Merge pull request #328 from smocker-dev/refactor/build-pipeline

build: embed the client via a build tag and streamline the release pipeline

Author: gwleclerc

.github/workflows/main.yml

@@ -14,12 +14,12 @@ on:
       - main
   workflow_dispatch: # Allow manual trigger
 
-# Least privilege by default; jobs that need more elevate it explicitly (see deploy).
+# Least privilege by default; the deploy job elevates it explicitly.
 permissions:
   contents: read
 
-# Cancel superseded runs on the same ref, but only for pull requests — never abort an
-# in-flight push to main or a tag (which may be mid-release).
+# Cancel superseded runs on the same ref, but only for pull requests — never abort an in-flight
+# push to main or a tag (which may be mid-release).
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -32,14 +32,14 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: npm
-
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
       - run: npm ci
-
       - name: Lint sources
         run: |
           make lint
@@ -53,124 +53,104 @@ jobs:
         with:
           fetch-depth: 0 # SonarCloud needs the full history for blame/coverage
           persist-credentials: false
-
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: npm
-
-      - name: Setup Go environment
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-
       - run: npm ci
-
       - name: Execute tests
         run: |
           make test
           make test-integration
           npm test
           make coverage
-
       - name: SonarCloud Scan
         uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
         continue-on-error: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
-  build:
+  e2e:
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-
-      - id: extract_ref
-        run: echo "GIT_REF=${GITHUB_REF##*/}" >> "$GITHUB_OUTPUT"
-
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: npm
-
-      - name: Setup Go environment
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
-
       - run: npm ci
+      - name: Install Playwright browser
+        run: npx playwright install --with-deps chromium
+      - name: Run Playwright non-regression suite
+        run: make test-e2e
 
-      - name: Build
-        run: |
-          make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} RELEASE=1 release
-          make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} build-docker
-          make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} start-docker
-
-      - name: Smoke-test the docker image
-        run: make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} smoke-docker
-
-      - if: startsWith(github.ref, 'refs/tags/')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: smocker-bin
-          path: ./build/smocker.tar.gz
-
-  e2e:
+  security:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: npm
-
-      - name: Setup Go environment
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
+      # Audit only the dependencies that ship in the client bundle (dev tooling isn't served), and
+      # fail only on high/critical advisories.
+      - name: Audit frontend dependencies (npm)
+        run: npm audit --omit=dev --audit-level=high
+      # govulncheck reports only vulnerabilities actually reachable from the code, so it's low-noise
+      # and safe to gate on.
+      - name: Scan backend dependencies (govulncheck)
+        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
 
-      - run: npm ci
-
-      - name: Install Playwright browser
-        run: npx playwright install --with-deps chromium
-
-      - name: Run Playwright non-regression suite
-        run: make test-e2e
-
-  security:
+  build:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: npm
-
-      - name: Setup Go environment
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
-      # Audit only the dependencies that ship in the client bundle (dev tooling isn't
-      # served), and fail only on high/critical advisories.
-      - name: Audit frontend dependencies (npm)
-        run: npm audit --omit=dev --audit-level=high
+      # Every run assembles the native image and smoke-tests it (proves the Dockerfile + embedded
+      # UI still work). Only tag builds also cross-compile the release binaries + tarball, which the
+      # deploy job packages into the multi-arch image and the GitHub release.
+      - name: Build image (+ release binaries on tags) and smoke-test
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: |
+          targets="build-docker start-docker smoke-docker"
+          [[ "$GITHUB_REF" == refs/tags/* ]] && targets="release $targets"
+          make VERSION="$VERSION" RELEASE=1 $targets
 
-      # govulncheck reports only vulnerabilities actually reachable from the code, so it's
-      # low-noise and safe to gate on.
-      - name: Scan backend dependencies (govulncheck)
-        run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+      - name: Upload release artifacts
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: smocker-dist
+          path: |
+            build/smocker.tar.gz
+            build/smocker-*
 
   deploy:
     needs: [lint, test, build, e2e, security]
@@ -186,20 +166,18 @@ jobs:
         with:
           persist-credentials: false
 
-      - id: extract_ref
-        run: echo "GIT_REF=${GITHUB_REF##*/}" >> "$GITHUB_OUTPUT"
-
       - id: release_flags
         name: Derive the release flavor from the tag suffix
+        env:
+          REF: ${{ github.ref_name }}
         run: |
-          ref="${GITHUB_REF##*/}"
           draft=false
           prerelease=false
           make_latest=true
-          if [[ "$ref" == *-draft ]]; then
+          if [[ "$REF" == *-draft ]]; then
             draft=true          # unpublished, editable on GitHub before release
             make_latest=false
-          elif [[ "$ref" == *-* ]]; then
+          elif [[ "$REF" == *-* ]]; then
             prerelease=true      # e.g. -preview / -rc: published but never "Latest"
             make_latest=false
           fi
@@ -209,33 +187,34 @@ jobs:
             echo "make_latest=$make_latest"
           } >> "$GITHUB_OUTPUT"
 
+      # The pre-built binaries (+ tarball) from the build job; the image is assembled from them.
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: smocker-bin
+          name: smocker-dist
           path: ./build
 
-      - run: cd build && tar -xvf smocker.tar.gz
-
       - name: Docker login
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-
+      # No QEMU: the image only packages the pre-built binaries (COPY-only target stages).
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Deploy on Docker registry
-        run: make VERSION=${{ steps.extract_ref.outputs.GIT_REF }} deploy-docker
+        env:
+          VERSION: ${{ github.ref_name }}
+        run: make VERSION="$VERSION" deploy-docker
 
       - name: Deploy on GitHub releases
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
-          files: build/smocker.tar.gz
+          files: |
+            build/smocker.tar.gz
+            build/smocker-*
           token: ${{ secrets.GITHUB_TOKEN }}
           draft: ${{ steps.release_flags.outputs.draft }}
           prerelease: ${{ steps.release_flags.outputs.prerelease }}

.gitignore

@@ -3,6 +3,5 @@
 node_modules/
 # All build, test and runtime output goes here (see Makefile / vite.config.ts / playwright.config.ts).
 build/
-# The embedded client is copied here by the release build; keep only the placeholder in git.
-server/frontend/dist/*
-!server/frontend/dist/.gitkeep
+# Vite builds the client straight here for embedding (release builds only, -tags embedclient).
+server/frontend/dist/

Dockerfile

@@ -1,26 +1,21 @@
-ARG GO_VERSION=1.26
-FROM golang:${GO_VERSION}-alpine AS build-backend
-RUN apk add --no-cache make ca-certificates
-ARG VERSION=snapshot
-ARG COMMIT
-WORKDIR /go/src/smocker
-COPY go.mod go.sum ./
-RUN go mod download
-COPY Makefile main.go ./
-COPY server/ ./server/
-# The client is built on the host (make release); bake it into the binary via go:embed.
-COPY build/client ./server/frontend/dist/
-# CGO_ENABLED=0 produces a fully static binary (pure-Go net/tls), required for a scratch image.
-RUN CGO_ENABLED=0 make VERSION=$VERSION COMMIT=$COMMIT RELEASE=1 build
+# The images are assembled from pre-built, static, client-embedded binaries (see
+# `make build-binaries`) — no compilation happens here, just packaging. buildx sets
+# TARGETOS/TARGETARCH/TARGETVARIANT per target platform, which selects the matching binary.
+
+# CA roots for the proxy mock type's HTTPS backends (scratch ships none). Pin to the build
+# platform: the cert bundle is arch-independent, so it's produced once natively and no target
+# platform ever runs a RUN step — the per-arch stage is COPY-only, so no QEMU emulation is needed.
+FROM --platform=$BUILDPLATFORM alpine:3 AS certs
+RUN apk add --no-cache ca-certificates
 
 FROM scratch
 LABEL org.opencontainers.image.source="https://github.com/smocker-dev/smocker"
 EXPOSE 8080 8081
-# CA roots so the proxy mock type can reach HTTPS backends (scratch ships none).
-COPY --from=build-backend /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-# The UI is embedded in the binary, so nothing else is needed — just the static binary.
-COPY --from=build-backend /go/src/smocker/build/smocker /smocker
-# Run unprivileged (nobody). The listen ports are >1024 so no privilege is needed; a mounted
-# persistence directory must be writable by this uid.
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY build/smocker-${TARGETOS}-${TARGETARCH}${TARGETVARIANT} /smocker
+# Run unprivileged (nobody); ports are >1024 and a mounted persistence dir must be writable by it.
 USER 65534:65534
 ENTRYPOINT ["/smocker"]