chore: bootstrap repo scaffolding (M0.1)

Adds the §1.2 scaffolding required by IMPLEMENTATION_PLAN.md M0.1: README, CONTRIBUTING, CODEOWNERS, CHANGELOG, PR + issue templates, CI workflow, release workflow, LICENSE, commitlint, cliff config, .editorconfig, .gitignore, .env.example. Refs: M0.1
2026-05-18 21:07:16 +02:00
parent 90b97c9d68
commit ebf627372f
15 changed files with 630 additions and 1 deletions
@@ -0,0 +1,35 @@
+# CI for orca-platform (IaC). Runs `orca validate` only.
+name: ci
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  shared:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+
+      - name: commitlint (PR only)
+        if: github.event_name == 'pull_request'
+        uses: wagoid/commitlint-github-action@v6
+
+      - name: gitleaks
+        uses: gitleaks/gitleaks-action@v2
+
+  validate:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: install orca
+        run: |
+          curl -fsSL https://orca.meghsakha.com/install.sh | sh
+          orca version
+
+      - name: orca validate
+        run: orca validate ./
@@ -0,0 +1,85 @@
+# release.yaml — production release on git tag vX.Y.Z.
+# Promotes the image already on stage to prod, gated by manual sign-off.
+name: release
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+jobs:
+  promote:
+    runs-on: docker
+    environment:
+      name: production           # Gitea Environments — requires sign-off per branch protection
+      url: https://yourplatform.com
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+
+      - name: extract version
+        id: v
+        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+
+      - name: verify stage soak (>= 24h on this image)
+        run: |
+          IMG=registry.yourplatform.com/${{ github.event.repository.name }}:env-stage
+          SOAK_SECONDS=$(orca image-age --env=stage --image $IMG)
+          if [ "$SOAK_SECONDS" -lt 86400 ]; then
+            echo "Stage soak only $SOAK_SECONDS s, < 24h. Aborting."
+            exit 1
+          fi
+        env:
+          ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
+
+      - name: re-tag image as semver + env-prod
+        uses: docker/login-action@v3
+        with:
+          registry: registry.yourplatform.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASS }}
+
+      - run: |
+          IMG=registry.yourplatform.com/${{ github.event.repository.name }}
+          docker pull $IMG:env-stage
+          docker tag  $IMG:env-stage $IMG:v${{ steps.v.outputs.version }}
+          docker tag  $IMG:env-stage $IMG:env-prod
+          docker push $IMG:v${{ steps.v.outputs.version }}
+          docker push $IMG:env-prod
+
+      - name: deploy to prod
+        run: orca apply --env=prod --image-tag=v${{ steps.v.outputs.version }}
+        env:
+          ORCA_TOKEN: ${{ secrets.ORCA_PROD_TOKEN }}
+
+      - name: post-deploy smoke
+        run: orca exec --env=prod smoke-runner
+
+      - name: generate release notes from conventional commits
+        uses: orhun/git-cliff-action@v3
+        with:
+          config: cliff.toml
+          args: --latest --strip header
+        env:
+          OUTPUT: RELEASE_NOTES.md
+
+      - name: create Gitea release
+        run: |
+          curl -X POST -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -Rs '{tag_name:"v${{ steps.v.outputs.version }}", name:"v${{ steps.v.outputs.version }}", body:.}' < RELEASE_NOTES.md)" \
+            https://gitea.meghsakha.com/api/v1/repos/${{ github.repository }}/releases
+
+  rollback-on-failure:
+    needs: promote
+    if: failure()
+    runs-on: docker
+    steps:
+      - name: orca rollback prod
+        run: orca rollout undo ${{ github.event.repository.name }} --env=prod
+        env:
+          ORCA_TOKEN: ${{ secrets.ORCA_PROD_TOKEN }}
+      - name: page on-call
+        run: |
+          curl -X POST -H "Content-Type: application/json" \
+            -d '{"text":"Release of ${{ github.event.repository.name }} ${{ github.ref }} FAILED. Rolled back. See Gitea Actions run."}' \
+            ${{ secrets.ONCALL_WEBHOOK }}