boban
/
clusev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
clusev/docs/release-pipeline.md

2.9 KiB
Raw Blame History

Release pipeline (maintainers — INTERNAL)

This file is export-ignore (see .gitattributes) — it never reaches the public repo. It may name the private repositories.

Clusev is promoted across three repositories, dev → staging → public:

Repo URL Role
Gitea (dev) https://git.bave.dev/boban/clusev Sole development source. Commit + tag here.
GitHub private (staging) https://github.com/boksbc/clusev-staging Push-mirror of Gitea. Runs CI; betas tested on staging.
GitHub public (release) https://github.com/clusev/clusev Receives only released versions — one clean commit per release, beta + stable tags. Public users install/update from here.

Channels follow semver tags: beta = vX.Y.Z-betaN, stable = vX.Y.Z.

No private repo URL is committed: config/clusev.php defaults repository to the public URL, install.sh derives CLUSEV_REPOSITORY from the clone origin into the (gitignored) .env, so dev points at Gitea, staging at GitHub-private, and public users at GitHub-public — automatically.

One-time wiring

  1. Gitea push-mirror (Gitea → repo → Settings → Mirror → Push Mirror):
    • Remote: https://github.com/boksbc/clusev-staging.git
    • Auth: GitHub username + a GitHub PAT (scope repo) as the password.
    • Enable "sync when new commits are pushed".
  2. boksbc/clusev-staging → Settings:
    • Variable PUBLIC_REPO_SLUG = clusev/clusev (the only variable the promotion workflows read).
    • Secret PUBLIC_REPO_TOKEN = a PAT/deploy token with push to clusev/clusev.
    • Environment production with a required reviewer (gates the promotion workflows).
    • (Optional staging deploy) Variable STAGING_ENABLED=true, STAGING_PROJECT_DIR, and a self-hosted runner labelled clusev-staging on the internal network — GitHub-hosted runners cannot reach the internal staging host (.165). Until then, update staging from its Versions page.

Promoting

  • To staging: push a beta tag vX.Y.Z-betaN to Gitea → mirror → CI tests it; staging runs the beta.
  • To public (beta): on boksbc/clusev-staging → Actions → run Promote to public (beta channel) with the beta tag → publishes it to clusev/clusev (beta channel).
  • To stable: run Promote beta to stable with the beta tag + the stable tag → publishes vX.Y.Z to clusev/clusev (stable channel).

There are no custom webhooks: Gitea's push-mirror + GitHub Actions (on: push tags / workflow_dispatch) replace them. promote.sh copies the release tree with git archive, which honours export-ignore, so internal docs (CLAUDE.md, rules.md, handoff.md, docs/) never reach the public repo. Phase B will drive the workflow_dispatch promotions from the dev dashboard via the GitHub API with a deploy token in the encrypted vault — see docs/superpowers/specs/2026-06-22-3-repo-release-promotion-design.md.