ci: add gitflow — dev/stage/main branches with CI workflows

- dev.yaml: build + local docker smoke test only (no push, no deploy) - stage.yaml: build + push + deploy to marketing-stage + smoke test (stops here) - deploy.yaml: add HTML placeholder touch step before docker build Proper human gate between stage and prod: the stage→main merge decision.
2026-05-03 11:28:43 -05:00
parent 102343c8fe
commit c75d8a9563
6 changed files with 399 additions and 3 deletions
@@ -0,0 +1,111 @@
+name: Dev — Build & local smoke test
+
+# Validates that the build compiles and the server starts cleanly.
+# No GCP deployment — this is the inner dev loop gate.
+# Merge to stage when you want a real environment.
+
+on:
+  push:
+    branches: [dev]
+    paths:
+      - 'src/**'
+      - 'dist/**'
+      - 'runtime/**'
+      - 'Dockerfile.stage'
+      - 'build-stage.sh'
+      - '.gitea/workflows/dev.yaml'
+
+  workflow_dispatch:
+
+jobs:
+  build-smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Clone el (provides elc compiler)
+        env:
+          CHECKOUT_TOKEN: ${{ secrets.CHECKOUT_TOKEN }}
+        run: |
+          set -euo pipefail
+          DEST="${{ github.workspace }}/../foundation-el"
+          rm -rf "$DEST"
+          git clone --depth 1 \
+            "https://will:${CHECKOUT_TOKEN}@git.neuralplatform.ai/neuron-technologies/el.git" \
+            "$DEST"
+          echo "EL_HOME=$DEST" >> "$GITHUB_ENV"
+
+      - name: Authenticate to GCP
+        uses: google-github-actions/auth@v2
+        with:
+          credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+      - name: Set up gcloud SDK
+        uses: google-github-actions/setup-gcloud@v2
+        with:
+          project_id: neuron-785695
+
+      - name: Configure docker auth for Artifact Registry
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get elc (pre-built linux/amd64)
+        run: |
+          set -euo pipefail
+          curl -fL -o "$EL_HOME/dist/platform/elc" \
+            https://git.neuralplatform.ai/neuron-technologies/el/releases/download/v1.2.1/elc-linux-amd64
+          chmod +x "$EL_HOME/dist/platform/elc"
+
+      - name: Compute image tag
+        id: tag
+        run: echo "tag=dev-${GITHUB_SHA:0:8}" >> "$GITHUB_OUTPUT"
+
+      - name: Touch HTML placeholder files
+        # El binary regenerates these at startup via fs_write. They must exist
+        # in the build context for Dockerfile COPY to succeed. touch is
+        # idempotent if the files already exist from a prior run.
+        run: touch src/index.html src/about.html src/terms.html src/enterprise-terms.html
+
+      - name: Build image (local only — no push)
+        env:
+          EXTRACT_JS: '1'
+        run: ./build-stage.sh "${{ steps.tag.outputs.tag }}"
+
+      - name: Local smoke test
+        run: |
+          set -euo pipefail
+          IMAGE="marketing:${{ steps.tag.outputs.tag }}"
+
+          docker run -d --name dev-smoke \
+            -p 8080:8080 \
+            -e PORT=8080 \
+            -e NODE_ENV=production \
+            -e LANDING_ROOT=/srv/landing \
+            "$IMAGE"
+
+          # entrypoint.sh sleeps 4s for soul-demo to load before starting neuron-web.
+          # Poll up to 45s total.
+          for i in $(seq 1 15); do
+            STATUS=$(curl -sSo /dev/null -w "%{http_code}" --max-time 5 http://localhost:8080/ || echo "000")
+            echo "Attempt $i/15: HTTP $STATUS"
+            if [ "$STATUS" = "200" ]; then
+              echo "Dev smoke test PASSED"
+              docker stop dev-smoke && docker rm dev-smoke
+              exit 0
+            fi
+            sleep 3
+          done
+
+          echo "--- container logs ---"
+          docker logs dev-smoke || true
+          docker stop dev-smoke && docker rm dev-smoke || true
+          echo "Dev smoke test FAILED"
+          exit 1