name: Build and publish frontend on: push: branches: - main tags: - "v*" permissions: contents: write jobs: publish: runs-on: large if: ${{ !startsWith(github.ref, 'refs/heads/') || !contains(github.event.head_commit.message, '[auto-version-bump]') }} steps: - name: Check out repository uses: actions/checkout@v4 with: token: ${{ secrets.GITEA_TOKEN }} persist-credentials: true - name: Verify release version and frontend source shell: bash run: | set -euo pipefail node --version python3 scripts/bump-version.py --check scripts/check-frontend.sh - name: Build Piper WebAssembly assets shell: bash run: | set -euo pipefail npm install --no-audit --no-fund npm run build:piper test -s public/tts/piper-wasm-v1/piper/piper_phonemize.wasm test -s public/tts/piper-wasm-v1/piper/piper_phonemize.data test -s public/tts/piper-wasm-v1/piper-worker.js test -s public/piper-runtime.js - name: Ensure Helm is available shell: bash env: HELM_VERSION: v3.17.3 run: | set -euo pipefail if command -v helm >/dev/null 2>&1; then helm version --short exit 0 fi mkdir -p "$HOME/.local/bin" "$RUNNER_TEMP/helm" archive="$RUNNER_TEMP/helm/helm-${HELM_VERSION}-linux-amd64.tar.gz" curl -fsSLo "$archive" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz" curl -fsSLo "$archive.sha256sum" "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz.sha256sum" (cd "$RUNNER_TEMP/helm" && sha256sum -c "$(basename "$archive").sha256sum") tar -xzf "$archive" -C "$RUNNER_TEMP/helm" install "$RUNNER_TEMP/helm/linux-amd64/helm" "$HOME/.local/bin/helm" echo "$HOME/.local/bin" >> "$GITHUB_PATH" - name: Lint and render chart shell: bash run: | set -euo pipefail helm lint deploy/helm/ai-spel-frontend helm template ai-spel-frontend deploy/helm/ai-spel-frontend \ --namespace ai-spel > "$RUNNER_TEMP/frontend-manifest.yaml" grep -q 'kind: Deployment' "$RUNNER_TEMP/frontend-manifest.yaml" grep -q 'kind: Service' "$RUNNER_TEMP/frontend-manifest.yaml" - name: Build and push commit image if: startsWith(github.ref, 'refs/heads/') shell: bash env: HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }} HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }} run: | set -euo pipefail printf '%s' "$HARBOR_PASSWORD" | docker login harbor.k3s.k0.nu \ --username "$HARBOR_USERNAME" --password-stdin unset HARBOR_PASSWORD version="$(cat VERSION)" tag="harbor.k3s.k0.nu/ai-spel/frontend:edge-${GITHUB_SHA:0:12}" docker build --platform linux/amd64 --pull \ --build-arg "FRONTEND_VERSION=$version" --tag "$tag" . docker image push "$tag" - name: Bump patch version and create release tag id: bump if: startsWith(github.ref, 'refs/heads/') shell: bash run: | set -euo pipefail git fetch origin main --quiet test "$(git rev-parse origin/main)" = "$GITHUB_SHA" || { echo 'main advanced during this workflow; a newer push will run the release step' exit 1 } version="$(python3 scripts/bump-version.py)" git config user.name "Gitea Actions" git config user.email "actions@users.noreply.gitea" git add VERSION deploy/helm/ai-spel-frontend/Chart.yaml package-lock.json git commit -m "Release $version [auto-version-bump]" git tag -a "v$version" -m "v$version" git push origin HEAD:main "refs/tags/v$version" echo "version=$version" >> "$GITHUB_OUTPUT" - name: Publish versioned image, chart, and manifest if: ${{ startsWith(github.ref, 'refs/tags/') || steps.bump.outputs.version != '' }} shell: bash env: AUTO_RELEASE_VERSION: ${{ steps.bump.outputs.version }} HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }} HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }} ORAS_VERSION: 1.2.3 run: | set -euo pipefail version="$(cat VERSION)" test -n "$version" if [[ "$GITHUB_REF" == refs/tags/* ]]; then test "$GITHUB_REF_NAME" = "v$version" else test "$AUTO_RELEASE_VERSION" = "$version" fi python3 scripts/bump-version.py --check printf '%s' "$HARBOR_PASSWORD" | docker login harbor.k3s.k0.nu \ --username "$HARBOR_USERNAME" --password-stdin image="harbor.k3s.k0.nu/ai-spel/frontend:$version" docker build --platform linux/amd64 --pull \ --build-arg "FRONTEND_VERSION=$version" --tag "$image" . docker image push "$image" publish_dir="$(mktemp -d)" trap 'rm -rf "$publish_dir"' EXIT helm lint deploy/helm/ai-spel-frontend helm package deploy/helm/ai-spel-frontend --destination "$publish_dir" \ --version "$version" --app-version "$version" registry_config="$RUNNER_TEMP/helm/registry.json" mkdir -p "$(dirname "$registry_config")" printf '{}' > "$registry_config" printf '%s' "$HARBOR_PASSWORD" | helm registry login harbor.k3s.k0.nu \ --username "$HARBOR_USERNAME" --password-stdin \ --registry-config "$registry_config" helm push "$publish_dir/ai-spel-frontend-$version.tgz" \ oci://harbor.k3s.k0.nu/ai-spel --registry-config "$registry_config" chart_metadata="$(helm show chart oci://harbor.k3s.k0.nu/ai-spel/ai-spel-frontend \ --version "$version" --registry-config "$registry_config")" chart_version="$(printf '%s\n' "$chart_metadata" | awk '$1 == "version:" { print $2 }')" chart_app_version="$(printf '%s\n' "$chart_metadata" | awk '$1 == "appVersion:" { gsub(/"/, "", $2); print $2 }')" [[ "$chart_version" == "$version" && "$chart_app_version" == "$version" ]] || { echo "Published frontend chart version mismatch: chart=$chart_version app=$chart_app_version expected=$version" exit 1 } helm template ai-spel-frontend "$publish_dir/ai-spel-frontend-$version.tgz" \ --namespace ai-spel > "$publish_dir/frontend-manifest.yaml" mkdir -p "$RUNNER_TEMP/oras" archive="$RUNNER_TEMP/oras/oras_${ORAS_VERSION}_linux_amd64.tar.gz" curl -fsSLo "$archive" \ "https://github.com/oras-project/oras/releases/download/v${ORAS_VERSION}/oras_${ORAS_VERSION}_linux_amd64.tar.gz" echo 'b4efc97a91f471f323f193ea4b4d63d8ff443ca3aab514151a30751330852827 '"$archive" | sha256sum -c - tar -xzf "$archive" -C "$RUNNER_TEMP/oras" oras export PATH="$RUNNER_TEMP/oras:$PATH" printf '%s' "$HARBOR_PASSWORD" | oras login harbor.k3s.k0.nu \ --username "$HARBOR_USERNAME" --password-stdin unset HARBOR_PASSWORD ( cd "$publish_dir" oras push --artifact-type application/vnd.ai-spel.frontend-manifest.v1 \ "harbor.k3s.k0.nu/ai-spel/frontend-manifest:$version" \ "frontend-manifest.yaml:application/yaml" )