feat: add CI-gated claude-dev image package

Define claude-dev capabilities as a tested contract and deploy immutable tags only after smoke checks so daily tooling upgrades remain CI-first and rollback-safe. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-02 23:40:44 +08:00
parent a91a1132c9
commit 755a0b6ae9
9 changed files with 326 additions and 1 deletions
@@ -0,0 +1,107 @@
+name: Deploy Claude Dev (Dev)
+on:
+  push:
+    branches: [dev]
+    paths:
+      - 'claude-dev/**'
+      - '.gitea/workflows/deploy-claude-dev-dev.yml'
+  workflow_dispatch:
+    inputs:
+      rollback_image:
+        description: 'Optional full image ref (for rollback), e.g. claude-dev:dev-abc123'
+        required: false
+
+jobs:
+  deploy-claude-dev-dev:
+    runs-on: ubuntu-latest
+    container:
+      volumes:
+        - /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
+        - /volume1/docker/claude-dev:/claude-dev-runtime
+    steps:
+      - name: Checkout dev branch
+        run: git clone --depth 1 --branch dev http://gitea:3000/jimmy/nas-tools.git .
+
+      - name: Resolve image tags
+        run: |
+          set -euo pipefail
+          if [ -n "${{ inputs.rollback_image }}" ]; then
+            image_ref="${{ inputs.rollback_image }}"
+            image_tag="${image_ref#claude-dev:}"
+            if [ "$image_ref" = "$image_tag" ]; then
+              echo "rollback_image must be in claude-dev:<tag> format" >&2
+              exit 1
+            fi
+            echo "ROLLBACK_ONLY=1" >> "$GITHUB_ENV"
+          else
+            short_sha="$(git rev-parse --short=12 HEAD)"
+            date_tag="$(date +%Y%m%d%H%M%S)"
+            image_tag="dev-${date_tag}-${short_sha}"
+            image_ref="claude-dev:${image_tag}"
+            echo "ROLLBACK_ONLY=0" >> "$GITHUB_ENV"
+          fi
+          echo "CLAUDE_DEV_IMAGE_TAG=${image_tag}" >> "$GITHUB_ENV"
+          echo "CLAUDE_DEV_IMAGE=${image_ref}" >> "$GITHUB_ENV"
+
+      - name: Build claude-dev image
+        if: env.ROLLBACK_ONLY == '0'
+        run: |
+          set -euo pipefail
+          DOCKER_BUILDKIT=0 docker build \
+            --cache-from claude-dev:latest \
+            -t "$CLAUDE_DEV_IMAGE" \
+            -t claude-dev:latest \
+            claude-dev/
+
+      - name: Smoke test required tools
+        if: env.ROLLBACK_ONLY == '0'
+        run: |
+          set -euo pipefail
+          docker run --rm "$CLAUDE_DEV_IMAGE" bash /opt/claude-dev/scripts/smoke-tools.sh
+
+      - name: Smoke test network assumptions
+        if: env.ROLLBACK_ONLY == '0'
+        run: |
+          set -euo pipefail
+          docker run --rm --network host "$CLAUDE_DEV_IMAGE" bash /opt/claude-dev/scripts/smoke-network.sh
+
+      - name: Smoke test auth and mount expectations
+        if: env.ROLLBACK_ONLY == '0'
+        run: |
+          set -euo pipefail
+          docker run --rm --network host \
+            -e REQUIRE_MOUNTS=1 \
+            -v /volume1/docker/claude-dev/claude-config:/root/.claude \
+            -v /volume1/docker/claude-dev/claude-config/.claude.json:/root/.claude.json \
+            -v /volume1/docker/claude-dev/gitea_token:/root/.gitea_token:ro \
+            "$CLAUDE_DEV_IMAGE" \
+            bash /opt/claude-dev/scripts/smoke-auth.sh
+
+      - name: Record previous image
+        run: |
+          set -euo pipefail
+          previous_image="$(docker inspect -f '{{.Config.Image}}' claude-dev 2>/dev/null || true)"
+          if [ -n "$previous_image" ]; then
+            printf '%s\n' "$previous_image" > /claude-dev-runtime/previous-image.txt
+            echo "Saved previous image: $previous_image"
+          else
+            echo "No existing claude-dev container found"
+          fi
+
+      - name: Sync compose and target tag
+        run: |
+          set -euo pipefail
+          cp claude-dev/docker-compose.yml /claude-dev-runtime/docker-compose.yml
+          printf '%s\n' "$CLAUDE_DEV_IMAGE_TAG" > /claude-dev-runtime/target-tag.txt
+
+      - name: Deploy claude-dev
+        run: |
+          set -euo pipefail
+          CLAUDE_DEV_IMAGE_TAG="$CLAUDE_DEV_IMAGE_TAG" docker compose -f /claude-dev-runtime/docker-compose.yml up -d --pull never
+
+      - name: Post-deploy runtime checks
+        run: |
+          set -euo pipefail
+          docker exec claude-dev bash -lc 'claude --version'
+          docker exec claude-dev bash -lc 'gh --version'
+          docker exec claude-dev bash -lc 'gh auth status || true'