steveandClaude Opus 5
67a73616e1
Twelve findings, all real, and the two that matter are about the pre-flight I added rather than about qwen. The credential check had a false pass in the OTHER direction from round 2's: on the GADFLY_BASE_URL override path, resolveModel builds the client with GADFLY_API_KEY and never reads QWEN_API_KEY/KIMI_API_KEY, so treating the provider's own key as sufficient there let a doomed run proceed. Having now been wrong about these rules in both directions, the check no longer tries to model both paths: it covers the REGISTRY path, whose rules it can state exactly, and says nothing about the override path — which is hand-configured by definition, while the registry path is the one you hit by adding a model id to a var and forgetting the secret. The logic moves to scripts/preflight.sh, sourced by both run.sh and the test. The previous answer to "this test duplicates production logic" was a regex drift-guard, and that guard compared only the provider table — not the decision logic, which is precisely the half that carried the bug. A duplicate you guard is still a duplicate; this deletes it, and the test now runs under `set -u` like production does. Also: the test that pins the shared provider slice held its own copy of the list (now ranges the slice); endpointProviderNames had nothing tying it to the switches it describes, which is how it shipped without "gemini" (a new test asserts every advertised name resolves); two godoc lists had drifted; and the "sanity" line that asserted nothing is gone. And the repo had NO test job — `go test` and the pre-flight table both existed and neither was ever executed by CI, which reads as coverage while providing none. Added one (build/vet/gofmt/test/pre-flight), running alongside the image build rather than gating it, so red is loud without standing between a push and a rebuild. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
159 lines
6.1 KiB
YAML
159 lines
6.1 KiB
YAML
name: Build & push image
|
|
|
|
# Builds the Gadfly reviewer container and pushes it to the Gitea container
|
|
# registry. Mirrors mort-ci.yml's build-and-push (BuildKit secrets for private
|
|
# module access + the LAN --add-host so the builder can reach the registry).
|
|
#
|
|
# push to main -> :latest + :sha-<short>
|
|
# push tag v* -> :<tag> + :latest
|
|
# other branch push -> :branch-<safe> + :sha-<short>
|
|
# pull_request -> build only (no push), as a sanity check
|
|
#
|
|
# Required repo secrets:
|
|
# REGISTRY_USER / REGISTRY_PASSWORD Gitea creds with registry push + read
|
|
# access to the private majordomo module.
|
|
# Optional:
|
|
# DISCORD_WEBHOOK_URL build notifications (unset => silent).
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
# Docs/example-only changes don't change the image — skip the rebuild.
|
|
# (Path filters are not applied to tag pushes, so `v*` releases always build.)
|
|
paths-ignore:
|
|
- "**.md"
|
|
- "examples/**"
|
|
- "LICENSE"
|
|
- ".gitignore"
|
|
- ".dockerignore"
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
paths-ignore:
|
|
- "**.md"
|
|
- "examples/**"
|
|
- "LICENSE"
|
|
- ".gitignore"
|
|
- ".dockerignore"
|
|
workflow_dispatch: {}
|
|
|
|
concurrency:
|
|
group: gadfly-image-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
IMAGE_NAME: gitea.stevedudenhoeffer.com/steve/gadfly
|
|
|
|
jobs:
|
|
# Runs alongside the image build rather than gating it: a red test should be
|
|
# loud on the PR without standing between Steve and a rebuild. Added because
|
|
# this repo had NO test job at all — `go test` and scripts/preflight_test.sh
|
|
# both existed and neither was ever executed by CI, which is worse than
|
|
# having no tests, since it reads as coverage.
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
- name: Configure private module access
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: |
|
|
git config --global url."https://${REGISTRY_USER}:${REGISTRY_PASSWORD}@gitea.stevedudenhoeffer.com/".insteadOf "https://gitea.stevedudenhoeffer.com/"
|
|
go env -w GOPRIVATE=gitea.stevedudenhoeffer.com/*
|
|
- name: go build
|
|
run: go build ./...
|
|
- name: go vet
|
|
run: go vet ./...
|
|
- name: gofmt
|
|
run: test -z "$(gofmt -l .)" || { gofmt -l .; exit 1; }
|
|
- name: go test
|
|
run: go test -count=1 ./...
|
|
- name: pre-flight credential table
|
|
run: bash scripts/preflight_test.sh
|
|
|
|
build-and-push:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
run: docker buildx create --use --name gadfly-builder --driver docker-container 2>/dev/null || docker buildx use gadfly-builder
|
|
|
|
- name: Log in to the registry
|
|
if: github.event_name != 'pull_request'
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: echo "${REGISTRY_PASSWORD}" | docker login gitea.stevedudenhoeffer.com -u "${REGISTRY_USER}" --password-stdin
|
|
|
|
- name: Compute tags
|
|
id: meta
|
|
run: |
|
|
SHA_SHORT=$(echo "${GITHUB_SHA}" | cut -c1-7)
|
|
PUSH=true
|
|
if [ "${{ github.event_name }}" = "pull_request" ]; then
|
|
# Build-only sanity check; nothing published.
|
|
TAGS="${IMAGE_NAME}:pr-${{ github.event.pull_request.number }}"
|
|
PUSH=false
|
|
elif [ "${{ github.ref_type }}" = "tag" ]; then
|
|
TAGS="${IMAGE_NAME}:${GITHUB_REF_NAME},${IMAGE_NAME}:latest"
|
|
elif [ "${GITHUB_REF_NAME}" = "main" ]; then
|
|
TAGS="${IMAGE_NAME}:latest,${IMAGE_NAME}:sha-${SHA_SHORT}"
|
|
else
|
|
BRANCH_SAFE=$(echo "${GITHUB_REF_NAME}" | sed 's/[^a-zA-Z0-9._-]/-/g; s/--*/-/g; s/^-//; s/-$//')
|
|
TAGS="${IMAGE_NAME}:branch-${BRANCH_SAFE},${IMAGE_NAME}:sha-${SHA_SHORT}"
|
|
fi
|
|
echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
|
|
echo "push=${PUSH}" >> "$GITHUB_OUTPUT"
|
|
echo "Tags: ${TAGS} (push=${PUSH})"
|
|
|
|
- name: Notify Discord (started)
|
|
if: github.event_name != 'pull_request'
|
|
env:
|
|
WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
|
|
run: |
|
|
[ -z "$WEBHOOK_URL" ] && exit 0
|
|
MSG="🪰 Gadfly image build #${{ github.run_number }} started on \`${{ github.ref_name }}\` (${{ github.sha }})."
|
|
curl -sS -H 'Content-Type: application/json' -d "{\"content\": \"$MSG\"}" "$WEBHOOK_URL" || true
|
|
|
|
- name: Build and push
|
|
env:
|
|
REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: |
|
|
TAG_FLAGS=""
|
|
IFS=',' read -ra TAG_ARRAY <<< "${{ steps.meta.outputs.tags }}"
|
|
for tag in "${TAG_ARRAY[@]}"; do TAG_FLAGS="$TAG_FLAGS --tag $tag"; done
|
|
|
|
PUSH_FLAG="--push"
|
|
[ "${{ steps.meta.outputs.push }}" = "false" ] && PUSH_FLAG="--output=type=cacheonly"
|
|
|
|
docker buildx build \
|
|
$PUSH_FLAG \
|
|
--platform linux/amd64 \
|
|
$TAG_FLAGS \
|
|
--add-host gitea.stevedudenhoeffer.com:192.168.0.134 \
|
|
--secret id=REGISTRY_USER,env=REGISTRY_USER \
|
|
--secret id=REGISTRY_PASSWORD,env=REGISTRY_PASSWORD \
|
|
--file ./Dockerfile \
|
|
.
|
|
|
|
- name: Notify Discord (result)
|
|
if: always() && github.event_name != 'pull_request'
|
|
env:
|
|
WEBHOOK_URL: ${{ secrets.DISCORD_WEBHOOK_URL }}
|
|
run: |
|
|
[ -z "$WEBHOOK_URL" ] && exit 0
|
|
if [ "${{ job.status }}" = "success" ]; then
|
|
MSG="✅ Gadfly image build #${{ github.run_number }} succeeded. Tags: \`${{ steps.meta.outputs.tags }}\`."
|
|
else
|
|
MSG="❌ Gadfly image build #${{ github.run_number }} failed. Check Actions logs."
|
|
fi
|
|
curl -sS -H 'Content-Type: application/json' -d "{\"content\": \"$MSG\"}" "$WEBHOOK_URL" || true
|