Release: develop -> main

.c8rc.json

@@ -0,0 +1,10 @@
+{
+  "all": true,
+  "include": ["**/*.js"],
+  "exclude": ["test/**", "coverage/**", "node_modules/**", "scripts/**"],
+  "temp-directory": "coverage/tmp",
+  "lines": 100,
+  "functions": 100,
+  "branches": 100,
+  "statements": 100
+}

.dockerignore

@@ -0,0 +1,5 @@
+node_modules
+.git
+.env
+coverage
+test

.github/workflows/auto-release-pr.yaml

@@ -0,0 +1,80 @@
+name: Auto Release PR
+
+on:
+  push:
+    branches: [develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: auto-release-pr
+  cancel-in-progress: false
+
+jobs:
+  create-release-pr:
+    name: Create Release PR
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Fetch main branch
+        run: git fetch origin main
+
+      - name: Check for existing PR
+        id: check-pr
+        run: |
+          PR_COUNT=$(gh pr list --base main --head develop --state open --json number,isCrossRepository --jq '[.[] | select(.isCrossRepository == false)] | length')
+          echo "pr_exists=$([[ $PR_COUNT -gt 0 ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check for differences
+        id: check-diff
+        if: steps.check-pr.outputs.pr_exists == 'false'
+        run: |
+          DIFF_COUNT=$(git rev-list --count origin/main..origin/develop)
+          echo "has_changes=$([[ $DIFF_COUNT -gt 0 ]] && echo 'true' || echo 'false')" >> $GITHUB_OUTPUT
+          echo "commit_count=$DIFF_COUNT" >> $GITHUB_OUTPUT
+
+      - name: Create Release PR
+        if: steps.check-pr.outputs.pr_exists == 'false' && steps.check-diff.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMIT_COUNT: ${{ steps.check-diff.outputs.commit_count }}
+        run: |
+          printf '%s\n' \
+            "EN:" \
+            "Automatic release PR from develop onto main. Merging publishes the production image tag and is a human decision." \
+            "" \
+            "DE:" \
+            "Automatischer Release-PR von develop nach main. Der Merge veröffentlicht das Produktions-Image und ist eine menschliche Entscheidung." \
+            "" \
+            "<details>" \
+            "<summary>Details</summary>" \
+            "" \
+            "This PR was automatically created after changes were pushed to develop." \
+            "It is the only path from develop onto main for this repository." \
+            "Do not merge until develop has been checked on the development hub." \
+            "" \
+            "**Commits:** ${COMMIT_COUNT} new commit(s)" \
+            "" \
+            "### Checklist" \
+            "- [ ] Review all changes" \
+            "- [ ] Verify CI passes" \
+            "- [ ] Approve and merge when ready for production" \
+            "" \
+            "</details>" \
+            > /tmp/pr-body.md
+
+          gh pr create \
+            --draft \
+            --base main \
+            --head develop \
+            --title "Release: develop -> main" \
+            --body-file /tmp/pr-body.md

.github/workflows/front-api-dev.yaml

@@ -0,0 +1,56 @@
+name: front-api DEV
+
+on:
+  push:
+    branches: [develop]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  IMAGE: dfxswiss/front-api
+  TAG: beta
+
+jobs:
+  build-and-push:
+    name: Build and push Docker image (DEV)
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.IMAGE }}:${{ env.TAG }}
+            ${{ env.IMAGE }}:${{ github.sha }}
+          platforms: linux/arm64
+
+      - name: Notify infrastructure to pull :beta
+        env:
+          GH_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
+        run: |
+          set -euo pipefail
+          repo="${{ secrets.DISPATCH_REPO }}"
+          if [ -z "${GH_TOKEN}" ] || [ -z "${repo}" ]; then
+            echo "::warning::DISPATCH_TOKEN or DISPATCH_REPO unset — set them like the other product image repos"
+            exit 0
+          fi
+          gh api "repos/${repo}/dispatches" \
+            -f event_type=image-published \
+            -f "client_payload[image]=${IMAGE}" \
+            -f "client_payload[tag]=${TAG}" \
+            -f "client_payload[sha]=${GITHUB_SHA}"

.github/workflows/front-api-prd.yaml

@@ -0,0 +1,56 @@
+name: front-api PRD
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  IMAGE: dfxswiss/front-api
+  TAG: latest
+
+jobs:
+  build-and-push:
+    name: Build and push Docker image (PRD)
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.IMAGE }}:${{ env.TAG }}
+            ${{ env.IMAGE }}:${{ github.sha }}
+          platforms: linux/arm64
+
+      - name: Notify infrastructure to pull :latest
+        env:
+          GH_TOKEN: ${{ secrets.DISPATCH_TOKEN }}
+        run: |
+          set -euo pipefail
+          repo="${{ secrets.DISPATCH_REPO }}"
+          if [ -z "${GH_TOKEN}" ] || [ -z "${repo}" ]; then
+            echo "::warning::DISPATCH_TOKEN or DISPATCH_REPO unset — set them like the other product image repos"
+            exit 0
+          fi
+          gh api "repos/${repo}/dispatches" \
+            -f event_type=image-published \
+            -f "client_payload[image]=${IMAGE}" \
+            -f "client_payload[tag]=${TAG}" \
+            -f "client_payload[sha]=${GITHUB_SHA}"

.github/workflows/main-from-develop.yml

@@ -0,0 +1,48 @@
+# PRs into main must come from this repository's develop branch.
+# GitHub has no native source-branch restriction; this job is the gate.
+# Do not add a YAML `if:` key (job or step): a skipped required check
+# counts as passing.
+
+name: Main source branch
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+      - edited
+      - labeled
+      - unlabeled
+
+permissions:
+  contents: read
+
+jobs:
+  only-develop:
+    name: Main only from develop
+    runs-on: ubuntu-latest
+    steps:
+      - name: Reject any head other than this repo's develop
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
+          THIS_REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          if [ -z "$HEAD_REF" ] || [ -z "$HEAD_REPO" ] || [ -z "$THIS_REPO" ]; then
+            echo "::error::Missing pull_request head metadata; refusing to pass."
+            exit 1
+          fi
+          if [ "$HEAD_REPO" != "$THIS_REPO" ]; then
+            echo "::error::PRs into main must come from ${THIS_REPO}@develop, not a fork (${HEAD_REPO})."
+            exit 1
+          fi
+          if [ "$HEAD_REF" != "develop" ]; then
+            echo "::error::PRs into main must come from develop (got '${HEAD_REF}'). Merge into develop first."
+            exit 1
+          fi
+          echo "Head is ${THIS_REPO}@develop."

.github/workflows/test.yml

@@ -0,0 +1,23 @@
+name: test
+
+on:
+  pull_request:
+  push:
+    branches: [develop, main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - run: npm ci
+      - run: bash test/test-server.sh
+      - run: bash test/test-offered-routes.sh
+      - run: bash test/test-main-from-develop.sh
+      - run: bash test/test-auto-release-pr.sh

.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+.env
+.DS_Store
+coverage/