Sync from deal-sage/deal-sage@13a420d134

pipeline/scripts/build.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Build the app with the DealSage connection baked in from org variables, and
+# record the build as a check so DealSage shows it beside the declared ones.
+set -euo pipefail
+. "$(dirname "$0")/lib.sh"
+require_env APP_ID DEALSAGE_FUNCTIONS_URL PUBLISH_TOKEN SUPABASE_ANON_KEY SUPABASE_URL
+git_context
+
+logf="$(mktemp)"; started="$(iso_now)"; t0="$(now_ms)"
+echo "::group::build"
+set +e
+VITE_SUPABASE_URL="$SUPABASE_URL" VITE_SUPABASE_ANON_KEY="$SUPABASE_ANON_KEY" \
+  npm run build 2>&1 | tee "$logf"
+rc=${PIPESTATUS[0]}
+set -e
+echo "::endgroup::"
+dur=$(( $(now_ms) - t0 ))
+if [ "$rc" = 0 ] && [ ! -f dist/index.html ]; then
+  echo "build succeeded but dist/index.html is missing" | tee -a "$logf"; rc=2
+fi
+status=passed; summary="built in $(( dur / 1000 ))s"
+[ "$rc" = 0 ] || { status=failed; summary="exit code $rc"; }
+
+payload="$(jq -n \
+  --arg appId "$APP_ID" --arg sha "$COMMIT_SHA" --arg branch "$BRANCH" \
+  --arg status "$status" --argjson duration "$dur" --arg summary "$summary" --rawfile log "$logf" \
+  --arg started "$started" --arg finished "$(iso_now)" \
+  '{appId:$appId, commitSha:$sha, branch:$branch, checkId:"build", name:"Build", status:$status,
+    required:true, durationMs:$duration, summary:$summary,
+    logTail:($log | split("\n") | .[-80:] | join("\n")), reportedBy:"ci",
+    startedAt:$started, finishedAt:$finished}')"
+ds_post record-app-check "$payload" >/dev/null || warn "could not record the build check in DealSage"
+rm -f "$logf"
+summary "- build: **$status** (${dur}ms)"
+[ "$rc" = 0 ] || die "Build failed ($summary); nothing was published."
+log "Build ok: $(find dist -type f | wc -l) files"

pipeline/scripts/ensure-tools.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Make sure the runner has what the pipeline shells out to: curl and jq always,
+# the AWS CLI only when bundles go to R2 through the S3 API (no
+# CUSTOM_APPS_WORKER_URL). Installs are apt-based, matching the runner image.
+set -euo pipefail
+. "$(dirname "$0")/lib.sh"
+
+need_apt=()
+command -v curl >/dev/null || need_apt+=(curl)
+command -v jq >/dev/null || need_apt+=(jq)
+if [ "${#need_apt[@]}" -gt 0 ]; then
+  log "Installing ${need_apt[*]}"
+  apt-get update -qq && apt-get install -y -qq --no-install-recommends "${need_apt[@]}" >/dev/null
+fi
+
+if [ -z "${CUSTOM_APPS_WORKER_URL:-}" ] && ! command -v aws >/dev/null; then
+  log "Installing the AWS CLI (bundle upload goes to R2 over S3)"
+  command -v unzip >/dev/null || { apt-get update -qq && apt-get install -y -qq --no-install-recommends unzip >/dev/null; }
+  curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
+  unzip -q -o /tmp/awscliv2.zip -d /tmp
+  /tmp/aws/install >/dev/null
+fi
+echo "tools ready: curl $(curl --version | head -n1 | cut -d' ' -f2), jq $(jq --version)$( command -v aws >/dev/null && echo ", aws $(aws --version 2>&1 | cut -d' ' -f1)")"

pipeline/scripts/lib.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# Shared helpers for the DealSage custom-app pipeline scripts. Sourced, not run.
+#
+# Conventions:
+#   * Every script is `set -euo pipefail` and sources this file first.
+#   * DealSage is reached only through DEALSAGE_FUNCTIONS_URL with the app's
+#     PUBLISH_TOKEN (appId-scoped, minted by DealSage). Nothing here holds a
+#     Supabase service key or an R2 account key.
+#   * Output meant for the job log goes through log(); machine-readable state
+#     is exchanged through $GITHUB_ENV / $GITHUB_OUTPUT like any other action.
+
+log() { printf '::group::%s\n' "$*" >/dev/null; printf '\n== %s\n' "$*"; }
+warn() { printf '::warning::%s\n' "$*"; }
+die() { printf '::error::%s\n' "$*"; exit 1; }
+
+# now_ms — wall clock in milliseconds (GNU date; falls back to seconds*1000).
+now_ms() { date +%s%3N 2>/dev/null || echo $(( $(date +%s) * 1000 )); }
+
+# iso_now — UTC timestamp for API payloads.
+iso_now() { date -u +%Y-%m-%dT%H:%M:%SZ; }
+
+# require_env NAME... — fail loudly when a required variable is missing.
+require_env() {
+  local missing=0 v
+  for v in "$@"; do
+    if [ -z "${!v:-}" ]; then printf '::error::%s is not set\n' "$v"; missing=1; fi
+  done
+  [ "$missing" = 0 ] || exit 1
+}
+
+# json_escape STRING — JSON string literal (with quotes) via jq.
+json_escape() { jq -Rn --arg s "$1" '$s'; }
+
+# tail_file FILE [LINES] — last LINES lines of FILE (default 80), for log tails.
+tail_file() { tail -n "${2:-80}" "$1" 2>/dev/null || true; }
+
+# ds_post PATH JSON — POST JSON to a DealSage function with the publish token.
+# Prints the response body; returns non-zero on HTTP failure (body still printed
+# to stderr so the job log shows why).
+ds_post() {
+  local path="$1" body="$2" out code
+  out="$(mktemp)"
+  code="$(curl -sS -o "$out" -w '%{http_code}' -X POST \
+    "${DEALSAGE_FUNCTIONS_URL%/}/${path}" \
+    -H "Authorization: Bearer ${PUBLISH_TOKEN}" \
+    -H "apikey: ${SUPABASE_ANON_KEY}" \
+    -H "content-type: application/json" \
+    --data-binary "$body")" || { cat "$out" >&2; rm -f "$out"; return 1; }
+  if [ "${code:0:1}" != "2" ]; then
+    printf 'DealSage %s returned HTTP %s: ' "$path" "$code" >&2; cat "$out" >&2; echo >&2
+    rm -f "$out"; return 1
+  fi
+  cat "$out"; rm -f "$out"
+}
+
+# git_context — export the commit/branch/author the pipeline is publishing.
+# Gitea Actions provides the GITHUB_* variables; the event payload carries the
+# head commit. Falls back to git itself (the checkout has the commit).
+git_context() {
+  local ev="${GITHUB_EVENT_PATH:-}"
+  COMMIT_SHA="${GITHUB_SHA:-$(git rev-parse HEAD 2>/dev/null || echo unknown)}"
+  BRANCH="${GITHUB_REF_NAME:-}"
+  if [ -z "$BRANCH" ]; then
+    BRANCH="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)"
+  fi
+  COMMIT_MESSAGE=""; COMMIT_AUTHOR=""
+  if [ -n "$ev" ] && [ -f "$ev" ]; then
+    COMMIT_MESSAGE="$(jq -r '.head_commit.message // .commits[-1].message // empty' "$ev" 2>/dev/null || true)"
+    COMMIT_AUTHOR="$(jq -r '.head_commit.author.name // .pusher.login // .pusher.username // empty' "$ev" 2>/dev/null || true)"
+  fi
+  [ -n "$COMMIT_MESSAGE" ] || COMMIT_MESSAGE="$(git log -1 --pretty=%B 2>/dev/null | head -c 2000 || true)"
+  [ -n "$COMMIT_AUTHOR" ] || COMMIT_AUTHOR="$(git log -1 --pretty=%an 2>/dev/null || echo "${GITHUB_ACTOR:-}")"
+  # First line only for the summary field; the full message travels separately.
+  COMMIT_SUBJECT="$(printf '%s' "$COMMIT_MESSAGE" | head -n 1 | head -c 200)"
+  export COMMIT_SHA BRANCH COMMIT_MESSAGE COMMIT_AUTHOR COMMIT_SUBJECT
+}
+
+# persist_env NAME VALUE — make a value visible to later composite steps.
+persist_env() {
+  if [ -n "${GITHUB_ENV:-}" ]; then
+    # Heredoc form handles multi-line values safely.
+    { printf '%s<<__DS_EOF__\n' "$1"; printf '%s\n' "$2"; printf '__DS_EOF__\n'; } >> "$GITHUB_ENV"
+  fi
+  export "$1=$2"
+}
+
+# summary MARKDOWN — append to the run's step summary when the runner supports it.
+summary() { [ -n "${GITHUB_STEP_SUMMARY:-}" ] && printf '%s\n' "$*" >> "$GITHUB_STEP_SUMMARY" || true; }

pipeline/scripts/manifest.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Read and validate .dealsage/app.json, then export what later steps need:
+#   APP_ID            the custom app this repo publishes
+#   MANIFEST_JSON     the whole manifest, compacted (recorded with the version)
+#   CHECKS_JSON       the checks array with defaults applied
+# Validation is deliberately jq-only (no npm dependency) so a broken manifest
+# fails fast, before install. The schema of record is ../manifest.schema.json.
+set -euo pipefail
+. "$(dirname "$0")/lib.sh"
+
+MANIFEST_PATH="${MANIFEST_PATH:-.dealsage/app.json}"
+[ -f "$MANIFEST_PATH" ] || die "Manifest not found at $MANIFEST_PATH"
+jq -e . "$MANIFEST_PATH" >/dev/null 2>&1 || die "$MANIFEST_PATH is not valid JSON"
+
+app_id="$(jq -r '.appId // empty' "$MANIFEST_PATH")"
+[[ "$app_id" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]] \
+  || die "$MANIFEST_PATH: appId is missing or not a UUID (got '${app_id:-<empty>}'). Provisioning stamps it; do not edit by hand."
+
+# Normalise checks: fill defaults, reject malformed entries with a clear message.
+checks="$(jq -c '
+  def bad(msg): error("checks: " + msg);
+  (.checks // [])
+  | if type != "array" then bad("must be an array") else . end
+  | map(
+      if type != "object" then bad("each check must be an object") else . end
+      | if (.id|type) != "string" or ((.id|test("^[a-z][a-z0-9-]{0,39}$"))|not)
+          then bad("id must match ^[a-z][a-z0-9-]{0,39}$ (got " + (.id|tostring) + ")") else . end
+      | if ((.run|type) == "string") == ((.uses|type) == "string")
+          then bad("check " + .id + " needs exactly one of run or uses") else . end
+      | if (.uses? // "") != "" and ((.uses|IN("conventions"))|not)
+          then bad("check " + .id + " uses an unknown platform check " + .uses) else . end
+      | {
+          id: .id,
+          name: (.name // .id),
+          run: (.run // null),
+          uses: (.uses // null),
+          required: (if .required == null then true else .required end),
+          timeoutMinutes: (.timeoutMinutes // 15)
+        }
+    )
+  | if (map(.id) | unique | length) != length then bad("ids must be unique") else . end
+' "$MANIFEST_PATH")" || exit 1
+
+manifest="$(jq -c . "$MANIFEST_PATH")"
+persist_env APP_ID "$app_id"
+persist_env MANIFEST_JSON "$manifest"
+persist_env CHECKS_JSON "$checks"
+log "Manifest: app $app_id, $(jq 'length' <<<"$checks") check(s)"
+jq -r '.[] | "  - \(.id) (\(if .required then "required" else "advisory" end)): \(.run // ("platform:" + .uses))"' <<<"$checks"

pipeline/scripts/publish.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Publish dist/ as a new version of the app:
+#   1. allocate  — DealSage assigns version N for this commit/branch and returns
+#                  where the bytes go plus a short-lived upload token.
+#   2. upload    — through the serving Worker when CUSTOM_APPS_WORKER_URL is set
+#                  (no R2 key on CI), else `aws s3 sync` with the org's R2 keys.
+#   3. promote   — ask DealSage to release it. DealSage decides: a default-branch
+#                  build under an "auto" policy goes live; anything else is kept
+#                  as a built version on its branch channel for preview and a
+#                  later, deliberate promotion. CI never knows the policy.
+# The live pointer only ever moves after the bytes are in place.
+set -euo pipefail
+. "$(dirname "$0")/lib.sh"
+require_env APP_ID DEALSAGE_FUNCTIONS_URL PUBLISH_TOKEN SUPABASE_ANON_KEY
+git_context
+[ -f dist/index.html ] || die "dist/index.html not found; run the build first"
+
+# --- 1. allocate ------------------------------------------------------------
+manifest_json="${MANIFEST_JSON:-{\}}"
+checks_json="${CHECKS_RESULT_JSON:-[]}"
+alloc_body="$(jq -n \
+  --arg appId "$APP_ID" --arg sha "$COMMIT_SHA" --arg branch "$BRANCH" \
+  --arg msg "$COMMIT_MESSAGE" --arg author "$COMMIT_AUTHOR" \
+  --argjson manifest "$manifest_json" --argjson checks "$checks_json" \
+  '{appId:$appId, action:"allocate", builtBy:"ci", commitSha:$sha, branch:$branch,
+    commitMessage:$msg, author:$author, manifest:$manifest, checks:$checks}')"
+alloc="$(ds_post record-app-version "$alloc_body")" || die "allocate failed"
+VERSION="$(jq -r '.version // empty' <<<"$alloc")"
+PREFIX="$(jq -r '.r2Prefix // empty' <<<"$alloc")"
+UPLOAD_TOKEN="$(jq -r '.uploadToken // empty' <<<"$alloc")"
+[ -n "$VERSION" ] && [ -n "$PREFIX" ] || die "allocate returned no version/prefix: $alloc"
+log "Allocated v$VERSION for $BRANCH@${COMMIT_SHA:0:7} -> $PREFIX"
+
+mark_failed() {
+  ds_post record-app-version "$(jq -n --arg appId "$APP_ID" --argjson v "$VERSION" --arg reason "$1" \
+    '{appId:$appId, action:"fail", version:$v, reason:$reason}')" >/dev/null 2>&1 || true
+}
+
+# --- 2. upload --------------------------------------------------------------
+if [ -n "${CUSTOM_APPS_WORKER_URL:-}" ]; then
+  [ -n "$UPLOAD_TOKEN" ] || { mark_failed "no upload token"; die "allocate returned no uploadToken but CUSTOM_APPS_WORKER_URL is set"; }
+  log "Uploading through the Worker"
+  export WORKER="${CUSTOM_APPS_WORKER_URL%/}" UPLOAD_TOKEN APP_ID VERSION
+  upload_one() { # relative path under dist/
+    local rel="$1" code
+    code="$(curl -sS -o /dev/null -w '%{http_code}' -X PUT \
+      "$WORKER/__upload/$APP_ID/$VERSION/$rel" \
+      -H "Authorization: Bearer $UPLOAD_TOKEN" --data-binary "@dist/$rel")" || code=000
+    case "$code" in 2*) ;; *) echo "upload failed ($code): $rel" >&2; return 1 ;; esac
+  }
+  export -f upload_one
+  if ! (cd dist && find . -type f | sed 's|^\./||') | xargs -P 6 -n 1 bash -c 'upload_one "$0"'; then
+    mark_failed "upload failed"; die "Upload failed; v$VERSION marked failed and was not promoted."
+  fi
+else
+  require_env R2_ACCOUNT_ID R2_BUCKET R2_ACCESS_KEY_ID R2_SECRET_ACCESS_KEY
+  log "Uploading with the AWS CLI to s3://$R2_BUCKET/${PREFIX%/}"
+  if ! AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID" AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY" \
+     AWS_DEFAULT_REGION=auto AWS_REQUEST_CHECKSUM_CALCULATION=when_required \
+     AWS_RESPONSE_CHECKSUM_VALIDATION=when_required \
+     aws s3 sync dist "s3://$R2_BUCKET/${PREFIX%/}" \
+       --endpoint-url "https://$R2_ACCOUNT_ID.r2.cloudflarestorage.com" --delete; then
+    mark_failed "upload failed"; die "Upload failed; v$VERSION marked failed and was not promoted."
+  fi
+fi
+log "Uploaded $(find dist -type f | wc -l) files"
+
+# --- 3. promote (DealSage applies the app's publish policy) ------------------
+promote="$(ds_post record-app-version "$(jq -n --arg appId "$APP_ID" --argjson v "$VERSION" \
+  '{appId:$appId, action:"promote", version:$v}')")" || die "promote request failed"
+promoted="$(jq -r '.promoted // false' <<<"$promote")"
+channel="$(jq -r '.channel // empty' <<<"$promote")"
+current="$(jq -r '.currentVersion // empty' <<<"$promote")"
+if [ "$promoted" = true ]; then
+  log "v$VERSION is live"
+else
+  live_note="nothing is live yet"; [ -n "$current" ] && live_note="live stays at v$current"
+  log "v$VERSION built and kept on channel '${channel:-branch/$BRANCH}' ($live_note); promote it from DealSage when ready"
+fi
+{
+  echo "version=$VERSION"; echo "promoted=$promoted"; echo "channel=${channel}"
+} >> "${GITHUB_OUTPUT:-/dev/null}"
+summary "### Published"
+summary "- **v$VERSION** from \`$BRANCH\` @ \`${COMMIT_SHA:0:7}\` — $( [ "$promoted" = true ] && echo "live" || echo "built, channel \`${channel:-branch/$BRANCH}\`" )"

pipeline/scripts/run-checks.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Run the checks declared in the manifest, record each result in DealSage, and
+# stop the pipeline if a required check failed. Advisory checks never block.
+#
+# Every result is posted to record-app-check with the commit and branch, so
+# DealSage can show checks per commit before a version exists and attach them
+# to the version once it is allocated. A DealSage outage is a warning here, not
+# a failure: the build should not be blocked by the dashboard being down.
+set -euo pipefail
+. "$(dirname "$0")/lib.sh"
+require_env APP_ID CHECKS_JSON DEALSAGE_FUNCTIONS_URL PUBLISH_TOKEN SUPABASE_ANON_KEY
+git_context
+CHECKS_DIR="$(cd "$(dirname "$0")/../checks" && pwd)"
+
+post_check() { # id name status required duration_ms summary logfile started finished
+  local payload
+  payload="$(jq -n \
+    --arg appId "$APP_ID" --arg sha "$COMMIT_SHA" --arg branch "$BRANCH" \
+    --arg id "$1" --arg name "$2" --arg status "$3" --argjson required "$4" \
+    --argjson duration "$5" --arg summary "$6" --rawfile log "$7" \
+    --arg started "$8" --arg finished "$9" \
+    '{appId:$appId, commitSha:$sha, branch:$branch, checkId:$id, name:$name, status:$status,
+      required:$required, durationMs:$duration, summary:$summary,
+      logTail:($log | split("\n") | .[-80:] | join("\n")), reportedBy:"ci",
+      startedAt:$started, finishedAt:$finished}')"
+  ds_post record-app-check "$payload" >/dev/null || warn "could not record check $1 in DealSage"
+}
+
+results='[]'
+required_failed=()
+count="$(jq 'length' <<<"$CHECKS_JSON")"
+if [ "$count" = 0 ]; then
+  log "No checks declared in .dealsage/app.json"
+  persist_env CHECKS_RESULT_JSON '[]'
+  exit 0
+fi
+
+while IFS= read -r check; do
+  id="$(jq -r .id <<<"$check")"; name="$(jq -r .name <<<"$check")"
+  run="$(jq -r '.run // empty' <<<"$check")"; uses="$(jq -r '.uses // empty' <<<"$check")"
+  required="$(jq -r .required <<<"$check")"; timeout_min="$(jq -r .timeoutMinutes <<<"$check")"
+  logf="$(mktemp)"; started="$(iso_now)"; t0="$(now_ms)"
+  echo "::group::check: $name ($id)"
+  if [ -n "$uses" ]; then
+    printf '$ platform check %s\n' "$uses" | tee "$logf"
+    set +e; timeout "${timeout_min}m" bash "$CHECKS_DIR/$uses.sh" 2>&1 | tee -a "$logf"; rc=${PIPESTATUS[0]}; set -e
+  else
+    printf '$ %s\n' "$run" | tee "$logf"
+    set +e; timeout "${timeout_min}m" bash -o pipefail -c "$run" 2>&1 | tee -a "$logf"; rc=${PIPESTATUS[0]}; set -e
+  fi
+  echo "::endgroup::"
+  dur=$(( $(now_ms) - t0 ))
+  case "$rc" in
+    0)   status=passed; summary="passed in $(( dur / 1000 ))s" ;;
+    124) status=error;  summary="timed out after ${timeout_min} minutes" ;;
+    *)   status=failed; summary="exit code $rc" ;;
+  esac
+  printf '%s: %s (%s)\n' "$name" "$status" "$summary"
+  post_check "$id" "$name" "$status" "$required" "$dur" "$summary" "$logf" "$started" "$(iso_now)"
+  results="$(jq -c --arg id "$id" --arg status "$status" --argjson d "$dur" --argjson req "$required" \
+    '. + [{id:$id, status:$status, durationMs:$d, required:$req}]' <<<"$results")"
+  if [ "$status" != passed ] && [ "$required" = true ]; then required_failed+=("$name"); fi
+  rm -f "$logf"
+done < <(jq -c '.[]' <<<"$CHECKS_JSON")
+
+persist_env CHECKS_RESULT_JSON "$results"
+summary "### Checks"
+summary "$(jq -r '.[] | "- \(.id): **\(.status)** (\(.durationMs)ms\(if .required then "" else ", advisory" end))"' <<<"$results")"
+
+if [ "${#required_failed[@]}" -gt 0 ]; then
+  die "Required check(s) failed: ${required_failed[*]}. The build was not published."
+fi
+log "All required checks passed"