feat(coordinator): reviewed SHU-71 M4 prerequisite provisioning entrypoint (SHU-251) #597

Workflow file for this run

	name: Platform CI

	on:
	pull_request:
	push:
	branches: [main]

	permissions:
	contents: read

	jobs:
	coordinator-future-clock:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v4
	with:
	persist-credentials: false
	- uses: actions/setup-node@v4
	with:
	node-version: 22
	- name: Assert service verification prerequisites
	run: \|
	# Host artifacts require /usr/bin/node; setup-node supplies a tool-cache binary.
	runner_node="$(command -v node)"
	test -x "$runner_node"
	if [ "$(readlink -f /usr/bin/node)" != "$(readlink -f "$runner_node")" ]; then
	sudo ln -sfn "$runner_node" /usr/bin/node
	fi
	test -x /usr/bin/node
	test "$(/usr/bin/node -p 'process.execPath')" = "$(node -p 'process.execPath')"
	systemd-analyze --version && test -x /usr/bin/flock
	- name: Entire coordinator suite with wall clock advanced 365 days
	env:
	SHU_TEST_CLOCK_OFFSET_MS: '31536000000'
	run: \|
	export NODE_OPTIONS="--import=${GITHUB_WORKSPACE}/.github/coordinator/test/fixture/shift-wall-clock.mjs"
	npm run test:coordinator
	coordinator-git243:
	# The orchestrator compatibility floor is Git 2.43. A newer runner's Git
	# previously hid a distinct-UID upload-pack ownership refusal.
	runs-on: ubuntu-24.04
	container: ubuntu:24.04
	timeout-minutes: 10
	steps:
	- name: Install and assert the Git 2.43 compatibility floor
	run: \|
	apt-get update -qq
	apt-get install -y --no-install-recommends git ca-certificates util-linux
	test "$(git --version)" = "git version 2.43.0"
	git --version
	setpriv --reuid=65534 --regid=65534 --clear-groups id -u
	- uses: actions/checkout@v4
	with:
	persist-credentials: false
	- uses: actions/setup-node@v4
	with:
	node-version: 22
	- name: Real Git and distinct-UID episode, including scoped bundle transport
	run: node --test .github/coordinator/test/attempt-workspace.test.mjs .github/coordinator/test/workspace-result.test.mjs .github/coordinator/test/workspace-result-mutations.test.mjs .github/coordinator/test/shu241-scoped-build.test.mjs .github/coordinator/test/shu241-mutations.test.mjs
	fast-checks:
	runs-on: ubuntu-latest
	timeout-minutes: 15
	# The db suite (packages/db) runs against a real Postgres on every PR:
	# migrations apply to a scratch database and the store's integrity +
	# concurrency tests execute there — the same reason Opus asked for CI to
	# apply migrations to a scratch DB per PR.
	services:
	postgres:
	image: postgres:17-alpine
	env:
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: ci-only-placeholder
	POSTGRES_DB: studenthub_authz
	ports:
	- 55432:5432
	options: >-
	--health-cmd "pg_isready -U postgres"
	--health-interval 5s
	--health-timeout 5s
	--health-retries 10
	env:
	DATABASE_URL: postgres://postgres:ci-only-placeholder@localhost:55432/studenthub_authz
	steps:
	- uses: actions/checkout@v4
	with:
	persist-credentials: false
	- uses: actions/setup-node@v4
	with:
	node-version: 22
	cache: npm
	- run: npm ci --ignore-scripts
	- run: npm run typecheck
	# Deterministic coordinator dry-run package (dispatch disabled): pure JS,
	# no build step — runs directly via node --test.
	- name: Assert service verification prerequisites
	run: \|
	# Host artifacts require /usr/bin/node; setup-node supplies a tool-cache binary.
	runner_node="$(command -v node)"
	test -x "$runner_node"
	if [ "$(readlink -f /usr/bin/node)" != "$(readlink -f "$runner_node")" ]; then
	sudo ln -sfn "$runner_node" /usr/bin/node
	fi
	test -x /usr/bin/node
	test "$(/usr/bin/node -p 'process.execPath')" = "$(node -p 'process.execPath')"
	systemd-analyze --version && test -x /usr/bin/flock
	- run: npm run test:coordinator
	# npm test is the no-external-dependencies suite; the db suite needs the
	# postgres service above, so it runs as its own explicit step (test:db).
	# Both are required for the PR to be green.
	- run: npm test
	- run: npm run test:db
	- run: npm run build
	- name: Validate Coolify Compose package
	env:
	SOURCE_REVISION: ${{ github.sha }}
	PLATFORM_DB_NAME: studenthub
	PLATFORM_DB_USER: studenthub
	PLATFORM_DB_PASSWORD: ci-only-placeholder
	PLATFORM_DATABASE_URL: postgresql://studenthub:ci-only-placeholder@platform-postgres:5432/studenthub
	OIDC_ISSUER: https://auth.example.test/application/o/studenthub/
	OIDC_CLIENT_ID: studenthub
	OIDC_CLIENT_SECRET: ci-only-placeholder
	OIDC_CALLBACK_URL: https://studenthub.example.test/login/callback
	OIDC_AUTHORIZATION_URL: https://auth.example.test/application/o/authorize/
	OIDC_TOKEN_URL: https://auth.example.test/application/o/token/
	OIDC_JWKS_URL: https://auth.example.test/application/o/studenthub/jwks/
	LOGIN_ALLOWED_RETURN_URLS: https://studenthub.example.test/
	run: docker compose -f deploy/coolify/compose.yaml config --quiet
	image-smoke:
	name: gateway-image-smoke
	runs-on: ubuntu-latest
	timeout-minutes: 15
	services:
	postgres:
	image: postgres:17-alpine
	env:
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: ci-only-placeholder
	POSTGRES_DB: studenthub_authz
	ports:
	- 55432:5432
	options: >-
	--health-cmd "pg_isready -U postgres"
	--health-interval 5s
	--health-timeout 5s
	--health-retries 10
	steps:
	- uses: actions/checkout@v4
	with:
	persist-credentials: false
	- name: Build deployable gateway image
	run: docker build --file Dockerfile --build-arg SOURCE_REVISION="${GITHUB_SHA}" --tag gateway-image-smoke .
	- name: 'IMAGE_SMOKE: /health must return 200 from the built image'
	env:
	DATABASE_URL: postgres://postgres:ci-only-placeholder@localhost:55432/studenthub_authz
	run: bash deploy/coolify/image-smoke.sh gateway-image-smoke

Navigation Menu

feat(coordinator): reviewed SHU-71 M4 prerequisite provisioning entrypoint (SHU-251) #597

Workflow file

feat(coordinator): reviewed SHU-71 M4 prerequisite provisioning entrypoint (SHU-251) #597

Uh oh!

Workflow file for this run