wip: uncommitted work on kraftwerk, saved 9 Oct 2026 (netcup issue 86)

2026-10-09 01:11:32 +02:00
parent 753701ca64
commit dc74380fb7
19 changed files with 1740 additions and 44 deletions
@@ -0,0 +1,26 @@
+name: Blog release
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    container:
+      image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          fetch-depth: 0
+          submodules: true
+
+      - name: Test the release contract
+        run: cd delivery && python3 -m unittest discover -s tests -v
+
+      - name: Build, package and inspect the immutable release
+        run: delivery/build.sh
@@ -0,0 +1,161 @@
+name: Deploy blog immutable package
+
+on:
+  workflow_dispatch:
+    inputs:
+      revision:
+        description: Full source commit
+        required: true
+      artifact_url:
+        description: Immutable Gitea generic-package URL
+        required: true
+      artifact_digest:
+        description: sha256 digest of site.tar.gz
+        required: true
+      target:
+        description: Provisioned site-scoped release root
+        required: true
+      verify_url:
+        description: Public release marker URL
+        required: true
+      desired_commit:
+        description: gitops-sandbox commit that selected this release
+        required: true
+      desired_generation:
+        description: Ancestor count of desired_commit; the receiver refuses older selections
+        required: true
+
+permissions:
+  contents: read
+
+# Best-effort only. Ordering is enforced by the receiver, which applies a
+# selection only if its generation is not older than the one already live, so
+# a stale dispatch or a re-run of an old run cannot replace a newer release.
+concurrency:
+  group: blog-deploy
+  cancel-in-progress: false
+
+jobs:
+  contract:
+    runs-on: ubuntu-latest
+    container:
+      image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Validate dispatch contract without network access
+        env:
+          REVISION: ${{ inputs.revision }}
+          ARTIFACT_URL: ${{ inputs.artifact_url }}
+          ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
+          TARGET: ${{ inputs.target }}
+          VERIFY_URL: ${{ inputs.verify_url }}
+          DESIRED_COMMIT: ${{ inputs.desired_commit }}
+          DESIRED_GENERATION: ${{ inputs.desired_generation }}
+        run: |
+          set -eu
+          python3 delivery/scripts/deploy_contract.py validate \
+            --revision "$REVISION" \
+            --artifact-url "$ARTIFACT_URL" \
+            --artifact-digest "$ARTIFACT_DIGEST" \
+            --target "$TARGET" \
+            --verify-url "$VERIFY_URL" \
+            --site-config delivery/site.json \
+            --desired-commit "$DESIRED_COMMIT" \
+            --desired-generation "$DESIRED_GENERATION"
+
+  deploy:
+    needs: contract
+    if: ${{ vars.BLOG_STATIC_DEPLOY_ENABLED == 'true' }}
+    runs-on: ubuntu-latest
+    container:
+      image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
+    timeout-minutes: 30
+    env:
+      ACTIVATION: ${{ vars.BLOG_STATIC_DEPLOY_ENABLED }}
+      REVISION: ${{ inputs.revision }}
+      ARTIFACT_URL: ${{ inputs.artifact_url }}
+      ARTIFACT_DIGEST: ${{ inputs.artifact_digest }}
+      TARGET: ${{ inputs.target }}
+      VERIFY_URL: ${{ inputs.verify_url }}
+      DESIRED_COMMIT: ${{ inputs.desired_commit }}
+      DESIRED_GENERATION: ${{ inputs.desired_generation }}
+      STATIC_PACKAGE_READ_USER: ${{ secrets.BLOG_PACKAGE_READ_USER }}
+      STATIC_PACKAGE_READ_TOKEN: ${{ secrets.BLOG_PACKAGE_READ_TOKEN }}
+      STATIC_DEPLOY_HOST: ${{ secrets.BLOG_STATIC_DEPLOY_HOST }}
+      STATIC_DEPLOY_USER: ${{ secrets.BLOG_STATIC_DEPLOY_USER }}
+      STATIC_DEPLOY_SSH_KEY: ${{ secrets.BLOG_STATIC_DEPLOY_SSH_KEY }}
+      STATIC_DEPLOY_KNOWN_HOSTS: ${{ secrets.BLOG_STATIC_DEPLOY_KNOWN_HOSTS }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+
+      - name: Enforce reviewed deployment gate
+        run: |
+          set -eu
+          test "$ACTIVATION" = true
+          python3 delivery/scripts/delivery_gate.py static_deploy \
+            --config delivery/.delivery/config.json
+          test -n "$STATIC_DEPLOY_HOST"
+          test -n "$STATIC_DEPLOY_USER"
+          test -n "$STATIC_DEPLOY_SSH_KEY"
+          test -n "$STATIC_DEPLOY_KNOWN_HOSTS"
+          case "$STATIC_DEPLOY_HOST" in *[!A-Za-z0-9.-]*|'') exit 1;; esac
+          case "$STATIC_DEPLOY_USER" in *[!A-Za-z0-9_-]*|'') exit 1;; esac
+
+      - name: Download and inspect the declared immutable artifact
+        run: |
+          set -eu
+          python3 delivery/scripts/deploy_contract.py prepare \
+            --revision "$REVISION" \
+            --artifact-url "$ARTIFACT_URL" \
+            --artifact-digest "$ARTIFACT_DIGEST" \
+            --target "$TARGET" \
+            --verify-url "$VERIFY_URL" \
+            --site-config delivery/site.json \
+            --desired-commit "$DESIRED_COMMIT" \
+            --desired-generation "$DESIRED_GENERATION" \
+            --archive delivery/.build/site.tar.gz \
+            --checksum delivery/.build/site.tar.gz.sha256 \
+            --request-token delivery/.build/deploy-request.token
+
+      - name: Send the artifact to the site-scoped forced command
+        id: receive
+        run: |
+          set -eu
+          umask 077
+          mkdir -p "$HOME/.ssh"
+          printf '%s\n' "$STATIC_DEPLOY_SSH_KEY" > "$HOME/.ssh/id_static_deploy"
+          printf '%s\n' "$STATIC_DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
+          cat > "$HOME/.ssh/config" <<CONFIG
+          Host static-release-target
+            HostName $STATIC_DEPLOY_HOST
+            User $STATIC_DEPLOY_USER
+            IdentityFile $HOME/.ssh/id_static_deploy
+            UserKnownHostsFile $HOME/.ssh/known_hosts
+            IdentitiesOnly yes
+            BatchMode yes
+            StrictHostKeyChecking yes
+            ConnectTimeout 10
+          CONFIG
+          request="$(cat delivery/.build/deploy-request.token)"
+          status=0
+          ssh static-release-target "static-release-receive $request" \
+            < delivery/.build/site.tar.gz || status=$?
+          # 3: the receiver already applied a newer selection; nothing changed.
+          if [ "$status" -eq 3 ]; then
+            echo "Superseded: generation $DESIRED_GENERATION ($DESIRED_COMMIT) is older than the live selection; nothing deployed."
+            printf 'superseded=true\n' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          test "$status" -eq 0
+          printf 'superseded=false\n' >> "$GITHUB_OUTPUT"
+
+      - name: Confirm public revision and digest
+        if: ${{ steps.receive.outputs.superseded == 'false' }}
+        run: |
+          set -eu
+          python3 delivery/scripts/static_release.py verify \
+            --url "$VERIFY_URL" \
+            --revision "$REVISION" \
+            --digest "$ARTIFACT_DIGEST"
@@ -0,0 +1,96 @@
+name: Publish blog immutable package
+
+# Every main push builds and tests the release. Publication additionally needs
+# the activation variable, the reviewed repository gate and the scoped package
+# secrets; without them nothing is published. Publication never deploys:
+# selecting the release is a reviewed change to gitops-sandbox/stacks.yml.
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      revision:
+        description: Full public/blog commit to publish
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: blog-publish
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    container:
+      image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
+    timeout-minutes: 15
+    env:
+      REQUESTED_REVISION: ${{ inputs.revision || github.sha }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ inputs.revision || github.sha }}
+          fetch-depth: 0
+          submodules: true
+
+      - name: Validate requested source, tests and build
+        run: |
+          set -eu
+          test "$(git rev-parse HEAD)" = "$REQUESTED_REVISION"
+          (cd delivery && python3 -m unittest discover -s tests -v)
+          delivery/build.sh
+
+  publish:
+    needs: validate
+    if: ${{ vars.BLOG_PACKAGE_PUBLISH_ENABLED == 'true' }}
+    runs-on: ubuntu-latest
+    container:
+      image: git.librete.ch/public/runner-image:v0.2.0@sha256:f60c587d3c0b0aac04a572db5349e27672bf76baec2ce547a3dcc28cebcf1b7e
+    timeout-minutes: 15
+    env:
+      ACTIVATION: ${{ vars.BLOG_PACKAGE_PUBLISH_ENABLED }}
+      REQUESTED_REVISION: ${{ inputs.revision || github.sha }}
+      STATIC_PACKAGE_USER: ${{ secrets.BLOG_PACKAGE_USER }}
+      STATIC_PACKAGE_TOKEN: ${{ secrets.BLOG_PACKAGE_TOKEN }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          ref: ${{ inputs.revision || github.sha }}
+          fetch-depth: 0
+          submodules: true
+
+      - name: Enforce reviewed publication gate
+        run: |
+          set -eu
+          test "$ACTIVATION" = true
+          python3 delivery/scripts/delivery_gate.py package_publish \
+            --config delivery/.delivery/config.json
+          test -n "$STATIC_PACKAGE_USER"
+          test -n "$STATIC_PACKAGE_TOKEN"
+
+      - name: Build and publish immutable package files
+        run: |
+          set -eu
+          test "$(git rev-parse HEAD)" = "$REQUESTED_REVISION"
+          delivery/build.sh
+          python3 delivery/scripts/generic_package.py \
+            --registry "${{ gitea.server_url }}" \
+            --owner public \
+            --package blog-site \
+            --revision "$REQUESTED_REVISION" \
+            --archive delivery/.build/site.tar.gz \
+            --checksum delivery/.build/site.tar.gz.sha256 \
+            --coordinate delivery/.build/release-coordinate.json \
+            > delivery/.build/published.json
+          cat delivery/.build/published.json
+          echo "Select this release with a reviewed gitops-sandbox stacks.yml change:"
+          python3 - delivery/.build/published.json <<'PY'
+          import json, sys
+          c = json.load(open(sys.argv[1]))
+          print("  blog:")
+          for key in ("revision", "artifact_url", "artifact_digest"):
+              print(f"    {key}: {c[key]}")
+          PY