argoyle
3709a90124
schemas / vulnerabilities (push) Successful in 1m2s
schemas / check (push) Successful in 1m9s
Unbound Release / Check Preconditions (push) Successful in 2s
Unbound Release / Create Release (push) Skipped
schemas / check-release (push) Successful in 1m23s
pre-commit / pre-commit (push) Successful in 1m47s
Unbound Release / Generate Changelog and Handle PR (push) Successful in 10s
Unbound Release / Create Tag (push) Successful in 6s
Release / release (push) Successful in 2m24s
schemas / build (push) Successful in 2m10s
schemas / deploy-prod-frostmoln (push) Successful in 1m2s
Moves the production deploy from AWS to the Frostmoln production cluster (namespace `schemas`). - `deploy-prod` (AWS) has failed since CI left AWS (no `k8s.unbound.se` context on the runners). It's replaced by `deploy-prod-frostmoln`, as in unbound-site/lingonpaj-site: `deploy prod-frostmoln -n schemas` with the org's `FROSTMOLN_PRODUCTION_DEPLOY_KEY`, `FROSTMOLN_PRODUCTION_CLUSTER_ID` and `BUILDTOOLS_FROSTMOLN_PRODUCTION`. - Restricted Pod Security: the image runs as `node` (uid 1000) with a matching securityContext. The service only writes under `/tmp` (cosmo composition). - `secrets.yaml` (AWS ClusterSecretStore, RDS + CloudAMQP) → `secrets-prod-frostmoln.yaml`: the namespace's `frostmoln` SecretStore and the Frostmoln Secret `schemas` (`POSTGRES_URL`, `AMQP_URL`, `API_KEY`), written by infra's `seed-schemas.sh`. The file had no target suffix, so it applied to every target. - `config-prod`/`pdb-prod` → `-prod-frostmoln`; the ALB ingress → a Traefik one for `/query` with a Let's Encrypt certificate. Checked locally (amd64): runs as uid 1000 with all capabilities dropped, `wgc` works, `/tmp` writable; it fails only on the (dummy) database, as expected. **Merge after** infra#1878 is applied and `seed-schemas.sh` + `migrate-schemas-db.sh` have run. `schemas.unbound.se` keeps pointing at AWS until the cut-over. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu Reviewed-on: #1019
50 lines
1.8 KiB
Docker
50 lines
1.8 KiB
Docker
FROM amd64/golang:1.27.2@sha256:9e036bef9c3cd035cae4aeff523b3997c3c8aa993b13d112a71ea90143e87e48 as modules
|
|
WORKDIR /build
|
|
ADD go.* /build
|
|
RUN go mod download
|
|
|
|
FROM modules as build
|
|
ARG CI_COMMIT
|
|
WORKDIR /build
|
|
ENV CGO_ENABLED=0
|
|
ADD . /build
|
|
RUN CGO_ENABLED=1 go test -mod=readonly -race -coverprofile=coverage.txt.tmp -covermode=atomic -coverpkg=$(go list ./... | tr '\n' , | sed 's/,$//') ./...
|
|
RUN ["/bin/bash", "-c", "cat coverage.txt.tmp | grep -v testing.go | grep -v -f <(find . -type f | xargs grep -l 'Code generated by github.com/99designs/gqlgen, DO NOT EDIT') > coverage.txt"]
|
|
RUN go tool cover -html=coverage.txt -o coverage.html
|
|
RUN go tool cover -func=coverage.txt
|
|
RUN rm coverage.txt.tmp
|
|
|
|
RUN GOOS=linux GOARCH=amd64 go build \
|
|
-a -installsuffix cgo \
|
|
-mod=readonly \
|
|
-o /release/service \
|
|
-ldflags "-w -s -X main.buildVersion=${CI_COMMIT}" \
|
|
./cmd/service/service.go
|
|
|
|
FROM scratch as export
|
|
COPY --from=build /build/coverage.txt /
|
|
|
|
FROM node:24.22.0-alpine@sha256:44fce696f38ba8c987c4db89954051000bbd05ffd8d8659ba15ed4a8602e937f
|
|
ENV TZ Europe/Stockholm
|
|
|
|
# Install wgc CLI globally for Cosmo Router composition
|
|
RUN npm install -g wgc@latest
|
|
|
|
# Cap Node.js heap for runtime wgc invocations. 512MB leaves room for
|
|
# composing supergraphs with many subgraphs; lower caps (e.g. 64MB) OOM
|
|
# wgc as the subgraph count grows.
|
|
ENV NODE_OPTIONS="--max-old-space-size=512"
|
|
|
|
# Copy timezone data and certificates
|
|
COPY --from=build /usr/share/zoneinfo /usr/share/zoneinfo
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
|
|
# Copy the service binary
|
|
COPY --from=build /release/service /
|
|
|
|
# The image's own non-root user: Frostmoln enforces restricted Pod Security.
|
|
# The service only writes under /tmp (cosmo composition).
|
|
USER node
|
|
|
|
CMD ["/service"]
|