mirror of
https://github.com/Stirling-Tools/Stirling-PDF.git
synced 2026-09-03 05:10:16 +03:00
Anthony Stirling
83e5319661
## What CI cost/routing cleanup. Four changes, each reversible with no code deleted. ### 1. Disable Depot repo-wide (reversible) Depot ran on trusted (non-fork) triggers via the `is_fork` output of `_runner-pick.yml`, driving both the `depot-*` runner selection and the Depot docker build actions. It's now disabled everywhere behind a single kill-switch: - `_runner-pick.yml` gains a dedicated `use_depot` output, forced `false` via `DEPOT_ENABLED=false`. `is_fork` stays truthful for trust gating (e.g. `build-enterprise` skipping on forks). - All `runs-on:` and `USE_DEPOT:` expressions now key off `use_depot`, so every job falls back to `ubuntu-latest` + buildx. - `settings.gradle` Depot remote build cache (`cache.depot.dev`) gated behind `depotCacheEnabled = false`. **Switch back on:** set `DEPOT_ENABLED=true` in `_runner-pick.yml` (and `depotCacheEnabled = true` in `settings.gradle`). Depot then reactivates on trusted triggers exactly as before. ### 2. arm64 PR docker build only on Dockerfile changes `test-build-docker.yml` was building `linux/amd64,linux/arm64/v8` on every PR matching the broad `project` filter. With Depot off, the arm64 leg runs under slow QEMU emulation on every code PR. New `dockerfiles` path filter (`docker/**/Dockerfile*`) gates the arm64 leg: normal code PRs build amd64 only; PRs that touch a Dockerfile still build amd64 + arm64. arm64 is still fully exercised on the base-image publish and on release. ### 3. Tauri PR build -> Linux only, unsigned, deb-only The PR path built the full 3-OS matrix (Windows + macOS-universal + Linux), plus the flaky Linux AppImage pass (#6127). PRs now build Linux only (fastest + cheapest to compile) via a new `minimal` input on `tauri-build.yml`: Linux deb only, no rpm, no AppImage. The full signed multi-OS matrix still runs on release, and nightly still warms the Rust cache with all-OS defaults (unchanged). Tradeoff: Windows/macOS desktop build breaks are caught by nightly (all-OS) rather than the introducing PR. ### 4. CI self-testing routing Editing `build.yml` only matched the `project` filter, so a change to how e2e / enterprise / tauri / engine jobs are dispatched didn't actually run those jobs. Added a `ci` anchor (`build.yml` + `.github/config/.files.yaml`) that every job-gating area filter now includes, so editing the router or the filter config runs every job. Also added the orphaned reusable workflows (`e2e-*`, `frontend-validation`, `docker-compose-tests`, `test-build-docker`, `check-openapi`, `check-licence`) to their area filters so editing a reusable workflow self-tests. ## Validation - All workflow YAML + `.files.yaml` parse; anchor resolution verified (every job-gating filter resolves to include the `ci` paths). - Gradle evaluates `settings.gradle` cleanly; `spotlessGradleCheck` passes.
237 lines
9.1 KiB
YAML
237 lines
9.1 KiB
YAML
name: UI test with TestDriverAI
|
|
|
|
on:
|
|
push:
|
|
branches: ["master", "UITest", "testdriver"]
|
|
|
|
# cancel in-progress jobs if a new job is triggered
|
|
# This is useful to avoid running multiple builds for the same branch if a new commit is pushed
|
|
# or a pull request is updated.
|
|
# It helps to save resources and time by ensuring that only the latest commit is built and tested
|
|
# This is particularly useful for long-running jobs that may take a while to complete.
|
|
# The `group` is set to a combination of the workflow name, event name, and branch name.
|
|
# This ensures that jobs are grouped by the workflow and branch, allowing for cancellation of
|
|
# in-progress jobs when a new commit is pushed to the same branch or a new pull request is opened.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref_name || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
pick:
|
|
uses: ./.github/workflows/_runner-pick.yml
|
|
|
|
deploy:
|
|
if: ${{ vars.CI_PROFILE != 'lite' }}
|
|
needs: pick
|
|
runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
env:
|
|
USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
|
|
DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Set up JDK 25
|
|
uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
|
|
with:
|
|
java-version: "25"
|
|
distribution: "temurin"
|
|
|
|
- name: Setup Gradle
|
|
uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
|
|
with:
|
|
gradle-version: 9.6.0
|
|
|
|
- name: Build with Gradle
|
|
run: ./gradlew build
|
|
env:
|
|
MAVEN_USER: ${{ secrets.MAVEN_USER }}
|
|
MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
|
|
MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
|
|
DISABLE_ADDITIONAL_FEATURES: true
|
|
|
|
- name: Set up Depot CLI
|
|
if: env.USE_DEPOT == 'true'
|
|
uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
|
|
|
|
- name: Set up Docker Buildx
|
|
if: env.USE_DEPOT != 'true'
|
|
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
|
|
|
|
- name: Get version number
|
|
id: versionNumber
|
|
run: |
|
|
VERSION=$(grep "^version =" build.gradle | awk -F'"' '{print $2}')
|
|
echo "versionNumber=$VERSION" >> $GITHUB_OUTPUT
|
|
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_HUB_USERNAME }}
|
|
password: ${{ secrets.DOCKER_HUB_API }}
|
|
|
|
- name: Build and push test image (Depot)
|
|
if: env.USE_DEPOT == 'true'
|
|
uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
|
|
with:
|
|
project: ${{ vars.DEPOT_PROJECT_ID }}
|
|
context: .
|
|
file: ./docker/embedded/Dockerfile
|
|
push: true
|
|
tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
|
|
build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
|
|
platforms: linux/amd64
|
|
|
|
- name: Build and push test image (Docker fork fallback)
|
|
if: env.USE_DEPOT != 'true'
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
context: .
|
|
file: ./docker/embedded/Dockerfile
|
|
push: true
|
|
cache-from: type=gha,scope=stirling-pdf-latest
|
|
cache-to: type=gha,mode=max,scope=stirling-pdf-latest
|
|
tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
|
|
build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
|
|
platforms: linux/amd64
|
|
|
|
- name: Set up SSH
|
|
run: |
|
|
mkdir -p ~/.ssh/
|
|
echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
|
|
sudo chmod 600 ../private.key
|
|
|
|
- name: Deploy to VPS
|
|
run: |
|
|
cat > docker-compose.yml << EOF
|
|
version: '3.3'
|
|
services:
|
|
stirling-pdf:
|
|
container_name: stirling-pdf-test-${{ github.sha }}
|
|
image: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
|
|
ports:
|
|
- "1337:8080"
|
|
volumes:
|
|
- /stirling/test-${{ github.sha }}/data:/usr/share/tessdata:rw
|
|
- /stirling/test-${{ github.sha }}/config:/configs:rw
|
|
- /stirling/test-${{ github.sha }}/logs:/logs:rw
|
|
environment:
|
|
DISABLE_ADDITIONAL_FEATURES: "true"
|
|
SECURITY_ENABLELOGIN: "false"
|
|
SYSTEM_DEFAULTLOCALE: en-US
|
|
UI_APPNAME: "Stirling-PDF Test"
|
|
UI_HOMEDESCRIPTION: "Test Deployment"
|
|
UI_APPNAMENAVBAR: "Test"
|
|
SYSTEM_MAXFILESIZE: "100"
|
|
METRICS_ENABLED: "true"
|
|
SYSTEM_GOOGLEVISIBILITY: "false"
|
|
SYSTEM_ENABLEANALYTICS: "false"
|
|
restart: on-failure:5
|
|
EOF
|
|
|
|
scp -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null docker-compose.yml ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }}:/tmp/docker-compose.yml
|
|
|
|
ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
|
|
mkdir -p /stirling/test-${{ github.sha }}/{data,config,logs}
|
|
mv /tmp/docker-compose.yml /stirling/test-${{ github.sha }}/docker-compose.yml
|
|
cd /stirling/test-${{ github.sha }}
|
|
docker-compose pull
|
|
docker-compose up -d
|
|
EOF
|
|
|
|
files-changed:
|
|
if: always()
|
|
name: detect what files changed
|
|
needs: pick
|
|
runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
|
|
timeout-minutes: 3
|
|
outputs:
|
|
frontend: ${{ steps.changes.outputs.frontend }}
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Check for file changes
|
|
uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
|
|
id: changes
|
|
with:
|
|
filters: ".github/config/.files.yaml"
|
|
|
|
test:
|
|
if: needs.files-changed.outputs.frontend == 'true'
|
|
needs: [pick, deploy, files-changed]
|
|
runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
cache: "npm"
|
|
cache-dependency-path: frontend/package-lock.json
|
|
|
|
- name: Run TestDriver.ai
|
|
uses: testdriverai/action@f0d0f45fdd684db628baa843fe9313f3ca3a8aa8 #1.1.3
|
|
with:
|
|
key: ${{secrets.TESTDRIVER_API_KEY}}
|
|
prerun: |
|
|
choco install go-task -y
|
|
task frontend:build
|
|
cd frontend
|
|
npm install dashcam-chrome --save
|
|
Start-Process "C:/Program Files/Google/Chrome/Application/chrome.exe" -ArgumentList "--start-maximized", "--load-extension=$(pwd)/node_modules/dashcam-chrome/build", "http://${{ secrets.NEW_VPS_HOST }}:1337"
|
|
Start-Sleep -Seconds 20
|
|
prompt: |
|
|
1. /run testing/testdriver/test.yml
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
FORCE_COLOR: "3"
|
|
|
|
cleanup:
|
|
needs: [pick, deploy, test]
|
|
runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
|
|
if: always()
|
|
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Set up SSH
|
|
run: |
|
|
mkdir -p ~/.ssh/
|
|
echo "${{ secrets.NEW_VPS_SSH_KEY }}" > ../private.key
|
|
sudo chmod 600 ../private.key
|
|
|
|
- name: Cleanup deployment
|
|
if: always()
|
|
run: |
|
|
ssh -i ../private.key -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ secrets.NEW_VPS_USERNAME }}@${{ secrets.NEW_VPS_HOST }} << EOF
|
|
cd /stirling/test-${{ github.sha }}
|
|
docker-compose down
|
|
cd /stirling
|
|
rm -rf test-${{ github.sha }}
|
|
EOF
|
|
continue-on-error: true # Ensure cleanup runs even if previous steps fail
|