AkurAI-PassVault / .akurai.yml

Latest change a695077fe727a9e8fe3947fefcff06bf02f3baf2 - OLI-188: roll out lint-config CI job and sibling-dep lint by Ólafur Búi Ólafsson

version: 1
jobs:
  - name: lint-config
    executor: native
    branches: [main]
    run:
      - sh scripts/test-lint-akurai-yml.sh
      - sh scripts/test-lint-sibling-deps.sh
      - sh scripts/lint-akurai-yml.sh .akurai.yml
      - sh scripts/lint-sibling-deps.sh

  - name: verify
    needs: [lint-config]
    executor: native
    branches: [main]
    run:
      - rm -rf ../AkurAI-Framework; git clone --quiet --no-checkout $AKURAI_BUILD_DATA/hosted/AkurAI-Framework.git ../AkurAI-Framework; git -C ../AkurAI-Framework checkout --quiet --detach 64c0dba2296e41722c261d7a9c4d804cb4fdc020; test "$(git -C ../AkurAI-Framework rev-parse HEAD)" = 64c0dba2296e41722c261d7a9c4d804cb4fdc020
      - RUSTUP_HOME=$AKURAI_HOST_HOME/.rustup CARGO_HOME=$AKURAI_HOST_HOME/.cargo PATH=$AKURAI_HOST_HOME/.cargo/bin:/usr/bin:/bin cargo fmt --all -- --check
      - RUSTUP_HOME=$AKURAI_HOST_HOME/.rustup CARGO_HOME=$AKURAI_HOST_HOME/.cargo PATH=$AKURAI_HOST_HOME/.cargo/bin:/usr/bin:/bin cargo clippy --all-targets --all-features -- -D warnings
      - RUSTUP_HOME=$AKURAI_HOST_HOME/.rustup CARGO_HOME=$AKURAI_HOST_HOME/.cargo PATH=$AKURAI_HOST_HOME/.cargo/bin:/usr/bin:/bin cargo test --all

  - name: package
    needs: [verify]
    executor: native
    branches: [main]
    run: RUSTUP_HOME=$AKURAI_HOST_HOME/.rustup CARGO_HOME=$AKURAI_HOST_HOME/.cargo PATH=$AKURAI_HOST_HOME/.cargo/bin:/usr/bin:/bin cargo build --release --target x86_64-unknown-linux-musl -p akurai-passvault
    artifacts:
      - target/x86_64-unknown-linux-musl/release/akurai-passvault

  - name: deploy
    needs: [package]
    executor: native
    environment: production
    approval: true
    branches: [main]
    run: |
      export HOME=$AKURAI_HOST_HOME
      export PATH=$AKURAI_HOST_HOME/.local/bin:/usr/bin:/bin
      HOST=akurai-ec2
      BIN=target/x86_64-unknown-linux-musl/release/akurai-passvault
      test -f "$BIN" || { echo "missing packaged binary: $BIN" >&2; exit 1; }

      echo "==> provision OIDC configuration"
      bash scripts/provision-oidc.sh

      echo "==> ship binary (backup previous)"
      scp -q "$BIN" "$HOST:/tmp/akurai-passvault.new"
      ssh "$HOST" 'sudo mkdir -p /opt/akurai-passvault/bin /var/lib/akurai-passvault /etc/akurai-passvault && { [ -f /opt/akurai-passvault/bin/akurai-passvault ] && sudo cp -p /opt/akurai-passvault/bin/akurai-passvault /opt/akurai-passvault/bin/akurai-passvault.prev || true; } && sudo install -m 755 -o ubuntu -g ubuntu /tmp/akurai-passvault.new /opt/akurai-passvault/bin/akurai-passvault && rm -f /tmp/akurai-passvault.new'

      echo "==> systemd unit"
      scp -q deploy/akurai-passvault.service "$HOST:/tmp/akurai-passvault.service"
      ssh "$HOST" 'sudo install -m 644 /tmp/akurai-passvault.service /etc/systemd/system/akurai-passvault.service && rm -f /tmp/akurai-passvault.service && sudo systemctl daemon-reload && sudo systemctl enable akurai-passvault.service'

      echo "==> nginx vhost"
      scp -q deploy/akurai-passvault.nginx.conf "$HOST:/tmp/akurai-passvault.nginx"
      ssh "$HOST" 'sudo install -m 644 /tmp/akurai-passvault.nginx /etc/nginx/sites-available/akurai-passvault.olibuijr.com && sudo ln -sf /etc/nginx/sites-available/akurai-passvault.olibuijr.com /etc/nginx/sites-enabled/akurai-passvault.olibuijr.com && rm -f /tmp/akurai-passvault.nginx && sudo nginx -t && sudo systemctl reload nginx'

      echo "==> env guard"
      ssh "$HOST" 'sudo test -f /etc/akurai-passvault/env'

      echo "==> restart service"
      ssh "$HOST" 'sudo systemctl restart akurai-passvault.service'

      echo "==> self healthcheck (rollback on failure)"
      sleep 3
      if ! ssh "$HOST" 'curl -fsS http://127.0.0.1:8102/api/health' >/dev/null; then
        echo "self health failed; rolling back to previous binary" >&2
        ssh "$HOST" 'sudo cp -p /opt/akurai-passvault/bin/akurai-passvault.prev /opt/akurai-passvault/bin/akurai-passvault && sudo systemctl restart akurai-passvault.service'
        exit 1
      fi

      echo "==> cross-environment health sweep"
      akurai-health-sweep --self akurai-passvault