Upgrade visual styling and ship prebuilt worldwide Docker images (#12)

* Add shared visual controls and native prebuilt worldwide Docker releases * Validate shared styles, synthetic buildings, and date-line-safe packet geometry * Document the release and bound decorative work in dense route views * Remove the retired terrain-history collection cache * Address review feedback on terrain updates, legends, and responsive buildings * Keep the region and packet legends separate on compact screens * Separate building, camera, and responsive browser checks * Wait for the complete synthetic snapshot before upgrade checks
2026-10-22 12:42:25 +00:00 · 2026-09-12 18:36:06 -04:00
1 parent 198fbef34d
commit f7941b7a95
@@ -1,12 +1,21 @@
 name: CI

-# Maintainer-dispatched validation for the self-hosted source distribution.
 on:
+  pull_request:
+  push:
+    branches: [main]
  workflow_dispatch:

 permissions:
  contents: read

+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  IMAGE_NAME: ghcr.io/n30nex/cartolite-server
+
 jobs:
  backend:
    name: Go test, vet, and race
@@ -50,46 +59,66 @@ jobs:
      - run: node scripts/check-frontend-budget.mjs web/dist

  container:
-    name: Container integration, browser, privacy, and scan
+    name: Container integration, browser, privacy, and scan (${{ matrix.arch }})
    needs: [backend, frontend]
-    runs-on: ubuntu-latest
-    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: web/package-lock.json
      - working-directory: web
+        if: matrix.arch == 'amd64'
        run: |
          npm ci
          npm exec playwright install --with-deps chromium
      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - name: Require and verify CARTO vector authorization
-        env:
-          CARTO_BASEMAP_API_KEY: ${{ secrets.CARTO_BASEMAP_API_KEY }}
+      - name: Read build identity
+        id: identity
        run: |
-          test -n "$CARTO_BASEMAP_API_KEY"
-          node scripts/check-carto-vector.mjs
+          version="$(tr -d '\r\n' < VERSION)"
+          [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          test "$version" = "$(jq -r .version web/package.json)"
+          test "$version" = "$(jq -r .version web/package-lock.json)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "time=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> "$GITHUB_OUTPUT"
      - name: Build hardened image
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
-          platforms: linux/amd64
+          platforms: linux/${{ matrix.arch }}
          load: true
          push: false
          tags: cartolite-server:ci
          build-args: |
-            APP_VERSION=ci
+            APP_VERSION=${{ steps.identity.outputs.version }}
            GIT_SHA=${{ github.sha }}
-            BUILD_TIME=unknown
-          secrets: |
-            carto_basemap_api_key=${{ secrets.CARTO_BASEMAP_API_KEY }}
+            BUILD_TIME=${{ steps.identity.outputs.time }}
+          cache-from: type=gha,scope=world-${{ matrix.arch }}
+          cache-to: type=gha,scope=world-${{ matrix.arch }},mode=max
      - run: |
          bash scripts/check-image-size.sh cartolite-server:ci
          test "$(docker image inspect cartolite-server:ci --format '{{.Config.User}}')" = "65532:65532"
-          test "$(docker image inspect cartolite-server:ci --format '{{.Architecture}}')" = "amd64"
+          test "$(docker image inspect cartolite-server:ci --format '{{.Architecture}}')" = "${{ matrix.arch }}"
+          test "$(docker image inspect cartolite-server:ci --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$GITHUB_SHA"
      - name: Start synthetic MQTT and server
        run: |
          docker network create cartolite-server-ci
@@ -115,12 +144,14 @@ jobs:
          bash scripts/integration-smoke.sh http://127.0.0.1:39476 artifacts/integration cartolite-server-mqtt
          bash scripts/performance-smoke.sh http://127.0.0.1:39476 cartolite-server-mqtt
      - name: Worldwide and terrain regressions
+        if: matrix.arch == 'amd64'
        working-directory: web
        env:
          CARTOLITE_BASE_URL: http://127.0.0.1:39476
          PLAYWRIGHT_HTML_OUTPUT_DIR: focused-playwright-report
        run: npm run test:e2e -- --grep '@terrain|@world' --output focused-test-results
      - name: Complete desktop and mobile browser suite
+        if: matrix.arch == 'amd64'
        working-directory: web
        env:
          CARTOLITE_BASE_URL: http://127.0.0.1:39476
@@ -143,13 +174,57 @@ jobs:
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          exit-code: "1"
+      - name: Build the previous source release for native upgrade verification
+        run: |
+          git worktree add --detach "$RUNNER_TEMP/cartolite-upgrade-base" v0.4.1
+          previous_sha="$(git -C "$RUNNER_TEMP/cartolite-upgrade-base" rev-parse HEAD)"
+          docker build --tag cartolite-server:upgrade-base \
+            --build-arg APP_VERSION=0.4.1 --build-arg GIT_SHA="$previous_sha" \
+            "$RUNNER_TEMP/cartolite-upgrade-base"
+      - name: Verify Compose installation and upgrade from 0.4.1
+        run: bash scripts/compose-smoke.sh cartolite-server:ci "$GITHUB_SHA" cartolite-server:upgrade-base
+      - name: Log in to GHCR
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish the tested platform image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        id: publish
+        run: |
+          candidate="${IMAGE_NAME}:sha-${GITHUB_SHA}-${{ matrix.arch }}"
+          docker tag cartolite-server:ci "$candidate"
+          docker push "$candidate"
+          digest="$(docker buildx imagetools inspect "$candidate" | awk '$1 == "Digest:" {print $2; exit}')"
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          mkdir -p artifacts/candidate
+          printf '%s\n' "$digest" > artifacts/candidate/${{ matrix.arch }}.txt
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+      - name: Attest the tested platform image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        with:
+          subject-name: ${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.publish.outputs.digest }}
+          push-to-registry: true
+      - name: Record platform digest
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: candidate-${{ matrix.arch }}
+          path: artifacts/candidate/${{ matrix.arch }}.txt
+          overwrite: true
      - name: Preserve browser and integration evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: cartolite-server-ci-evidence
+          name: cartolite-server-ci-evidence-${{ matrix.arch }}
+          overwrite: true
          path: |
            artifacts/integration/
+            artifacts/compose/
            web/test-results/
            web/playwright-report/
            web/focused-test-results/
@@ -159,10 +234,85 @@ jobs:
          docker rm -f cartolite cartolite-server-mqtt >/dev/null 2>&1 || true
          docker network rm cartolite-server-ci >/dev/null 2>&1 || true

+  publish:
+    name: Assemble and attest tested platform digests
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: [container]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      packages: write
+      attestations: write
+      id-token: write
+    outputs:
+      image: ${{ steps.index.outputs.image }}
+    steps:
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Assemble exact tested images without rebuilding
+        id: index
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name candidate-amd64 --dir candidates
+          gh run download "$GITHUB_RUN_ID" --repo "$GITHUB_REPOSITORY" --name candidate-arm64 --dir candidates
+          amd64="$(cat candidates/amd64.txt)"
+          arm64="$(cat candidates/arm64.txt)"
+          [[ "$amd64" =~ ^sha256:[0-9a-f]{64}$ && "$arm64" =~ ^sha256:[0-9a-f]{64}$ ]]
+          gh attestation verify "oci://${IMAGE_NAME}@${amd64}" --repo "$GITHUB_REPOSITORY"
+          gh attestation verify "oci://${IMAGE_NAME}@${arm64}" --repo "$GITHUB_REPOSITORY"
+          candidate="${IMAGE_NAME}:sha-${GITHUB_SHA}"
+          docker buildx imagetools create --tag "$candidate" "${IMAGE_NAME}@${amd64}" "${IMAGE_NAME}@${arm64}"
+          docker buildx imagetools inspect "$candidate" --raw | jq -e '[.manifests[].platform | .os + "/" + .architecture] | sort == ["linux/amd64","linux/arm64"]'
+          digest="$(docker buildx imagetools inspect "$candidate" | awk '$1 == "Digest:" {print $2; exit}')"
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+          echo "image=${IMAGE_NAME}@${digest}" >> "$GITHUB_OUTPUT"
+      - uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        with:
+          subject-name: ${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.index.outputs.digest }}
+          push-to-registry: true
+
+  public-install:
+    name: Anonymous published-image install (${{ matrix.arch }})
+    needs: [publish]
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Pull anonymously and verify the install recipe
+        env:
+          CANDIDATE_IMAGE: ${{ needs.publish.outputs.image }}
+        run: |
+          mkdir -p "$RUNNER_TEMP/anonymous-docker"
+          DOCKER_CONFIG="$RUNNER_TEMP/anonymous-docker" docker pull "$CANDIDATE_IMAGE"
+          test "$(docker image inspect "$CANDIDATE_IMAGE" --format '{{.Architecture}}')" = "${{ matrix.arch }}"
+          bash scripts/compose-smoke.sh "$CANDIDATE_IMAGE" "$GITHUB_SHA"
+      - if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: published-install-${{ matrix.arch }}
+          path: artifacts/compose/
+          overwrite: true
+
  required:
    name: CI / Required
    if: always()
-    needs: [backend, frontend, container]
+    needs: [backend, frontend, container, publish, public-install]
    runs-on: ubuntu-latest
    permissions:
      contents: read
@@ -174,9 +324,15 @@ jobs:
          BACKEND: ${{ needs.backend.result }}
          FRONTEND: ${{ needs.frontend.result }}
          CONTAINER: ${{ needs.container.result }}
-        run: test "$BACKEND" = success -a "$FRONTEND" = success -a "$CONTAINER" = success
+          PUBLISH: ${{ needs.publish.result }}
+          PUBLIC_INSTALL: ${{ needs.public-install.result }}
+        run: |
+          test "$BACKEND" = success -a "$FRONTEND" = success -a "$CONTAINER" = success
+          if [[ "$GITHUB_EVENT_NAME" == push ]]; then
+            test "$PUBLISH" = success -a "$PUBLIC_INSTALL" = success
+          fi
      - name: Attach dispatched validation to the exact commit
-        if: always()
+        if: always() && github.event_name == 'workflow_dispatch'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GATE_RESULT: ${{ steps.gate.outcome }}
@@ -187,6 +343,6 @@ jobs:
          fi
          gh api --method POST "repos/$GITHUB_REPOSITORY/statuses/$GITHUB_SHA" \
            -f state="$state" -f context='CI / Required' \
-            -f description='Maintainer-dispatched backend, frontend and container validation' \
+            -f description='Backend, frontend and native platform validation' \
            -f target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
            --silent
@@ -0,0 +1,121 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: write
+  packages: write
+  attestations: read
+  actions: read
+
+concurrency:
+  group: release-${{ github.ref_name }}
+  cancel-in-progress: false
+
+env:
+  IMAGE_NAME: ghcr.io/n30nex/cartolite-server
+
+jobs:
+  promote:
+    name: Promote tested digest
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout tag history
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0
+      - name: Verify version, main ancestry, and successful CI
+        id: release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          [[ "$GITHUB_REF_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+          sha="$(git rev-list -n 1 "$GITHUB_REF_NAME")"
+          test "$sha" = "$GITHUB_SHA"
+          version="${GITHUB_REF_NAME#v}"
+          test "$version" = "$(tr -d '\r\n' < VERSION)"
+          git fetch origin main --depth=200
+          git merge-base --is-ancestor "$sha" origin/main
+
+          runs="$(gh api --method GET \
+            "repos/$GITHUB_REPOSITORY/actions/workflows/ci.yml/runs" \
+            -f head_sha="$sha" -f status=completed -f per_page=100)"
+          jq -e --arg sha "$sha" --arg repo "$GITHUB_REPOSITORY" '
+            any(.workflow_runs[];
+              .head_sha == $sha and .conclusion == "success" and .event == "push" and
+              .head_branch == "main" and .head_repository.full_name == $repo)
+          ' <<<"$runs" >/dev/null
+
+          echo "sha=$sha" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          echo "series=${version%.*}" >> "$GITHUB_OUTPUT"
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Log in to GHCR
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Resolve and verify tested candidate
+        id: candidate
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        shell: bash
+        run: |
+          candidate="${IMAGE_NAME}:sha-${{ steps.release.outputs.sha }}"
+          digest="$(docker buildx imagetools inspect "$candidate" | awk '$1 == "Digest:" {print $2; exit}')"
+          [[ "$digest" =~ ^sha256:[0-9a-f]{64}$ ]]
+          gh attestation verify "oci://${IMAGE_NAME}@${digest}" --repo "$GITHUB_REPOSITORY"
+          echo "digest=$digest" >> "$GITHUB_OUTPUT"
+      - name: Build release manifest and checksums
+        shell: bash
+        run: |
+          mkdir -p artifacts/release
+          cp compose.yml artifacts/release/
+          cp compose.carto.yml compose.build.yml artifacts/release/
+          cp .env.example artifacts/release/default.env.example
+          version="${{ steps.release.outputs.version }}"
+          git archive --format=zip --prefix="CartoLite-Server-v${version}/" "${{ steps.release.outputs.sha }}" > "artifacts/release/CartoLite-Server-v${version}.zip"
+          git archive --format=tar.gz --prefix="CartoLite-Server-v${version}/" "${{ steps.release.outputs.sha }}" > "artifacts/release/CartoLite-Server-v${version}.tar.gz"
+          jq -n \
+            --arg version "${{ steps.release.outputs.version }}" \
+            --arg gitSha "${{ steps.release.outputs.sha }}" \
+            --arg image "${IMAGE_NAME}@${{ steps.candidate.outputs.digest }}" \
+            --arg candidateTag "sha-${{ steps.release.outputs.sha }}" \
+            '{schemaVersion:1,version:$version,gitSha:$gitSha,image:$image,candidateTag:$candidateTag,platforms:["linux/amd64","linux/arm64"]}' \
+            > artifacts/release/release-manifest.json
+          (cd artifacts/release && sha256sum default.env.example compose.yml compose.carto.yml compose.build.yml release-manifest.json CartoLite-Server-v* > SHA256SUMS)
+          (cd artifacts/release && sha256sum --check SHA256SUMS)
+      - name: Promote the exact digest without rebuilding
+        shell: bash
+        run: |
+          source="${IMAGE_NAME}@${{ steps.candidate.outputs.digest }}"
+          docker buildx imagetools create --prefer-index=false \
+            --tag "${IMAGE_NAME}:${{ steps.release.outputs.version }}" \
+            --tag "${IMAGE_NAME}:${{ steps.release.outputs.series }}" \
+            --tag "${IMAGE_NAME}:latest" \
+            "$source"
+          for tag in "${{ steps.release.outputs.version }}" "${{ steps.release.outputs.series }}" latest; do
+            actual="$(docker buildx imagetools inspect "${IMAGE_NAME}:$tag" | awk '$1 == "Digest:" {print $2; exit}')"
+            test "$actual" = "${{ steps.candidate.outputs.digest }}"
+          done
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            artifacts/release/default.env.example \
+            artifacts/release/compose.yml \
+            artifacts/release/compose.carto.yml \
+            artifacts/release/compose.build.yml \
+            artifacts/release/CartoLite-Server-v* \
+            artifacts/release/release-manifest.json \
+            artifacts/release/SHA256SUMS \
+            --verify-tag \
+            --title "CartoLite Server ${{ steps.release.outputs.version }}" \
+            --generate-notes