s /app/frontend/dist/index.html'
+      - name: Start production Compose and smoke core pages
+        run: |
+          if MEILI_MASTER_KEY=too-short deploy/docker/preflight.sh; then
+            echo "preflight accepted a short Meilisearch key" >&2
+            exit 1
+          fi
+          if POSTGRES_IMAGE_REF=pgvector/pgvector:pg16 deploy/docker/preflight.sh; then
+            echo "preflight accepted a mutable PostgreSQL image" >&2
+            exit 1
+          fi
+          deploy/docker/preflight.sh
+          docker compose -f deploy/docker/docker-compose.prod.yml config --format json | python3 -c 'import json, os, sys; config = json.load(sys.stdin); assert all(config["services"][service]["environment"]["GOCHAT_JWT_PREVIOUS_SECRETS"] == os.environ["GOCHAT_JWT_PREVIOUS_SECRETS"] for service in ("gochat", "worker"))'
+          docker compose -f deploy/docker/docker-compose.prod.yml up -d --wait gochat
+          curl -fsS "http://127.0.0.1:$GOCHAT_PORT/health" | grep -q '"status":"ok"'
+          curl -fsS "http://127.0.0.1:$GOCHAT_PORT/app" | grep -q '/assets/'
+      - name: Stop production Compose
+        if: always()
+        run: |
+          docker compose -f deploy/docker/docker-compose.prod.yml down -v
+          docker rm -f gochat-ci-registry || true
+
+  release:
+    name: Publish immutable image
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [backend, backend-postgres, frontend]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      image_ref: ${{ steps.ref.outputs.image_ref }}
+      image_digest: ${{ steps.build.outputs.digest }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract immutable tags
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          flavor: latest=false
+          tags: |
+            type=semver,pattern={{version}}
+            type=sha
+      - name: Capture build date
+        id: date
+        run: echo "value=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"
+      - name: Build and push
+        id: build
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deploy/docker/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ github.ref_name }}
+            COMMIT_SHA=${{ github.sha }}
+            BUILD_DATE=${{ steps.date.outputs.value }}
+          cache-from: type=gha,scope=gochat
+          cache-to: type=gha,mode=max,scope=gochat
+      - name: Record digest reference
+        id: ref
+        run: |
+          image_ref="${REGISTRY}/${IMAGE_NAME}@${{ steps.build.outputs.digest }}"
+          echo "image_ref=$image_ref" >> "$GITHUB_OUTPUT"
+          echo "GoChat image: \`$image_ref\`" >> "$GITHUB_STEP_SUMMARY"