frontend: bump bits to 0.1.3.dev0 (subject-filtered user-limit NATS s… #264
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 European Centre for Medium-Range Weather Forecasts (ECMWF) | |
| # | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| env: | |
| SKAFFOLD_SHA256: 8f62095ba8c282c03ad7b4987fbaf4f29b289fd6cbafb0351effd49f73f0240d | |
| SKAFFOLD_VERSION: v2.18.0 | |
| jobs: | |
| fmt: | |
| name: Format | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable | |
| with: | |
| toolchain: stable | |
| components: rustfmt | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| env: | |
| CARGO_NET_GIT_FETCH_WITH_CLI: "true" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable | |
| with: | |
| toolchain: stable | |
| - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 | |
| - name: Configure private repo access | |
| env: | |
| RAW_GH_TOKEN: ${{ secrets.GH_REPO_READ_TOKEN }} | |
| run: | | |
| token="$(printf '%s' "$RAW_GH_TOKEN" | tr -d '[:space:]')" | |
| echo "::add-mask::$token" | |
| git config --global url."https://x-access-token:${token}@github.com/".insteadOf "https://github.com/" | |
| - name: Strip local path patches | |
| run: sed -i '/^\[patch\./,$d' Cargo.toml | |
| - name: Frontend unit tests | |
| env: | |
| NO_PROXY: "127.0.0.1,localhost" | |
| run: | | |
| unset HTTP_PROXY http_proxy HTTPS_PROXY https_proxy ALL_PROXY all_proxy | |
| cargo test --locked -p polytope-server | |
| - name: Integration tests | |
| env: | |
| NO_PROXY: "127.0.0.1,localhost" | |
| run: | | |
| unset HTTP_PROXY http_proxy HTTPS_PROXY https_proxy ALL_PROXY all_proxy | |
| cargo test --locked -p polytope-server-integration-tests | |
| skaffold-validate: | |
| name: Validate Skaffold config | |
| runs-on: ubuntu-latest | |
| env: | |
| GH_TOKEN: dummy | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Skaffold | |
| run: | | |
| curl -fsSL "https://storage.googleapis.com/skaffold/releases/${SKAFFOLD_VERSION}/skaffold-linux-amd64" -o skaffold | |
| echo "${SKAFFOLD_SHA256} skaffold" | sha256sum --check - | |
| sudo install skaffold /usr/local/bin/skaffold | |
| - name: Validate Skaffold configuration | |
| run: skaffold diagnose --yaml-only --filename skaffold.yaml >/dev/null | |
| # Select the images affected by a PR before starting the costly container | |
| # builds. Release-tag existence is intentionally not considered here: a PR | |
| # must validate its changed image even when an older immutable release image | |
| # already has the same TAG-file value. | |
| changed-images: | |
| name: Select changed images | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.select.outputs.matrix }} | |
| has_images: ${{ steps.select.outputs.has_images }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Select affected images | |
| id: select | |
| env: | |
| BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }} | |
| HEAD_SHA: ${{ github.sha }} | |
| run: | | |
| if [[ -z "$BASE_SHA" || "$BASE_SHA" =~ ^0+$ ]]; then | |
| BASE_SHA="$(git rev-parse "$HEAD_SHA^")" | |
| fi | |
| matrix="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA" | python3 .github/scripts/select-images.py)" | |
| echo "Changed-image matrix: $matrix" | |
| echo "matrix=$matrix" >> "$GITHUB_OUTPUT" | |
| if python3 -c 'import json, sys; sys.exit(not json.loads(sys.argv[1])["include"])' "$matrix"; then | |
| echo "has_images=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_images=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| # Fork PRs are skipped: private dependency and ECCR credentials are required. | |
| # PRs import cache only; trusted pushes to main refresh the affected cache. | |
| image-build: | |
| name: Build / ${{ matrix.name }} | |
| needs: [fmt, test, skaffold-validate, changed-images] | |
| if: (github.event_name == 'push' || (github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork)) && needs.changed-images.outputs.has_images == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 120 | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 2 | |
| matrix: ${{ fromJSON(needs.changed-images.outputs.matrix) }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Log in to ECCR | |
| env: | |
| ECCR_PASSWORD: ${{ secrets.ECCR_PASSWORD }} | |
| ECCR_USERNAME: ${{ secrets.ECCR_USERNAME }} | |
| run: printf '%s' "$ECCR_PASSWORD" | docker login eccr.ecmwf.int --username "$ECCR_USERNAME" --password-stdin | |
| - name: Prepare repository token | |
| env: | |
| RAW_GH_TOKEN: ${{ secrets.GH_REPO_READ_TOKEN }} | |
| run: | | |
| token="$(printf '%s' "$RAW_GH_TOKEN" | tr -d '[:space:]')" | |
| echo "::add-mask::$token" | |
| echo "GH_TOKEN=$token" >> "$GITHUB_ENV" | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 | |
| - name: Install Skaffold | |
| run: | | |
| tool_dir="$RUNNER_TEMP/skaffold" | |
| mkdir -p "$tool_dir" | |
| curl -fsSL "https://storage.googleapis.com/skaffold/releases/${SKAFFOLD_VERSION}/skaffold-linux-amd64" -o "$tool_dir/skaffold" | |
| echo "${SKAFFOLD_SHA256} $tool_dir/skaffold" | sha256sum --check - | |
| chmod +x "$tool_dir/skaffold" | |
| echo "$tool_dir" >> "$GITHUB_PATH" | |
| - name: Build ${{ matrix.name }} (no push) | |
| env: | |
| BUILDKIT_CACHE_MODE: ${{ github.event_name == 'push' && 'read-write' || 'read' }} | |
| run: skaffold build --cache-artifacts=false --push=false --filename skaffold.yaml --profile buildx-cache --build-image "${{ matrix.image }}" | |
| # On push to main: create a {VERSION}.dev0 git tag if it doesn't exist yet. | |
| # A human promotes to the real tag (e.g. 2.2.0) to trigger release.yaml. | |
| tag: | |
| name: Tag | |
| needs: [fmt, test, skaffold-validate] | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Check if dev tag already exists | |
| id: check | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| version=$(cat VERSION 2>/dev/null | tr -d '[:space:]') | |
| if [[ -z "$version" ]]; then | |
| echo "No VERSION file; skipping." | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| dev_tag="${version}.dev0" | |
| echo "dev_tag=${dev_tag}" >> "$GITHUB_OUTPUT" | |
| if gh api /repos/${{ github.repository }}/git/ref/tags/${dev_tag} >/dev/null 2>&1; then | |
| echo "${dev_tag} already exists; skipping." | |
| echo "skip=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "skip=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Create tag | |
| if: steps.check.outputs.skip == 'false' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh api /repos/${{ github.repository }}/git/refs \ | |
| --method POST \ | |
| --field ref="refs/tags/${{ steps.check.outputs.dev_tag }}" \ | |
| --field sha="${{ github.sha }}" |