svcforge: reference implementation

Complete working build of the system learn-python/ teaches. 164 tests, mypy --strict clean, domain coverage 99%.
2026-07-17 10:44:54 +00:00
commit 50c2fe2a1e
102 changed files with 12018 additions and 0 deletions
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+#
+# CI's last act.
+#
+# Resolves the digest each service's commit-SHA tag points at, writes those digests into
+# deploy/chart/values.yaml, and commits. That commit is the deploy: ArgoCD is watching
+# master and picks it up. This script does not, and must not, talk to the cluster.
+#
+# Called by .gitea/workflows/ci.yaml on master only. Runnable by hand for a re-bump:
+#   REGISTRY=gitea.oci-oci.duckdns.org IMAGE_NS=gitea_admin IMAGE_TAG=<sha> ./scripts/bump-digests.sh
+#
+# -e   a failed inspect must not lead to committing a stale digest
+# -u   an unset REGISTRY would silently resolve the wrong image
+# -o pipefail   the digest comes out of a pipe; without this, a failing inspect that pipes
+#               into a successful grep exits 0 and writes garbage
+set -euo pipefail
+
+: "${REGISTRY:?REGISTRY must be set}"
+: "${IMAGE_NS:?IMAGE_NS must be set}"
+: "${IMAGE_TAG:?IMAGE_TAG must be set (the commit sha the images were built from)}"
+
+SERVICES=(api worker reconciler)
+CHART_VALUES="deploy/chart/values.yaml"
+
+# yq, pinned by digest. Not python+pyyaml: a yaml round-trip strips every comment in
+# values.yaml, and those comments are the only thing explaining why the digests are there.
+# yq edits in place and leaves the rest of the file alone.
+YQ_IMAGE="mikefarah/yq:4.44.6@sha256:b1d117c609ba990436ad1649299e2f6c378f62cb562caf30b6f2fb6144713422"
+
+WORKDIR="$(mktemp -d)"
+cleanup() {
+    rm -rf "${WORKDIR}"
+}
+trap cleanup EXIT
+
+yq() {
+    docker run --rm -v "${PWD}:/work" -w /work -u "$(id -u):$(id -g)" "${YQ_IMAGE}" "$@"
+}
+
+echo "==> resolving digests for tag ${IMAGE_TAG}"
+for svc in "${SERVICES[@]}"; do
+    image="${REGISTRY}/${IMAGE_NS}/svcforge-${svc}"
+    digest="$(docker buildx imagetools inspect "${image}:${IMAGE_TAG}" --format '{{.Manifest.Digest}}')"
+
+    # Defence against a silently empty inspect. Without this, `yq` would happily write an
+    # empty digest and the chart's own guard would fail the release later, further from
+    # the cause.
+    if [[ ! "${digest}" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+        echo "!! ${svc}: refusing to write a non-digest: '${digest}'" >&2
+        exit 1
+    fi
+
+    echo "    ${svc} -> ${digest}"
+    echo "${digest}" > "${WORKDIR}/${svc}.digest"
+done
+
+echo "==> writing ${CHART_VALUES}"
+for svc in "${SERVICES[@]}"; do
+    digest="$(cat "${WORKDIR}/${svc}.digest")"
+    # env(...) rather than string interpolation: a digest is attacker-controlled only in
+    # theory, but yq expression injection is not a thing worth leaving open.
+    DIGEST="${digest}" yq -i ".image.${svc}.digest = strenv(DIGEST)" "${CHART_VALUES}"
+done
+
+if git diff --quiet -- "${CHART_VALUES}"; then
+    echo "==> no digest changed; nothing to commit"
+    exit 0
+fi
+
+echo "==> committing"
+git config user.name "svcforge-ci"
+git config user.email "ci@svcforge.invalid"
+git add "${CHART_VALUES}"
+git commit -m "ci: bump image digests to ${IMAGE_TAG}
+
+Built and scanned by ${IMAGE_TAG}. ArgoCD syncs from this commit.
+
+[skip ci]"
+git push origin HEAD:master
+
+echo "==> done. ArgoCD owns it from here."