ci: 🔧 add ci

.github/workflows/build.yml

@@ -0,0 +1,47 @@
+name: Build
+
+on:
+  workflow_call:
+    inputs:
+      image:
+        required: true
+        type: string
+      context:
+        required: true
+        type: string
+      target:
+        required: true
+        type: string
+    outputs:
+      image_tag:
+        value: ${{ jobs.build.outputs.image_tag }}
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.meta.outputs.tags }}
+    permissions:
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ inputs.image }}
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ inputs.context }}
+          push: true
+          pull: true
+          tags: ${{ steps.meta.outputs.tags }}
+          target: ${{ inputs.target }}

.github/workflows/main-ci.yml

@@ -0,0 +1,23 @@
+name: Main CI
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+      - dev
+  pull_request:
+    branches:
+      - main
+      - dev
+
+jobs:
+  build:
+    name: Build Frontend
+    uses: ./.github/workflows/build.yml
+    with:
+      image: ghcr.io/dnum-mi/grist-sync-plugin
+      context: ./
+      target: prod
+
+

.github/workflows/release-build.yml

@@ -0,0 +1,17 @@
+name: Version Release Build
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+
+  build:
+    name: Build
+    uses: ./.github/workflows/build.yml
+    with:
+      image: ghcr.io/dnum-mi/grist-sync-plugin
+      context: ./
+      target: prod

.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  release:
+    name: Create new release
+    runs-on: ubuntu-latest
+    outputs:
+      release-created: ${{ steps.release.outputs.release_created }}
+      major-tag: ${{ steps.release.outputs.major }}
+      minor-tag: ${{ steps.release.outputs.minor }}
+      patch-tag: ${{ steps.release.outputs.patch }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Pre release new version
+        id: release
+        uses: googleapis/release-please-action@v4
+        with:
+          target-branch: ${{ github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -28,5 +28,3 @@ coverage
 *.njsproj
 *.sln
 *.sw?
-
-package-lock.json

.gitlab-ci-dso.yml

@@ -0,0 +1,36 @@
+include:
+  - project: $CATALOG_PATH
+    file: vault-ci.yml
+    ref: main
+  - project: $CATALOG_PATH
+    file: kaniko-ci.yml
+    ref: main
+
+default:
+  image: alpine:latest
+
+variables:
+  REGISTRY_URL: ${REGISTRY_HOST}/${PROJECT_PATH}
+
+stages:
+  - read-secret
+  - docker-build
+
+read_secret:
+  stage: read-secret
+  extends:
+    - .vault:read_secret
+
+build:
+  variables:
+    WORKING_DIR: ./
+    DOCKERFILE: ./Dockerfile
+    IMAGE_NAMES: grist-sync-api:${CI_COMMIT_SHORT_SHA} grist-sync-api:${CI_COMMIT_REF_NAME}
+    EXTRA_BUILD_ARGS: --registry-mirror registry.dso.interieur.rie.gouv.fr/dockerhub
+  stage: docker-build
+  extends:
+    - .kaniko:build-push
+  # Triggers job only if a file in the client directory changed in current commit
+  # rules:
+  #   - changes:
+  #     - client/**/*

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.1"
+}

Dockerfile

@@ -0,0 +1,31 @@
+FROM node:24-slim AS base
+
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y jq \
+    && apt-get clean
+
+
+# Copy necessary files
+COPY package.json package-lock.json ./
+
+FROM base AS dev
+RUN npm install
+CMD ["pnpm" , "run" , "dev"]
+
+
+FROM base AS build
+RUN npm install
+COPY . .
+# Temporary disable type checking
+RUN npm ci
+RUN npm run build
+FROM nginxinc/nginx-unprivileged:1.27-alpine AS prod
+
+USER 0
+
+RUN chmod 777 /usr/share/nginx/html
+COPY --chown=101:101 --chmod=400 nginx.conf /etc/nginx/nginx.conf
+COPY --chown=101:101 --from=build /app/dist /usr/share/nginx/html
+

nginx.conf

@@ -0,0 +1,28 @@
+worker_processes 4;
+
+events { worker_connections 1024; }
+
+# Directive to run nginx as non-root user
+pid        /tmp/nginx.pid;
+
+http {
+    # https://github.com/dnum-mi/basegun/issues/407
+    server_tokens off;
+
+    server {
+        listen 8080;
+        root  /usr/share/nginx/html;
+        include /etc/nginx/mime.types;
+
+        location / {
+          try_files $uri $uri/ /index.html;
+        }
+
+        error_page  404              /404.html;
+
+        error_page  500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   /usr/share/nginx/html;
+        }
+    }
+}