Skip to content

Docker preview parity, keyless deploy smoke, and rsync upload (#146) - #162

Open
ijiraq wants to merge 6 commits into
ivoa:mainfrom
ijiraq:cursor/docker-parity-deploys-52dc
Open

Docker preview parity, keyless deploy smoke, and rsync upload (#146)#162
ijiraq wants to merge 6 commits into
ivoa:mainfrom
ijiraq:cursor/docker-parity-deploys-52dc

Conversation

@ijiraq

@ijiraq ijiraq commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

Contributor-facing infrastructure so developers and content providers can verify work from a fork without IVOA deploy secrets or webtest keys, while keeping real host deploys maintainer-only (#146).

  1. Local Docker parity — make docker-preview serves the site at http://localhost:1313 with the same Hugo / Pagefind / Node pins as CI (content + structural/layout checks; no host Hugo required). make docker-html does a production-style static build into ./public. Docker P2 hardening: no host hugo-bin/pagefind-bin shims from the container, lockfile-aware npm cache, TARGETARCH-aware installs.
  2. CI without org secrets — on PRs (including forks), workflow CI runs Build site and uploads downloadable site-public (unzip → top-level index.html), plus Deploy smoke (mock SSH/rsync) into a disposable OpenSSH mock using only a repo test key.
  3. Real hosts stay maintainer-only — webtest / prod uploads still use org-held SFTP_* secrets via the first-party rsync-upload action (addresses Upload site using rsync rather than sftp #146). Fork PRs do not push to webtest.ivoa.info; that is intentional and separate from local/CI preview.

Also clarifies CONTRIBUTING so forks keep Docker local preview + secret-free CI, and webtest.ivoa.info remains same-repo / org-secrets only.

Test plan

Copy-paste from CONTRIBUTING (“How to verify before / after a PR”):

  1. Get the branch

    git fetch origin
git checkout cursor/docker-parity-deploys-52dc
git pull

  2. Live preview (layout + content)

    docker compose down
make docker-preview

    Open http://localhost:1313/ — home page loads; edit markdown under content/ and see Hugo reload. Stop with Ctrl+C.

  3. Production-style static build

    make docker-html
ls public/index.html

    Expect docker-html OK: public/index.html present.

  4. Optional full mock deploy

    ./scripts/deploy-smoke.sh

    Expect deploy-smoke OK (uses only deploy/mock-ssh/ test key — not IVOA servers).

  5. After the PR is open — GitHub Actions (secret-free)

    • Checks → workflow CI green for Build site and Deploy smoke (mock SSH/rsync)
    • Download artifact site-public from Build site; unzip and confirm top-level index.html
    • A https://webtest.ivoa.info/v/<branch>/ URL is a separate org-secret same-repo deploy — not required to review fork work

cursoragent and others added 6 commits October 4, 2026 20:42
@cursoragent @ijiraq
Add Docker preview parity, rsync upload, and mock deploy smoke
1e27cf0 
Introduce a pinned Node/Hugo/Pagefind Docker preview as the canonical
pre-PR path, replace SFTP uploads with a first-party rsync action, and
prove deploys against a disposable OpenSSH mock so contributors never
need IVOA keys (ivoa#146).

Co-authored-by: JJ Kavelaars <jj.kavelaars@nrc-cnrc.gc.ca>
@cursoragent @ijiraq
Fix Docker preview when node_modules is a volume mount
54881c3 
The preview entrypoint removed the node_modules directory itself while
Compose mounts a named volume there, which fails with "Device or
resource busy". Clear only mount contents (or npm ci into the directory)
instead so first-start and warm restarts work.

Co-authored-by: JJ Kavelaars <jj.kavelaars@nrc-cnrc.gc.ca>
@cursoragent @ijiraq
Document explicit Docker verification steps; add make docker-html
20a7cff 
Rewrite CONTRIBUTING verification into copy-paste commands (preview,
static build, mock deploy, CI checks/artifact download). Add
make docker-html wrapping docker/build-html.sh so the build-only path
matches the docs.

Co-authored-by: JJ Kavelaars <jj.kavelaars@nrc-cnrc.gc.ca>
@cursoragent @ijiraq
Clarify fork preview path in CONTRIBUTING
2f32603 
Forks keep full Docker local preview and secret-free CI (Build site
artifact site-public, mock Deploy smoke). Only the webtest.ivoa.info
branch deploy remains same-repo / org-secrets.

Co-authored-by: JJ Kavelaars <jj.kavelaars@nrc-cnrc.gc.ca>
@ijiraq
Clarify local preview wording in CONTRIBUTING
0d29079 
Spell out that forks can preview with Docker before push, keep
secret-free CI (Build site artifact and mock Deploy smoke), and note
that webtest.ivoa.info remains same-repo / org-secrets only.
@cursoragent @ijiraq
Fix Docker P2: no host shims, lockfile cache, TARGETARCH
ccd013b 
Stop writing hugo/pagefind shims into the bind-mounted checkout; use
image PATH and Makefile HUGO_DIR/PAGEFIND_DIR overrides. Invalidate
preview_node_modules via package-lock.json hash. Download Hugo and
Pagefind archives for TARGETARCH (amd64/arm64).

Co-authored-by: JJ Kavelaars <jj.kavelaars@nrc-cnrc.gc.ca>
@ijiraq
ijiraq marked this pull request as draft October 5, 2026 01:16
@ijiraq
ijiraq marked this pull request as ready for review October 5, 2026 01:17
This was referenced Nov 7, 2026
Open
Open
@ijiraq

ijiraq commented Nov 7, 2026

Copy link
Copy Markdown
Author

Split request follow-up: the rsync-only deploy change is now in a separate ready PR — #169 (head ijiraq:cursor/rsync-upload-only-ec7c).

That PR covers only rsync-upload + deploy_main / deploy_version wiring for #146 (sftp-upload kept deprecated). No Docker / preview / mock-smoke tooling.

Leaving this PR (#162) open for the Docker parity / keyless CI preview work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ijiraq @cursoragent