chore: bootstrap repo scaffolding (M0.1)

Adds the §1.2 scaffolding required by IMPLEMENTATION_PLAN.md M0.1: README, CONTRIBUTING, CODEOWNERS, CHANGELOG, PR + issue templates, CI workflow, release workflow, LICENSE, commitlint, cliff config, .editorconfig, .gitignore, .env.example. Refs: M0.1
2026-05-18 21:07:18 +02:00
parent ae9f68d6b6
commit 5a960a261a
15 changed files with 692 additions and 1 deletions
@@ -0,0 +1,97 @@
+# CI for TypeScript / Next.js services. Copy to .gitea/workflows/ci.yaml in the repo.
+name: ci
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  shared:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+
+      - name: commitlint (PR only)
+        if: github.event_name == 'pull_request'
+        uses: wagoid/commitlint-github-action@v6
+
+      - name: gitleaks
+        uses: gitleaks/gitleaks-action@v2
+
+      - name: trivy fs scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: fs
+          severity: HIGH,CRITICAL
+          exit-code: 1
+
+  test:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with: { version: 9 }
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm lint
+      - run: pnpm typecheck
+      - run: pnpm test --coverage
+
+      - name: coverage gate
+        run: |
+          node -e "const c=require('./coverage/coverage-summary.json').total.lines.pct; if (c<70) { console.error('coverage', c, '< 70%'); process.exit(1) }"
+
+      - run: pnpm build
+
+  e2e:
+    needs: test
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with: { version: 9 }
+      - uses: actions/setup-node@v4
+        with: { node-version: '20', cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec playwright install --with-deps chromium
+      - name: e2e against stage
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: pnpm e2e
+        env:
+          PLAYWRIGHT_BASE_URL: https://stage.yourplatform.com
+          PLAYWRIGHT_TEST_USER: ${{ secrets.STAGE_TEST_USER }}
+          PLAYWRIGHT_TEST_PASS: ${{ secrets.STAGE_TEST_PASS }}
+
+  image:
+    needs: [shared, test]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/login-action@v3
+        with:
+          registry: registry.yourplatform.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASS }}
+      - uses: docker/build-push-action@v6
+        with:
+          push: true
+          tags: |
+            registry.yourplatform.com/${{ github.event.repository.name }}:sha-${{ github.sha }}
+            registry.yourplatform.com/${{ github.event.repository.name }}:env-stage
+      - uses: anchore/sbom-action@v0
+        with:
+          image: registry.yourplatform.com/${{ github.event.repository.name }}:sha-${{ github.sha }}
+      - run: orca apply --env=stage --image-tag=sha-${{ github.sha }}
+        env:
+          ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
@@ -0,0 +1,85 @@
+# release.yaml — production release on git tag vX.Y.Z.
+# Promotes the image already on stage to prod, gated by manual sign-off.
+name: release
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+jobs:
+  promote:
+    runs-on: docker
+    environment:
+      name: production           # Gitea Environments — requires sign-off per branch protection
+      url: https://yourplatform.com
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+
+      - name: extract version
+        id: v
+        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+
+      - name: verify stage soak (>= 24h on this image)
+        run: |
+          IMG=registry.yourplatform.com/${{ github.event.repository.name }}:env-stage
+          SOAK_SECONDS=$(orca image-age --env=stage --image $IMG)
+          if [ "$SOAK_SECONDS" -lt 86400 ]; then
+            echo "Stage soak only $SOAK_SECONDS s, < 24h. Aborting."
+            exit 1
+          fi
+        env:
+          ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
+
+      - name: re-tag image as semver + env-prod
+        uses: docker/login-action@v3
+        with:
+          registry: registry.yourplatform.com
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASS }}
+
+      - run: |
+          IMG=registry.yourplatform.com/${{ github.event.repository.name }}
+          docker pull $IMG:env-stage
+          docker tag  $IMG:env-stage $IMG:v${{ steps.v.outputs.version }}
+          docker tag  $IMG:env-stage $IMG:env-prod
+          docker push $IMG:v${{ steps.v.outputs.version }}
+          docker push $IMG:env-prod
+
+      - name: deploy to prod
+        run: orca apply --env=prod --image-tag=v${{ steps.v.outputs.version }}
+        env:
+          ORCA_TOKEN: ${{ secrets.ORCA_PROD_TOKEN }}
+
+      - name: post-deploy smoke
+        run: orca exec --env=prod smoke-runner
+
+      - name: generate release notes from conventional commits
+        uses: orhun/git-cliff-action@v3
+        with:
+          config: cliff.toml
+          args: --latest --strip header
+        env:
+          OUTPUT: RELEASE_NOTES.md
+
+      - name: create Gitea release
+        run: |
+          curl -X POST -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -Rs '{tag_name:"v${{ steps.v.outputs.version }}", name:"v${{ steps.v.outputs.version }}", body:.}' < RELEASE_NOTES.md)" \
+            https://gitea.meghsakha.com/api/v1/repos/${{ github.repository }}/releases
+
+  rollback-on-failure:
+    needs: promote
+    if: failure()
+    runs-on: docker
+    steps:
+      - name: orca rollback prod
+        run: orca rollout undo ${{ github.event.repository.name }} --env=prod
+        env:
+          ORCA_TOKEN: ${{ secrets.ORCA_PROD_TOKEN }}
+      - name: page on-call
+        run: |
+          curl -X POST -H "Content-Type: application/json" \
+            -d '{"text":"Release of ${{ github.event.repository.name }} ${{ github.ref }} FAILED. Rolled back. See Gitea Actions run."}' \
+            ${{ secrets.ONCALL_WEBHOOK }}