feat: add Proxmox provisioning service with CI and deployment tooling

2026-09-14 20:09:12 +02:00
commit 06c3474636
52 changed files with 9779 additions and 0 deletions
@@ -0,0 +1,144 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Protected runs get their own group; publication is queued at job level.
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}-${{ github.event_name != 'pull_request' && github.ref_protected && github.run_id || 'checks' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || !github.ref_protected }}
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+
+jobs:
+  python-tests:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      PIP_DISABLE_PIP_VERSION_CHECK: "1"
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Run Python tests
+        run: sh ci/python-tests.sh
+      - name: Upload JUnit report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: python-test-results
+          path: reports/pytest.xml
+          retention-days: 7
+          if-no-files-found: warn
+
+  javascript-check:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "24"
+          package-manager-cache: false
+      - name: Check JavaScript syntax
+        run: node --check provisioner/static/app.js
+
+  container-policy:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions: {}
+    outputs:
+      publish: ${{ steps.policy.outputs.publish }}
+    steps:
+      # Ref names are read from the runner environment, never inserted into shell code.
+      # The container script independently enforces these publication rules.
+      - name: Select verification or publication
+        id: policy
+        run: |
+          publish=false
+          if [[ "$GITHUB_REF_PROTECTED" == true ]] &&
+             [[ "$GITHUB_EVENT_NAME" == push || "$GITHUB_EVENT_NAME" == workflow_dispatch ]]; then
+            if [[ "$GITHUB_REF_TYPE" == branch && -n "$DEFAULT_BRANCH" && "$GITHUB_REF_NAME" == "$DEFAULT_BRANCH" ]] ||
+               [[ "$GITHUB_REF_TYPE" == tag && "$GITHUB_REF_NAME" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+              publish=true
+            fi
+          fi
+          printf 'publish=%s\n' "$publish" >> "$GITHUB_OUTPUT"
+
+  container-verify:
+    needs: [python-tests, javascript-check, container-policy]
+    if: ${{ needs.container-policy.outputs.publish == 'false' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      DOCKER_HOST: unix:///var/run/docker.sock
+      DOCKER_BUILDKIT: "1"
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - name: Check Docker tools
+        run: |
+          docker info
+          docker buildx version
+      - name: Build and smoke-test image
+        run: sh ci/container.sh verify
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: container-build
+          path: build.env
+          retention-days: 7
+          if-no-files-found: error
+
+  container-publish:
+    needs: [python-tests, javascript-check, container-policy]
+    if: ${{ needs.container-policy.outputs.publish == 'true' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: write
+    concurrency:
+      group: ghcr-container-publish
+      cancel-in-progress: false
+      queue: max
+    env:
+      DOCKER_HOST: unix:///var/run/docker.sock
+      DOCKER_BUILDKIT: "1"
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - name: Check Docker tools
+        run: |
+          docker info
+          docker buildx version
+      - name: Build, smoke-test and publish image
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: sh ci/container.sh publish
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: container-deploy
+          path: |
+            build.env
+            deploy.env
+          retention-days: 30
+          if-no-files-found: error