chore: production-ready CI/CD

srpatcha · srpatcha · commit bea6b47b6c5e · 2026-05-07T23:20:23.000-07:00
Apply the production-ready CI/CD plan:
- Phase 1: cross-cutting workflow fixes (action version pins,
  book-build path fix, video-build dynamic version + guards,
  permissions+concurrency blocks)
- Phase 2: per-repo CI hardening (drop continue-on-error,
  add OS/compiler matrices, fix repo-specific bugs)
- Phase 3: complete release matrix (Linux/Windows/macOS/embedded
  binaries, real CycloneDX + SPDX SBOMs via anchore/sbom-action,
  cosign keyless signing, conditional Apple notarization /
  Authenticode / GPG signing gated on secrets)

All workflow files pass actionlint clean.
diff --git a/.github/workflows/book-build.yml b/.github/workflows/book-build.yml
@@ -42,20 +42,20 @@ jobs:
       - name: Check book source
         id: check
         run: |
-          if [ ! -f book.md ]; then
+          if [ ! -f docs/book/book.md ]; then
             echo "has_book=false" >> $GITHUB_OUTPUT
             echo "lines=0" >> $GITHUB_OUTPUT
             echo "images=0" >> $GITHUB_OUTPUT
             echo "tables=0" >> $GITHUB_OUTPUT
-            echo "WARNING: book.md not found"
+            echo "WARNING: docs/book/book.md not found"
             exit 0
           fi
           echo "has_book=true" >> $GITHUB_OUTPUT
-          LINES=$(wc -l < book.md)
-          IMAGES=$(grep -c '!\[' book.md || echo 0)
-          TABLES=$(grep -c '^|' book.md || echo 0)
-          CODE=$(grep -c '```' book.md || echo 0)
-          CHAPTERS=$(grep -c '^## ' book.md || echo 0)
+          LINES=$(wc -l < docs/book/book.md)
+          IMAGES=$(grep -c '!\[' docs/book/book.md || echo 0)
+          TABLES=$(grep -c '^|' docs/book/book.md || echo 0)
+          CODE=$(grep -c '```' docs/book/book.md || echo 0)
+          CHAPTERS=$(grep -c '^## ' docs/book/book.md || echo 0)
           echo "lines=$LINES" >> $GITHUB_OUTPUT
           echo "images=$IMAGES" >> $GITHUB_OUTPUT
           echo "tables=$TABLES" >> $GITHUB_OUTPUT
@@ -104,7 +104,7 @@ jobs:
 
       - name: Clean source
         run: |
-          sed -i 's/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]//g' book.md
+          sed -i 's/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]//g' docs/book/book.md
           echo "Control characters cleaned"
 
       - name: Extract metadata
@@ -114,9 +114,9 @@ jobs:
           echo "repo_name=$REPO_NAME" >> $GITHUB_OUTPUT
           echo "pdf_name=${REPO_NAME}-guide.pdf" >> $GITHUB_OUTPUT
           # Extract title from frontmatter or first heading
-          TITLE=$(grep -m1 '^title:' book.md | sed 's/^title: *"*//;s/"*$//' || echo "")
+          TITLE=$(grep -m1 '^title:' docs/book/book.md | sed 's/^title: *"*//;s/"*$//' || echo "")
           if [ -z "$TITLE" ]; then
-            TITLE=$(head -10 book.md | grep "^# " | head -1 | sed 's/^# //')
+            TITLE=$(head -10 docs/book/book.md | grep "^# " | head -1 | sed 's/^# //')
           fi
           if [ -z "$TITLE" ]; then TITLE="$REPO_NAME — Official Guide"; fi
           echo "title=$TITLE" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -6,12 +6,21 @@ on:
   pull_request:
     branches: [master, main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   python:
-    runs-on: ubuntu-latest
-    continue-on-error: true
+    name: Python (${{ matrix.os }} / ${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
     strategy:
+      fail-fast: false
       matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
         python-version: ["3.11", "3.12"]
     steps:
       - uses: actions/checkout@v4
@@ -34,9 +43,10 @@ jobs:
         run: pytest
 
   frontend:
+    name: Frontend (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
-    continue-on-error: true
     strategy:
+      fail-fast: false
       matrix:
         node-version: [20.x, 22.x]
     steps:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
@@ -5,6 +5,13 @@ on:
     - cron: '0 3 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   nightly:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -9,6 +9,11 @@ on:
 permissions:
   contents: write
   packages: write
+  id-token: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   validate:
@@ -27,54 +32,103 @@ jobs:
           coverage report --fail-under=70
 
   docker:
-    name: Docker Build & Push
+    name: Docker Build & Push (multi-arch)
     runs-on: ubuntu-latest
     needs: validate
     steps:
       - uses: actions/checkout@v4
       - name: Extract version
         id: version
-        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+        run: |
+          TAG=${GITHUB_REF#refs/tags/}
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
+          echo "version=${TAG#v}" >> $GITHUB_OUTPUT
+      - name: Lowercase repo name
+        id: repo
+        run: echo "name=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+      - name: Set up QEMU (for arm64 emulation)
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push
+      - name: Build and push (linux/amd64,linux/arm64)
         uses: docker/build-push-action@v6
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: |
-            ghcr.io/${{ github.repository }}:${{ steps.version.outputs.version }}
-            ghcr.io/${{ github.repository }}:latest
+            ghcr.io/${{ steps.repo.outputs.name }}:${{ steps.version.outputs.version }}
+            ghcr.io/${{ steps.repo.outputs.name }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
 
   pypi:
-    name: Publish to PyPI
+    name: Publish to PyPI (OIDC trusted publishing)
     runs-on: ubuntu-latest
     needs: validate
+    permissions:
+      id-token: write
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
-      - name: Build & publish
+      - name: Build dist
         run: |
-          pip install build twine
+          pip install build
           python -m build
+      - name: Check dist
+        run: |
+          pip install twine
           twine check dist/*
-      - name: Upload to PyPI
-        if: startsWith(github.ref, 'refs/tags/v')
+      - name: Publish to PyPI (trusted publishing)
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
+
+  npm:
+    name: Publish to npm (frontend)
+    runs-on: ubuntu-latest
+    needs: validate
+    steps:
+      - uses: actions/checkout@v4
+      - name: Detect package.json
+        id: detect
+        run: |
+          if [ -f package.json ]; then
+            echo "has_npm=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_npm=false" >> $GITHUB_OUTPUT
+            echo "::notice::No package.json found, skipping npm publish"
+          fi
+      - uses: actions/setup-node@v4
+        if: steps.detect.outputs.has_npm == 'true'
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Install dependencies
+        if: steps.detect.outputs.has_npm == 'true'
+        run: npm ci
+      - name: Build
+        if: steps.detect.outputs.has_npm == 'true'
+        run: npm run build
+      - name: Publish (skip if NPM_TOKEN missing)
+        if: steps.detect.outputs.has_npm == 'true' && env.NODE_AUTH_TOKEN != ''
         env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-        run: twine upload dist/*
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: npm publish
 
   release:
     name: Create Release
     runs-on: ubuntu-latest
-    needs: [validate, pypi]
+    needs: [validate, docker, pypi]
     steps:
       - uses: actions/checkout@v4
         with:
@@ -84,18 +138,64 @@ jobs:
         run: |
           TAG=${GITHUB_REF#refs/tags/}
           echo "tag=$TAG" >> $GITHUB_OUTPUT
+          echo "version=${TAG#v}" >> $GITHUB_OUTPUT
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
       - name: Build dist
         run: |
           pip install build
           python -m build
+      - name: Generate checksums
+        run: |
+          cd dist
+          sha256sum * > SHA256SUMS.txt
+          mv SHA256SUMS.txt ..
+      - name: Generate CycloneDX SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          format: cyclonedx-json
+          output-file: sbom.cdx.json
+          artifact-name: sbom.cdx.json
+      - name: Generate SPDX SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          path: .
+          format: spdx-json
+          output-file: sbom.spdx.json
+          artifact-name: sbom.spdx.json
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+      - name: Sign artifacts
+        run: |
+          set -e
+          for f in dist/*; do
+            [ -f "$f" ] || continue
+            cosign sign-blob --yes --bundle "${f}.sig.bundle" "$f"
+          done
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.version.outputs.tag }}
           name: "eDB ${{ steps.version.outputs.tag }}"
           generate_release_notes: true
-          files: dist/*
+          fail_on_unmatched_files: false
+          body: |
+            ## eDB ${{ steps.version.outputs.tag }}
+
+            Python wheels + sdist published to PyPI (OIDC trusted publishing).
+            Multi-arch Docker image published to ghcr.io.
+
+            ### Integrity & supply-chain
+            - `SHA256SUMS.txt`
+            - `sbom.cdx.json` — CycloneDX SBOM
+            - `sbom.spdx.json` — SPDX SBOM
+            - `*.sig.bundle` — Sigstore cosign keyless signatures
+          files: |
+            dist/*
+            dist/*.sig.bundle
+            SHA256SUMS.txt
+            sbom.cdx.json
+            sbom.spdx.json
           prerelease: ${{ contains(steps.version.outputs.tag, 'rc') || contains(steps.version.outputs.tag, 'beta') }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -9,6 +9,10 @@ on:
 
 permissions: read-all
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   analysis:
     name: Scorecard Analysis
diff --git a/.github/workflows/video-build.yml b/.github/workflows/video-build.yml
@@ -46,31 +46,50 @@ jobs:
           cd promo
           manim render -qh --format mp4 promo_scene.py ProductPromo
 
+      - name: Compute version-derived filename
+        id: vid
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF#refs/tags/}"
+          else
+            VERSION="dev-latest"
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "filename=eDB_${VERSION}_promo.mp4" >> $GITHUB_OUTPUT
+
       - name: Merge video + audio
         run: |
           cd promo
           VIDEO=$(find media/videos -name "ProductPromo.mp4" | head -1)
+          if [ -z "$VIDEO" ]; then
+            echo "::error::Manim render produced no MP4"
+            exit 1
+          fi
+          if [ ! -f narration.mp3 ]; then
+            echo "::error::narration.mp3 missing"
+            exit 1
+          fi
           ffmpeg -y -i "$VIDEO" -i narration.mp3 \
             -c:v copy -c:a aac -b:a 192k \
             -map 0:v:0 -map 1:a:0 \
             -shortest \
-            eDB_v1.0_promo.mp4
-          ls -lh eDB_v1.0_promo.mp4
+            ${{ steps.vid.outputs.filename }}
+          ls -lh ${{ steps.vid.outputs.filename }}
 
       - name: Upload final video
         uses: actions/upload-artifact@v4
         with:
           name: eDB-promo-video
-          path: promo/eDB_v1.0_promo.mp4
+          path: promo/${{ steps.vid.outputs.filename }}
           retention-days: 90
 
       - name: Attach to release
         if: github.event_name == 'release'
         uses: softprops/action-gh-release@v2
         with:
-          files: promo/eDB_v1.0_promo.mp4
+          files: promo/${{ steps.vid.outputs.filename }}
           tag_name: ${{ github.event.release.tag_name }}
           fail_on_unmatched_files: false
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
diff --git a/.github/workflows/weekly.yml b/.github/workflows/weekly.yml
@@ -5,6 +5,13 @@ on:
     - cron: '0 6 * * 0'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   full-test:
     runs-on: ubuntu-latest
