Jason Woltje
da038d3df2
The woodpeckerci/plugin-docker-buildx plugin was failing with "insufficient_scope: authorization failed" when pushing to Harbor, even though the same credentials worked locally. Switched to the standard plugins/docker which uses traditional docker login authentication that may work better with Harbor. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
148 lines
3.3 KiB
YAML
148 lines
3.3 KiB
YAML
# Woodpecker CI Quality Enforcement Pipeline - Monorepo
|
|
when:
|
|
- event: [push, pull_request, manual]
|
|
|
|
variables:
|
|
- &node_image "node:20-alpine"
|
|
- &install_deps |
|
|
corepack enable
|
|
pnpm install --frozen-lockfile
|
|
- &use_deps |
|
|
corepack enable
|
|
|
|
steps:
|
|
install:
|
|
image: *node_image
|
|
commands:
|
|
- *install_deps
|
|
|
|
security-audit:
|
|
image: *node_image
|
|
commands:
|
|
- *use_deps
|
|
- pnpm audit --audit-level=high
|
|
depends_on:
|
|
- install
|
|
|
|
lint:
|
|
image: *node_image
|
|
environment:
|
|
SKIP_ENV_VALIDATION: "true"
|
|
commands:
|
|
- *use_deps
|
|
- pnpm lint || true # Non-blocking while fixing legacy code
|
|
depends_on:
|
|
- install
|
|
when:
|
|
- evaluate: 'CI_PIPELINE_EVENT != "pull_request" || CI_COMMIT_BRANCH != "main"'
|
|
|
|
prisma-generate:
|
|
image: *node_image
|
|
environment:
|
|
SKIP_ENV_VALIDATION: "true"
|
|
commands:
|
|
- *use_deps
|
|
- pnpm --filter "@mosaic/api" prisma:generate
|
|
depends_on:
|
|
- install
|
|
|
|
typecheck:
|
|
image: *node_image
|
|
environment:
|
|
SKIP_ENV_VALIDATION: "true"
|
|
commands:
|
|
- *use_deps
|
|
- pnpm typecheck
|
|
depends_on:
|
|
- prisma-generate
|
|
|
|
test:
|
|
image: *node_image
|
|
environment:
|
|
SKIP_ENV_VALIDATION: "true"
|
|
commands:
|
|
- *use_deps
|
|
- pnpm test || true # Non-blocking while fixing legacy tests
|
|
depends_on:
|
|
- prisma-generate
|
|
|
|
build:
|
|
image: *node_image
|
|
environment:
|
|
SKIP_ENV_VALIDATION: "true"
|
|
NODE_ENV: "production"
|
|
commands:
|
|
- *use_deps
|
|
- pnpm build
|
|
depends_on:
|
|
- typecheck # Only block on critical checks
|
|
- security-audit
|
|
- prisma-generate
|
|
|
|
# ======================
|
|
# Docker Build & Push (main/develop only)
|
|
# ======================
|
|
# Requires secrets: harbor_username, harbor_password
|
|
|
|
docker-build-api:
|
|
image: plugins/docker
|
|
settings:
|
|
registry: reg.mosaicstack.dev
|
|
repo: reg.mosaicstack.dev/mosaic/api
|
|
dockerfile: apps/api/Dockerfile
|
|
context: .
|
|
tags:
|
|
- "${CI_COMMIT_SHA:0:8}"
|
|
- latest
|
|
username:
|
|
from_secret: harbor_username
|
|
password:
|
|
from_secret: harbor_password
|
|
when:
|
|
- branch: [main, develop]
|
|
event: [push, manual]
|
|
depends_on:
|
|
- build
|
|
|
|
docker-build-web:
|
|
image: plugins/docker
|
|
settings:
|
|
registry: reg.mosaicstack.dev
|
|
repo: reg.mosaicstack.dev/mosaic/web
|
|
dockerfile: apps/web/Dockerfile
|
|
context: .
|
|
build_args:
|
|
- NEXT_PUBLIC_API_URL=https://api.mosaicstack.dev
|
|
tags:
|
|
- "${CI_COMMIT_SHA:0:8}"
|
|
- latest
|
|
username:
|
|
from_secret: harbor_username
|
|
password:
|
|
from_secret: harbor_password
|
|
when:
|
|
- branch: [main, develop]
|
|
event: [push, manual]
|
|
depends_on:
|
|
- build
|
|
|
|
docker-build-postgres:
|
|
image: plugins/docker
|
|
settings:
|
|
registry: reg.mosaicstack.dev
|
|
repo: reg.mosaicstack.dev/mosaic/postgres
|
|
dockerfile: docker/postgres/Dockerfile
|
|
context: docker/postgres
|
|
tags:
|
|
- "${CI_COMMIT_SHA:0:8}"
|
|
- latest
|
|
username:
|
|
from_secret: harbor_username
|
|
password:
|
|
from_secret: harbor_password
|
|
when:
|
|
- branch: [main, develop]
|
|
event: [push, manual]
|
|
depends_on:
|
|
- build
|