refactor: bundle fonts (#1569)

.github/labeller.yaml

@@ -58,6 +58,9 @@ p:date-utils:
 p:errors:
   - changed-files:
     - any-glob-to-any-file: packages/errors/**/*
+p:fonts:
+  - changed-files:
+    - any-glob-to-any-file: packages/fonts/**/*
 p:geo-utils:
   - changed-files:
     - any-glob-to-any-file: packages/geo_utils/**/*

.github/workflows/build-app-proxy.yaml

@@ -134,6 +134,13 @@ jobs:
           cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-app-proxy
           --step upload_assets
 
+      - name: verify bundled faces are CORS-usable from the app origin
+        run: >-
+          deploy/scripts/verify-asset-cors.sh
+          --endpoint https://fluxerstatic.com
+          --origin https://fluxer.app
+          --manifest app-dist-output/dist/assets-manifest.txt
+
   build-arm64:
     name: build app-proxy (arm64)
     needs: meta
@@ -160,6 +167,7 @@ jobs:
           build-args: |
             BUILD_VERSION=${{ needs.meta.outputs.build_version }}
             PUBLIC_ASSET_BASE_URL=https://fluxerstatic.com
+            BUNDLE_LOCAL_ASSETS=false
           cache-from: type=gha,scope=fluxer-app-proxy-arm64
           cache-to: type=gha,scope=fluxer-app-proxy-arm64,mode=max,ignore-error=true
         env:

.github/workflows/repair-static-asset-metadata.yaml

@@ -1,40 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: repair static asset metadata
-
-on:
-  workflow_dispatch:
-    inputs:
-      prefix:
-        description: "S3 key prefix to repair"
-        type: string
-        required: false
-        default: "assets/"
-
-jobs:
-  repair:
-    runs-on: ubuntu-24.04
-    environment: static-assets
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      STATIC_BUCKET: fluxer-static
-      S3_ENDPOINT: https://ewr1.vultrobjects.com
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: 1.93.0
-
-      - name: Repair app asset metadata
-        env:
-          REPAIR_PREFIX: ${{ inputs.prefix }}
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- repair-static-asset-metadata
-          --bucket "${STATIC_BUCKET}"
-          --prefix "${REPAIR_PREFIX}"

.github/workflows/sync-static-bucket.yaml

@@ -1,39 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-or-later
-name: sync static bucket
-
-on:
-  workflow_dispatch:
-
-jobs:
-  push:
-    runs-on: ubuntu-24.04
-    environment: static-assets
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    env:
-      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      STATIC_BUCKET: fluxer-static
-      S3_ENDPOINT: https://ewr1.vultrobjects.com
-      S3_WRITE_CONCURRENCY: 8
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
-
-      - name: Set up Rust
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
-        with:
-          toolchain: 1.93.0
-
-      - name: Append static assets to S3
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- sync-static-bucket
-          --source fluxer_static
-          --bucket "${STATIC_BUCKET}"
-
-      - name: Repair app asset metadata
-        run: >-
-          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- repair-static-asset-metadata
-          --bucket "${STATIC_BUCKET}"
-          --prefix assets/

.github/workflows/tests.yaml

@@ -216,6 +216,74 @@ jobs:
           cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- ci
           --step knip
 
+  fonts:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        with:
+          python-version: "3.13"
+
+      - name: Install font tooling
+        run: python3 -m pip install -r tools/fonts/requirements.txt
+
+      - name: Verify shipped fonts match the lockfile
+        run: python3 tools/fonts/build_fonts.py --verify
+
+  font-serving:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+        with:
+          toolchain: stable
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+
+      - name: Install Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+
+      - name: Cache cargo
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: rust-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: |
+            rust-${{ runner.os }}-
+
+      - name: Install native dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config \
+            build-essential \
+            libcurl4-openssl-dev \
+            libvips-dev \
+            libavfilter-dev \
+            libheif-dev \
+            libwebp-dev
+
+      - name: Install Node.js dependencies
+        run: pnpm --filter fluxer_admin --filter fluxer_marketing install
+
+      - name: Run the font serving integration suite
+        run: cargo run --locked -q -p fluxer-dev -- font-serving-it
+
   ci-scripts:
     runs-on: ubuntu-24.04
     timeout-minutes: 25