Add isolated Luau rule engine service

2026-10-20 11:24:52 +02:00
commit a85a49dfd5
16 changed files with 936 additions and 0 deletions
@@ -0,0 +1,134 @@
+name: Build and publish rule engine
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: large
+    if: ${{ !startsWith(github.ref, 'refs/heads/') || !contains(github.event.head_commit.message, '[auto-version-bump]') }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          persist-credentials: true
+
+      - name: Test and lint in the shared builder image
+        shell: bash
+        run: |
+          set -euo pipefail
+          docker run --rm \
+            --volume "$PWD:/src" \
+            --volume ai-spel-rule-engine-cargo:/src/target \
+            --workdir /src \
+            harbor.k3s.k0.nu/ai-spel/game-builder:rust1.89-v2 \
+            sh -c 'cargo generate-lockfile && cargo fmt --all && cargo fmt --all -- --check && cargo test --workspace && cargo clippy --locked --workspace --all-targets -- -D warnings'
+
+      - name: Bump version and create Git tag
+        id: bump
+        if: startsWith(github.ref, 'refs/heads/')
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch origin main --quiet
+          test "$(git rev-parse origin/main)" = "$GITHUB_SHA"
+          version="$(python3 scripts/bump-release-version.py)"
+          git config user.name "Gitea Actions"
+          git config user.email "actions@users.noreply.gitea"
+          git add -u
+          git add Cargo.toml Cargo.lock deploy/helm/ai-spel-rule-engine/Chart.yaml deploy/argocd/application.yaml
+          git commit -m "Release $version [auto-version-bump]"
+          git tag -a "v$version" -m "v$version"
+          git push origin HEAD:main "refs/tags/v$version"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Build and publish image and Helm chart
+        id: publish
+        if: ${{ startsWith(github.ref, 'refs/tags/') || steps.bump.outputs.version != '' }}
+        shell: bash
+        env:
+          HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
+          HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
+          AUTO_RELEASE_VERSION: ${{ steps.bump.outputs.version }}
+        run: |
+          set -euo pipefail
+          version="${AUTO_RELEASE_VERSION:-${GITHUB_REF_NAME#v}}"
+          printf '%s' "$HARBOR_PASSWORD" | docker login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
+          image="harbor.k3s.k0.nu/ai-spel/rule-engine:$version"
+          docker build --platform linux/amd64 --pull --tag "$image" .
+          docker image push "$image"
+          helm_version=v3.17.3
+          if ! command -v helm >/dev/null 2>&1; then
+            mkdir -p "$RUNNER_TEMP/helm" "$HOME/.local/bin"
+            archive="helm-${helm_version}-linux-amd64.tar.gz"
+            curl -fsSLo "$RUNNER_TEMP/helm/$archive" "https://get.helm.sh/$archive"
+            curl -fsSLo "$RUNNER_TEMP/helm/$archive.sha256sum" "https://get.helm.sh/$archive.sha256sum"
+            (cd "$RUNNER_TEMP/helm" && sha256sum -c "$archive.sha256sum")
+            tar -xzf "$RUNNER_TEMP/helm/$archive" -C "$RUNNER_TEMP/helm"
+            install "$RUNNER_TEMP/helm/linux-amd64/helm" "$HOME/.local/bin/helm"
+            echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+            export PATH="$HOME/.local/bin:$PATH"
+          fi
+          helm lint deploy/helm/ai-spel-rule-engine
+          package_dir="$(mktemp -d)"
+          trap 'rm -rf "$package_dir"' EXIT
+          helm package deploy/helm/ai-spel-rule-engine --destination "$package_dir" --version "$version" --app-version "$version"
+          printf '%s' "$HARBOR_PASSWORD" | helm registry login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
+          helm push "$package_dir/ai-spel-rule-engine-$version.tgz" oci://harbor.k3s.k0.nu/ai-spel
+          helm template ai-spel-rule-engine "$package_dir/ai-spel-rule-engine-$version.tgz" --namespace ai-spel > "$package_dir/manifest.yaml"
+          oras_version=1.2.3
+          mkdir -p "$RUNNER_TEMP/oras"
+          curl -fsSLo "$RUNNER_TEMP/oras/oras.tgz" "https://github.com/oras-project/oras/releases/download/v${oras_version}/oras_${oras_version}_linux_amd64.tar.gz"
+          echo 'b4efc97a91f471f323f193ea4b4d63d8ff443ca3aab514151a30751330852827  '"$RUNNER_TEMP/oras/oras.tgz" | sha256sum -c -
+          tar -xzf "$RUNNER_TEMP/oras/oras.tgz" -C "$RUNNER_TEMP/oras" oras
+          install "$RUNNER_TEMP/oras/oras" "$RUNNER_TEMP/oras-bin"
+          printf '%s' "$HARBOR_PASSWORD" | "$RUNNER_TEMP/oras-bin" login harbor.k3s.k0.nu --username "$HARBOR_USERNAME" --password-stdin
+          unset HARBOR_PASSWORD
+          "$RUNNER_TEMP/oras-bin" push --artifact-type application/vnd.ai-spel.kubernetes-manifest.v1 \
+            "harbor.k3s.k0.nu/ai-spel/rule-engine-manifest:$version" \
+            "$package_dir/manifest.yaml:application/yaml"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Deploy rule engine through Argo CD
+        if: ${{ startsWith(github.ref, 'refs/tags/') || steps.bump.outputs.version != '' }}
+        shell: bash
+        env:
+          KUBECONFIG_B64: ${{ secrets.AI_SPEL_TEST_KUBECONFIG }}
+          AUTO_RELEASE_VERSION: ${{ steps.bump.outputs.version }}
+        run: |
+          set -euo pipefail
+          test -n "$KUBECONFIG_B64"
+          mkdir -p "$RUNNER_TEMP/kube"
+          printf '%s' "$KUBECONFIG_B64" | base64 -d > "$RUNNER_TEMP/kube/config"
+          chmod 600 "$RUNNER_TEMP/kube/config"
+          unset KUBECONFIG_B64
+          export KUBECONFIG="$RUNNER_TEMP/kube/config"
+          version="${AUTO_RELEASE_VERSION:-${GITHUB_REF_NAME#v}}"
+          if ! kubectl -n ai-spel get statefulset ai-spel-nats >/dev/null 2>&1 \
+            && ! kubectl -n argocd get application ai-spel-rule-engine >/dev/null 2>&1; then
+            echo 'NATS is not installed yet. The backend release pipeline bootstraps NATS and this Argo Application.'
+            exit 0
+          fi
+          kubectl -n ai-spel rollout status statefulset/ai-spel-nats --timeout=10m
+          kubectl -n argocd apply -f deploy/argocd/application.yaml
+          kubectl -n argocd patch application ai-spel-rule-engine --type merge -p "{\"spec\":{\"source\":{\"targetRevision\":\"$version\"}}}"
+          deadline=$((SECONDS + 600))
+          while (( SECONDS < deadline )); do
+            sync="$(kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.sync.status}')"
+            health="$(kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.health.status}')"
+            if [[ "$sync" == Synced && "$health" == Healthy ]]; then break; fi
+            sleep 5
+          done
+          [[ "$sync" == Synced && "$health" == Healthy ]] || {
+            echo "Argo CD did not reach Synced/Healthy for rule engine $version"
+            kubectl -n argocd get application ai-spel-rule-engine -o jsonpath='{.status.conditions[*].message}'
+            exit 1
+          }
+          kubectl -n ai-spel rollout status deployment/ai-spel-rule-engine --timeout=10m
+          kubectl -n ai-spel get pods -l app.kubernetes.io/instance=ai-spel-rule-engine -o wide