release: canopy-web 0.1.0

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/report-document.yml

@@ -0,0 +1,47 @@
+name: Report a graph or node
+description: Report a harmful, misleading or broken graph or node in the catalogue.
+labels: ["report"]
+body:
+  - type: input
+    id: document
+    attributes:
+      label: Catalogue URL
+      description: The page URL of the graph or node you are reporting.
+      placeholder: https://graphs.univerlab.org/g/acme/things/flow
+    validations:
+      required: true
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Kind
+      description: Whether the document is a graph or a node.
+      options:
+        - graph
+        - node
+  - type: input
+    id: source
+    attributes:
+      label: Source repository
+      description: The owner/repo that holds the document.
+      placeholder: acme/things
+  - type: dropdown
+    id: reason
+    attributes:
+      label: Reason
+      description: Why the catalogue should remove it.
+      options:
+        - Malicious or dangerous command
+        - Misleading description
+        - Prompt that steers the agent to do harm
+        - Broken or invalid
+        - Copyright or licence
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: details
+    attributes:
+      label: Details
+      description: What is wrong, where it appears, and what should happen instead.
+    validations:
+      required: true

.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: ci
+
+on:
+  pull_request:
+  # release.yml runs CI again on main before it deploys.
+  workflow_call:
+
+jobs:
+  install:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+
+  lint:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+
+  typecheck:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+
+  test:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm test
+
+  validate:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run validate
+
+  e2e:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npx playwright install --with-deps chromium
+      - run: npm run test:e2e
+        env:
+          # A server that never answers shows its own output in the log.
+          DEBUG: pw:webserver

.github/workflows/deploy-remote.yml

@@ -0,0 +1,42 @@
+name: deploy-remote
+
+# Manual only: nothing deploys on merge. Publishes apps/remote/worker/ to
+# Cloudflare as the `canopy-remote` Worker behind remote.univerlab.org. The
+# account id is inlined in apps/remote/worker/wrangler.toml, so the only
+# secret is the API token.
+on:
+  workflow_dispatch: {}
+  # release.yml calls this after CI passes on main.
+  workflow_call: {}
+
+concurrency:
+  group: deploy-remote-worker
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Deploy worker
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      # The Worker serves the browser app from apps/remote/web/dist via the
+      # [assets] binding, so the web build must exist before wrangler deploy.
+      # The pages link the shared look kit, which `npm run build:look` copies
+      # into apps/remote/web/public/look: the kit must exist before the web
+      # build runs. Same generator both apps use for the look kit, one source
+      # of truth.
+      - run: npm run build:look
+      - run: npm run build:remote-web
+      - name: Deploy with Wrangler
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          wranglerVersion: 4.153.0
+          workingDirectory: apps/remote/worker
+          command: deploy

.github/workflows/deploy.yml

@@ -0,0 +1,40 @@
+name: deploy
+
+# Manual only: nothing deploys on merge. Publishes apps/graphs/ to Cloudflare as
+# the `canopy-graphs` Worker behind graphs.univerlab.org. The account id is
+# inlined in apps/graphs/wrangler.toml, so the only secret is the API token.
+on:
+  workflow_dispatch: {}
+  # release.yml calls this after CI passes on main.
+  workflow_call: {}
+
+concurrency:
+  group: deploy-worker
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Deploy worker
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      # The pages link the shared look kit, which `npm run build:look` copies
+      # into apps/graphs/public/look, and /editor loads its bundle from
+      # apps/graphs/public/editor, built by `npm run build:editor`: the
+      # [assets] directory must exist before wrangler deploys. Same
+      # generator both apps use for the look kit, one source of truth.
+      - run: npm run build:look
+      - run: npm run build:editor
+      - name: Deploy with Wrangler
+        uses: cloudflare/wrangler-action@v3
+        with:
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          wranglerVersion: 4.153.0
+          workingDirectory: apps/graphs
+          command: deploy

.github/workflows/release.yml

@@ -0,0 +1,64 @@
+name: release
+
+# Run by hand on main. One version for both subdomains: the version in
+# package.json names one tag, and graphs.univerlab.org and remote.univerlab.org
+# deploy together from it. CI runs again on main, then both Workers deploy, and
+# the tag and GitHub release come last, so a tag always names something that
+# really shipped. To release again, bump the version in package.json by PR.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  version:
+    name: Check version
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.version.outputs.tag }}
+    steps:
+      - name: Release from main only
+        run: |
+          if [ "$GITHUB_REF" != "refs/heads/main" ]; then
+            echo "::error::Releases run from main, not $GITHUB_REF."
+            exit 1
+          fi
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Read the version and refuse a released one
+        id: version
+        run: |
+          tag="v$(node -p "require('./package.json').version")"
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            echo "::error::$tag is already released. Bump the version in package.json first."
+            exit 1
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
+  ci:
+    needs: version
+    uses: ./.github/workflows/ci.yml
+
+  deploy-graphs:
+    needs: ci
+    uses: ./.github/workflows/deploy.yml
+    secrets: inherit
+
+  deploy-remote:
+    needs: ci
+    uses: ./.github/workflows/deploy-remote.yml
+    secrets: inherit
+
+  release:
+    name: Tag and GitHub release
+    needs: [version, deploy-graphs, deploy-remote]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Create the tag and the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ needs.version.outputs.tag }}
+        run: gh release create "$TAG" --target "$GITHUB_SHA" --title "$TAG" --generate-notes