Gallery view: iOS-style grid of visual note cards #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & publish images | |
| # Test gates first, then build the API and web (nginx+PWA) images and push | |
| # them to GHCR. The build job only runs if the checks pass, so a regression | |
| # never reaches an image. The NAS just pulls. | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| jobs: | |
| backend-checks: | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: notesapp | |
| ports: ["5432:5432"] | |
| options: >- | |
| --health-cmd "pg_isready -U postgres" --health-interval 5s | |
| --health-timeout 5s --health-retries 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| - name: Install dependencies | |
| run: pip install -r backend/requirements.txt | |
| - name: Lint (ruff) | |
| working-directory: backend | |
| run: ruff check app tests | |
| - name: Unit tests (pytest) | |
| working-directory: backend | |
| run: python -m pytest | |
| - name: Migrations apply cleanly on a fresh Postgres | |
| working-directory: backend | |
| env: | |
| DATABASE_URL: postgresql+asyncpg://postgres:postgres@localhost:5432/notesapp | |
| run: alembic upgrade head | |
| pwa-checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: pwa/package-lock.json | |
| - name: Install dependencies | |
| working-directory: pwa | |
| run: npm ci | |
| - name: Type-check and build | |
| working-directory: pwa | |
| run: npm run build | |
| build-images: | |
| needs: [backend-checks, pwa-checks] | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| strategy: | |
| matrix: | |
| include: | |
| - name: api | |
| context: ./backend | |
| dockerfile: ./backend/Dockerfile | |
| - name: web | |
| context: . | |
| dockerfile: ./pwa/Dockerfile | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # arm64 layers build under QEMU emulation — slower, but the images | |
| # then run natively on both the Intel NAS and Apple Silicon Macs. | |
| - uses: docker/setup-qemu-action@v3 | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.name }} | |
| tags: | | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| type=semver,pattern={{version}} | |
| type=sha | |
| - uses: docker/build-push-action@v6 | |
| with: | |
| context: ${{ matrix.context }} | |
| file: ${{ matrix.dockerfile }} | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha,scope=${{ matrix.name }} | |
| cache-to: type=gha,scope=${{ matrix.name }},mode=max |