Add read-only production runtime audit

2026-08-17 11:17:40 +07:00
parent 057d4ed9dc
commit a1de4715a4
106 changed files with 6869 additions and 1782 deletions
@@ -0,0 +1,86 @@
+name: Build and sync k3s practice images
+
+# Practice-cluster only (readytochat.realvuxbaro.me, ArgoCD-managed on the
+# self-hosted k3s box). Does not touch deploy.yml or the production
+# EC2/Compose stack — production never pulls a GHCR image and isn't
+# ArgoCD-managed at all, so this workflow has no path to affect it.
+#
+# ArgoCD's Applications already autosync (syncPolicy.automated) — the gap
+# this closes is that the image tag they deploy was a static string
+# (`:practice`) that nothing ever rebuilt. This tags every build with the
+# commit SHA and repoints the Application at it.
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - apps/ai-service/**
+      - apps/web/**
+      - packages/**
+      - ingestion/data/verified/drug_entities.json
+      - .github/workflows/build-practice-images.yml
+      - .github/scripts/sync_practice_argocd.py
+  workflow_dispatch:
+
+concurrency:
+  group: practice-images
+  cancel-in-progress: false
+
+jobs:
+  build-and-sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push ai-service
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/ai-service/Dockerfile
+          push: true
+          tags: ghcr.io/baovu2k4/vsf-duocthu-ai-service:${{ github.sha }}
+          cache-from: type=gha,scope=practice-ai-service
+          cache-to: type=gha,mode=max,scope=practice-ai-service
+
+      - name: Build and push web
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: apps/web/Dockerfile
+          push: true
+          tags: ghcr.io/baovu2k4/vsf-duocthu-web:${{ github.sha }}
+          cache-from: type=gha,scope=practice-web
+          cache-to: type=gha,mode=max,scope=practice-web
+
+      - name: Point the practice ArgoCD Application at the new images
+        env:
+          ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
+          ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
+          IMAGE_TAG: ${{ github.sha }}
+        run: python3 .github/scripts/sync_practice_argocd.py
+
+      - name: Confirm readytochat is serving the new build
+        run: |
+          for attempt in $(seq 1 18); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' \
+              "https://readytochat.realvuxbaro.me/api/history?conversation_id=ci-smoke-${{ github.sha }}")
+            if [ "$code" = "200" ]; then
+              echo "readytochat.realvuxbaro.me is live on ${{ github.sha }}"
+              exit 0
+            fi
+            sleep 10
+          done
+          echo "readytochat.realvuxbaro.me did not pick up ${{ github.sha }} within 3 minutes"
+          exit 1