argoyleandClaude Opus 5.5
d041432772
schemas / vulnerabilities (pull_request) Successful in 38s
schemas / check (pull_request) Successful in 1m8s
schemas / check-release (pull_request) Successful in 1m7s
pre-commit / pre-commit (pull_request) Successful in 1m17s
schemas / build (pull_request) Successful in 1m36s
schemas / deploy-prod-frostmoln (pull_request) Skipped
The AWS deploy-prod job has failed since CI left AWS (no k8s.unbound.se context on the runners). Deploys now go to the Frostmoln production cluster (namespace schemas), the way the sites do. Frostmoln enforces restricted Pod Security: the pod runs as the image's non-root user with a matching securityContext. The prod-only manifests move to the prod-frostmoln target; the ALB ingress becomes a Traefik one with a Let's Encrypt certificate. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ma8eHhW59hLAJuLzBnLvUu
50 lines
1.8 KiB
Docker
50 lines
1.8 KiB
Docker
FROM amd64/golang:1.27.2@sha256:9e036bef9c3cd035cae4aeff523b3997c3c8aa993b13d112a71ea90143e87e48 as modules
|
|
WORKDIR /build
|
|
ADD go.* /build
|
|
RUN go mod download
|
|
|
|
FROM modules as build
|
|
ARG CI_COMMIT
|
|
WORKDIR /build
|
|
ENV CGO_ENABLED=0
|
|
ADD . /build
|
|
RUN CGO_ENABLED=1 go test -mod=readonly -race -coverprofile=coverage.txt.tmp -covermode=atomic -coverpkg=$(go list ./... | tr '\n' , | sed 's/,$//') ./...
|
|
RUN ["/bin/bash", "-c", "cat coverage.txt.tmp | grep -v testing.go | grep -v -f <(find . -type f | xargs grep -l 'Code generated by github.com/99designs/gqlgen, DO NOT EDIT') > coverage.txt"]
|
|
RUN go tool cover -html=coverage.txt -o coverage.html
|
|
RUN go tool cover -func=coverage.txt
|
|
RUN rm coverage.txt.tmp
|
|
|
|
RUN GOOS=linux GOARCH=amd64 go build \
|
|
-a -installsuffix cgo \
|
|
-mod=readonly \
|
|
-o /release/service \
|
|
-ldflags "-w -s -X main.buildVersion=${CI_COMMIT}" \
|
|
./cmd/service/service.go
|
|
|
|
FROM scratch as export
|
|
COPY --from=build /build/coverage.txt /
|
|
|
|
FROM node:24.21.0-alpine@sha256:ebfe2f90462722a7a4de65e91990e97fe0d401c70e0e762c5b53302f905ec1c1
|
|
ENV TZ Europe/Stockholm
|
|
|
|
# Install wgc CLI globally for Cosmo Router composition
|
|
RUN npm install -g wgc@latest
|
|
|
|
# Cap Node.js heap for runtime wgc invocations. 512MB leaves room for
|
|
# composing supergraphs with many subgraphs; lower caps (e.g. 64MB) OOM
|
|
# wgc as the subgraph count grows.
|
|
ENV NODE_OPTIONS="--max-old-space-size=512"
|
|
|
|
# Copy timezone data and certificates
|
|
COPY --from=build /usr/share/zoneinfo /usr/share/zoneinfo
|
|
COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
|
|
|
|
# Copy the service binary
|
|
COPY --from=build /release/service /
|
|
|
|
# The image's own non-root user: Frostmoln enforces restricted Pod Security.
|
|
# The service only writes under /tmp (cosmo composition).
|
|
USER node
|
|
|
|
CMD ["/service"]
|