thanhnvandClaude Opus 4.8
36a4812ef3
Standard production layout: the OKR app (was nested under AINative_OKR_CASAN5/) is now
the repository root. No more wrapper directory.
- Promote AINative_OKR_CASAN5/* -> repo root (backend/ frontend/ packages/ apps/
.specify/ docs/ infra/ nginx/ scripts/ + configs). Merge tool dirs: .gitea (kept the
active deploy ci.yml, added harness-ci.yml + runbooks), .claude (agents/commands +
launch.json), .github moved up.
- Remove redundant: 00_SUBMISSION_PACKAGE, scattered root notes (FPT_CASAN_Full.md,
tu-tuong-casan.md, casan-tu-sinh..., casan_harness_assessment.md, source-review...,
README_CASAN5_REFINED.md), casan-next-plans/ and optimize-docs/ (competition/planning
artifacts — roadmap + design history preserved in git log / commit messages).
- Update all references to the old layout:
- .gitea/workflows/{ci,harness-ci}.yml, .github/workflows/{ci,deploy}.yml:
working-directory .; drop AINative_OKR_CASAN5/ prefix; .specify/{tests,scripts}
-> packages/casan-harness/... (.specify/logs state kept)
- .claude/launch.json, .gitea/*-runbook.md: path prefixes
- CLAUDE.md, README.md: docs/input -> apps/okr/domain/input
- policy-bundle.yaml: 8 policy paths -> packages/casan-harness/...; manifest re-signed
- secrets-scan.sh: fixture excludes -> new package/domain paths.
Full gate from the new root: PASS=64 FAIL=0 SKIP=3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
255 lines
11 KiB
YAML
255 lines
11 KiB
YAML
name: CASAN CI Gate
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop, "feature/**"]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# All run steps execute inside (the app directory).
|
|
# actions/* steps still reference $GITHUB_WORKSPACE root, so paths in `with:` blocks
|
|
# must include prefix.
|
|
|
|
jobs:
|
|
# ──────────────────────────────────────────────────────────────────────────
|
|
# Job 1 — Frontend unit tests (fast gate, ~1 min)
|
|
# Runs on: web/Gitea VPS runner (161.33.139.73) — light job, no Docker build
|
|
# ──────────────────────────────────────────────────────────────────────────
|
|
frontend-tests:
|
|
name: "Frontend Tests (H3 gate)"
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: .
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Setup Node.js 20
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: package-lock.json
|
|
|
|
- name: Install frontend dependencies
|
|
run: npm ci -w frontend
|
|
|
|
- name: Run Vitest (16 tests)
|
|
run: npm test -w frontend
|
|
|
|
# ──────────────────────────────────────────────────────────────────────────
|
|
# Job 2 — CASAN Security Gate + Vault KMS signing (H4/H5/H2/H6/H7)
|
|
# Runs on: web/Gitea VPS runner (161.33.139.73) — after frontend-tests to
|
|
# prevent OOM (1 GB RAM VPS, sequential jobs via capacity: 1)
|
|
# ──────────────────────────────────────────────────────────────────────────
|
|
security-gate:
|
|
name: "CASAN Security Gate + Vault KMS (H4/H5)"
|
|
runs-on: ubuntu-latest
|
|
needs: [frontend-tests]
|
|
defaults:
|
|
run:
|
|
working-directory: .
|
|
env:
|
|
VAULT_ADDR: "http://vault:8200"
|
|
VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Setup Node.js 20
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: package-lock.json
|
|
|
|
- name: Install test tools
|
|
run: |
|
|
apt-get update -qq 2>/dev/null && \
|
|
apt-get install -y -qq jq openssl python3 python-is-python3 uuid-runtime curl 2>/dev/null || true
|
|
command -v python >/dev/null 2>&1 || \
|
|
ln -sf "$(command -v python3)" /usr/local/bin/python
|
|
echo "python: $(python --version)"
|
|
echo "jq: $(jq --version)"
|
|
echo "openssl: $(openssl version)"
|
|
|
|
- name: Vault KMS — enable transit + pre-create keys
|
|
run: |
|
|
if curl -sf "$VAULT_ADDR/v1/sys/health" >/dev/null 2>&1; then
|
|
bash packages/casan-harness/scripts/bash/vault-kms.sh enable-transit
|
|
bash packages/casan-harness/scripts/bash/vault-kms.sh ensure-key casan-policy-key
|
|
bash packages/casan-harness/scripts/bash/vault-kms.sh ensure-key casan-audit-key
|
|
echo "VAULT_KMS_READY"
|
|
else
|
|
echo "VAULT_KMS_SKIP (unreachable — will use local-file fallback)"
|
|
fi
|
|
|
|
- name: Run CASAN4 harness tests (35 tests)
|
|
run: bash packages/casan-harness/tests/run-casan4-harness-tests.sh
|
|
|
|
- name: Run adversarial harness tests (44 tests)
|
|
run: bash packages/casan-harness/tests/adversarial-harness-tests.sh
|
|
|
|
- name: Sign audit chain head via Vault KMS (H5)
|
|
run: bash packages/casan-harness/scripts/bash/sign-audit-head.sh
|
|
|
|
- name: Sign policy bundle via Vault KMS (H5)
|
|
run: bash packages/casan-harness/scripts/bash/sign-policy-bundle.sh sign
|
|
|
|
- name: Verify audit chain (anchor=signed expected in CI)
|
|
run: bash packages/casan-harness/scripts/bash/verify-audit-chain.sh
|
|
|
|
- name: Security gate — aggregate verdict (PASS=11 FAIL=0 SKIP=0)
|
|
run: bash packages/casan-harness/scripts/bash/security-gate.sh
|
|
|
|
- name: Upload test evidence
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: casan-evidence-${{ github.run_number }}
|
|
path: |
|
|
docs/output/casan/evidence/harness-test-report.md
|
|
docs/output/casan/evidence/
|
|
retention-days: 14
|
|
|
|
# ──────────────────────────────────────────────────────────────────────────
|
|
# Job 3 — Build Docker images + deploy to /opt/webapps/okr (main only)
|
|
#
|
|
# Runs on: DEDICATED CI RUNNER (161.33.149.243, label: ci-runner)
|
|
# Heavy Docker builds do NOT run on the web/Gitea VPS.
|
|
#
|
|
# Architecture:
|
|
# CI runner (161.33.149.243) Web VPS (161.33.139.73)
|
|
# ───────────────────────── ────────────────────────────────
|
|
# docker build okr-backend /opt/webapps/okr/
|
|
# docker build okr-frontend ──► docker-compose.yml
|
|
# docker save | gzip | ssh ──► docker load
|
|
# docker compose up -d
|
|
#
|
|
# DB: Oracle MySQL HeatWave (10.0.1.254:3306, webapp_db)
|
|
# Credentials live on web VPS: /opt/webapps/webapp-mysql.env
|
|
#
|
|
# Required Gitea secrets:
|
|
# DEPLOY_SSH_KEY — ed25519 private key for ubuntu@161.33.139.73
|
|
# JWT_SECRET — app JWT signing secret
|
|
#
|
|
# One-time CI runner setup:
|
|
# ssh ubuntu@161.33.149.243
|
|
# RUNNER_TOKEN=<from Gitea admin> bash scripts/setup-ci-runner.sh
|
|
# ──────────────────────────────────────────────────────────────────────────
|
|
deploy-okr:
|
|
name: "Build & Deploy OKR → /opt/webapps/okr"
|
|
runs-on: [ci-runner]
|
|
needs: [frontend-tests, security-gate]
|
|
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
|
defaults:
|
|
run:
|
|
working-directory: .
|
|
env:
|
|
JWT_SECRET: ${{ secrets.JWT_SECRET }}
|
|
WEB_VPS: "ubuntu@161.33.139.73"
|
|
APP_DIR: "/opt/webapps/okr"
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Setup SSH for web VPS deploy
|
|
env:
|
|
DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
printf '%s\n' "$DEPLOY_SSH_KEY" | tr -d '\r' > ~/.ssh/deploy_key
|
|
chmod 600 ~/.ssh/deploy_key
|
|
ssh-keyscan -H 161.33.139.73 >> ~/.ssh/known_hosts 2>/dev/null
|
|
echo "SSH ready: $(ssh-keygen -l -f ~/.ssh/deploy_key 2>&1)"
|
|
|
|
- name: Ensure docker access on web VPS (self-heal group membership)
|
|
run: |
|
|
# The deploy user must be in the 'docker' group to reach
|
|
# /var/run/docker.sock (root:docker, mode 660). Idempotent; self-heals
|
|
# a rebuilt web VPS. Each subsequent step opens a fresh SSH session, so
|
|
# the new group membership takes effect without a reboot.
|
|
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS '
|
|
if id -nG "$USER" | tr " " "\n" | grep -qx docker; then
|
|
echo "docker group: already a member"
|
|
else
|
|
echo "docker group: adding $USER"
|
|
sudo usermod -aG docker "$USER"
|
|
fi
|
|
# docker compose reads env_file client-side as this user, so the
|
|
# root-managed DB secret must be group-readable by the deploy user.
|
|
MYSQL_ENV=/opt/webapps/webapp-mysql.env
|
|
if [ -f "$MYSQL_ENV" ] && ! [ -r "$MYSQL_ENV" ]; then
|
|
echo "mysql env: granting docker-group read"
|
|
sudo chgrp docker "$MYSQL_ENV" && sudo chmod 640 "$MYSQL_ENV"
|
|
else
|
|
echo "mysql env: readable (or absent)"
|
|
fi
|
|
'
|
|
# Prove a NEW session can reach the docker daemon before streaming ~GBs.
|
|
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
|
'docker version --format "server={{.Server.Version}}"'
|
|
|
|
- name: Build backend image (node:20-slim + Prisma MySQL)
|
|
run: docker build -t okr-backend:latest -f Dockerfile.backend .
|
|
|
|
- name: Build frontend image (nginx + React SPA, VITE_API_BASE_URL=/api/v1)
|
|
run: |
|
|
docker build \
|
|
--build-arg VITE_API_BASE_URL=/api/v1 \
|
|
-t okr-frontend:latest \
|
|
-f Dockerfile.frontend \
|
|
.
|
|
|
|
- name: Transfer images to web VPS
|
|
run: |
|
|
echo "Streaming images to web VPS (this may take ~1 min)..."
|
|
docker save okr-backend:latest okr-frontend:latest | \
|
|
gzip | \
|
|
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
|
'docker load'
|
|
|
|
- name: Prepare app directory + docker-compose on web VPS
|
|
run: |
|
|
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
|
"mkdir -p $APP_DIR"
|
|
scp -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no \
|
|
docker-compose.prod.yml $WEB_VPS:$APP_DIR/docker-compose.yml
|
|
|
|
- name: Write app secrets on web VPS
|
|
run: |
|
|
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
|
"printf 'JWT_SECRET=%s\nFRONTEND_ORIGIN=http://161.33.139.73\n' '${JWT_SECRET}' \
|
|
> $APP_DIR/.env.app && chmod 600 $APP_DIR/.env.app"
|
|
|
|
- name: Deploy containers on web VPS
|
|
run: |
|
|
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \
|
|
"cd $APP_DIR && docker compose up -d --remove-orphans --pull never"
|
|
|
|
- name: Health check
|
|
run: |
|
|
echo "Waiting 30s for containers to initialise (includes Prisma migrate + seed)..."
|
|
sleep 30
|
|
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS '
|
|
echo "=== Containers ===" &&
|
|
docker compose -f /opt/webapps/okr/docker-compose.yml ps &&
|
|
echo "" &&
|
|
echo "=== HTTP check ===" &&
|
|
if curl -fsS -o /dev/null -w "HTTP %{http_code}" http://localhost; then
|
|
echo ""
|
|
echo "DEPLOY_OK http://161.33.139.73"
|
|
else
|
|
echo "DEPLOY_WARN — backend logs:"
|
|
docker logs okr-backend --tail 30 || true
|
|
docker logs okr-frontend --tail 20 || true
|
|
fi
|
|
'
|