deepseek-harness/.gitea/workflows/sync-upstream.yml

name: Sync upstream and build images

# Keeps this repository current with the official upstream
# (https://github.com/deepseek-ai/deepseek-harness) and the registry stocked
# with IMMUTABLE version tags:
#   1. Mirrors upstream master and dsh-v* tags into this repo.
#   2. Builds a new <version> tag when a new @deepseek-ai/dsh appears on npm
#      and the registry lacks it.
#   3. Freshness check for the PINNED default version (ARG DSH_VERSION in the
#      Dockerfile): if a newer pnpm release or a patched node base image has
#      shipped since the newest existing build of that version, builds a
#      <version>-r<run> revision tag with the updated toolchain.
#
# This workflow NEVER pushes or moves `latest`, and never re-pushes an
# existing tag: every upgrade of the running deployment is a deliberate
# template edit to a new immutable tag.

on:
  schedule:
    - cron: '17 */6 * * *'
  workflow_dispatch: {}
  push:
    branches: [main]
    paths:
      - Dockerfile
      - web.cordis.patch.yml
      - .gitea/workflows/sync-upstream.yml

env:
  UPSTREAM: https://github.com/deepseek-ai/deepseek-harness.git
  REGISTRY: gitea.milesward.dev
  IMAGE: mward4/deepseek-harness
  BASE_IMAGE: node:22-bookworm-slim

jobs:
  sync-and-build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout CI branch
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Mirror upstream refs into this repository
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -eux
          git clone --bare "$UPSTREAM" /tmp/upstream
          cd /tmp/upstream
          git remote add mirror "https://oauth2:${TOKEN}@${REGISTRY}/${IMAGE}.git"
          git push mirror '+refs/heads/master:refs/heads/master'
          git push mirror '+refs/tags/dsh-v*:refs/tags/dsh-v*'

      - name: Plan builds (new dsh version + pinned-version freshness)
        id: plan
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -eu
          DSH_LATEST=$(npm view @deepseek-ai/dsh@latest version)
          PNPM_LATEST=$(npm view pnpm@latest version)
          PINNED=$(sed -n 's/^ARG DSH_VERSION=//p' Dockerfile | head -1)
          docker pull -q "$BASE_IMAGE" > /dev/null
          BASE_DIGEST=$(docker inspect --format '{{index .RepoDigests 0}}' "$BASE_IMAGE")
          echo "dsh latest=$DSH_LATEST pinned=$PINNED pnpm=$PNPM_LATEST base=$BASE_DIGEST"

          ACCEPT='application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json'
          tag_exists() {
            [ "$(curl -s -o /dev/null -w '%{http_code}' -u "${{ github.repository_owner }}:${TOKEN}" \
              -H "Accept: $ACCEPT" "https://${REGISTRY}/v2/${IMAGE}/manifests/$1")" = 200 ]
          }
          # Labels of a single-arch manifest's config blob ("pnpm|base"); empty
          # output (index manifests, missing labels) means "treat as stale".
          tag_toolchain() {
            MAN=$(curl -s -u "${{ github.repository_owner }}:${TOKEN}" \
              -H 'Accept: application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json' \
              "https://${REGISTRY}/v2/${IMAGE}/manifests/$1") || return 0
            CFG=$(printf '%s' "$MAN" | grep -o '"digest": *"sha256:[a-f0-9]*"' | head -1 | grep -o 'sha256:[a-f0-9]*') || return 0
            [ -n "$CFG" ] || return 0
            BLOB=$(curl -s -u "${{ github.repository_owner }}:${TOKEN}" "https://${REGISTRY}/v2/${IMAGE}/blobs/$CFG") || return 0
            P=$(printf '%s' "$BLOB" | grep -o '"dev.milesward.pnpm-version":"[^"]*"' | cut -d'"' -f4 || true)
            B=$(printf '%s' "$BLOB" | grep -o '"dev.milesward.base-digest":"[^"]*"' | cut -d'"' -f4 || true)
            echo "${P}|${B}"
          }

          BUILDS=""
          # 1. New official release the registry lacks -> new version tag.
          if ! tag_exists "$DSH_LATEST"; then
            BUILDS="$DSH_LATEST=$DSH_LATEST"
          fi
          # 2. Pinned version: missing entirely -> build it; otherwise compare
          #    the newest existing build's toolchain labels and cut a -rN
          #    revision when pnpm or the base image moved.
          if [ "$PINNED" != "$DSH_LATEST" ] && ! tag_exists "$PINNED"; then
            BUILDS="$BUILDS $PINNED=$PINNED"
          elif tag_exists "$PINNED"; then
            NEWEST=$(curl -s -H "Authorization: token ${TOKEN}" \
              "https://${REGISTRY}/api/v1/packages/${{ github.repository_owner }}?type=container&q=deepseek-harness&limit=100" \
              | tr ',' '\n' | sed -n 's/.*"version": *"\([^"]*\)".*/\1/p' \
              | grep -E "^${PINNED}(-r[0-9]+)?$" | sort -V | tail -1)
            TOOL=$(tag_toolchain "$NEWEST")
            echo "newest build of pinned: $NEWEST toolchain='$TOOL'"
            if [ "$TOOL" != "${PNPM_LATEST}|${BASE_DIGEST}" ]; then
              echo "toolchain stale (want ${PNPM_LATEST}|${BASE_DIGEST}) -> revision build"
              BUILDS="$BUILDS ${PINNED}-r${{ github.run_number }}=$PINNED"
            fi
          fi

          echo "planned builds: '${BUILDS}'"
          {
            echo "builds=${BUILDS}"
            echo "pnpm=${PNPM_LATEST}"
            echo "base_digest=${BASE_DIGEST}"
          } >> "$GITHUB_OUTPUT"

      - name: Build, smoke-test, and push
        if: steps.plan.outputs.builds != ''
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
          PNPM_VERSION: ${{ steps.plan.outputs.pnpm }}
          BASE_DIGEST: ${{ steps.plan.outputs.base_digest }}
        run: |
          set -eux
          echo "$TOKEN" | docker login "$REGISTRY" -u "${{ github.repository_owner }}" --password-stdin
          for entry in ${{ steps.plan.outputs.builds }}; do
            TAG=${entry%%=*}
            VER=${entry#*=}
            REF="${REGISTRY}/${IMAGE}:${TAG}"
            docker build \
              --build-arg "DSH_VERSION=${VER}" \
              --build-arg "PNPM_VERSION=${PNPM_VERSION}" \
              --build-arg "BASE_DIGEST=${BASE_DIGEST}" \
              -t "$REF" .

            # Smoke: versions match, and the web server actually boots with
            # the baked patch and answers HTTP on its non-loopback interface.
            # 200 = pre-token versions; 303/401 = 0.1.2+ launch-token auth.
            SMOKE="dsh-smoke-${{ github.run_id }}"
            docker rm -f "$SMOKE" 2>/dev/null || true
            docker run -d --name "$SMOKE" "$REF"
            sleep 3
            [ "$(docker exec "$SMOKE" dsh --version)" = "$VER" ]
            [ "$(docker exec "$SMOKE" pnpm --version)" = "$PNPM_VERSION" ]
            OK=""
            for i in $(seq 1 30); do
              if docker exec "$SMOKE" node -e '
                const os = require("os");
                const nic = Object.values(os.networkInterfaces()).flat()
                  .find(i => i && i.family === "IPv4" && !i.internal);
                fetch("http://" + nic.address + ":3080/").then(r => {
                  process.exit([200, 303, 401].includes(r.status) ? 0 : 1);
                }).catch(() => process.exit(2));'
              then OK=1; break; fi
              sleep 2
            done
            if [ -z "$OK" ]; then
              echo "::error::smoke test failed for $REF (server never answered on the container interface)"
              docker logs "$SMOKE" | tail -50
              docker rm -f "$SMOKE"
              exit 1
            fi
            docker rm -f "$SMOKE"

            docker push "$REF"
          done