feat(hrafn): author the CI deploy that replaces the hand-rsync path

hrafn was handed to infra-ops for uptime ownership with no CI deploy and no commit provenance -- the image was always local/hrafn:v1 and the whole working tree lived in the compose directory. These two files fix both. They are authored here because infra-ops owns hrafn's uptime, but they belong in vh/hrafn; claude-bot is not a collaborator there, so they are handed to the repo holder rather than committed directly. - playbooks-deploy.yaml -> vh/hrafn playbooks/deploy.yaml - gitea-workflows-deploy.yaml -> vh/hrafn .gitea/workflows/deploy.yaml Design calls recorded in the README: the build context travels as one tarball rather than per-file upload steps (nevermore's pattern fails open when a new source file has no matching step), and the playbook refuses to deploy unless .env exists at 0600 -- a guard prompted by it arriving 0644 with a live bearer token in it. Validated with `elway --dry-run`, which caught a real interpolation bug during authoring. No new Actions secrets needed.
2026-08-22 15:26:45 -07:00
parent b6924de728
commit b001d0cb2e
3 changed files with 252 additions and 0 deletions
@@ -0,0 +1,87 @@
+# Gitea Actions workflow for hrafn.
+#
+# Runs on every push to main (and on manual workflow_dispatch). Drives
+# the in-repo elway playbook (playbooks/deploy.yaml) — that file is the
+# single source of truth for "how hrafn is deployed", manual or automated.
+#
+# Replaces the hand-rsync deploy. Two things change as a result:
+#   - the image is tagged with the commit SHA rather than a fixed `v1`,
+#     so the host can answer "what is running" and a rollback is a retag
+#   - only the build context ships (Dockerfile, compose.yaml,
+#     pyproject.toml, README.md, src/) instead of the whole working tree,
+#     so tests/, docs/, persistent-memory.md and friends stop living in
+#     /opt/docker/compose/hrafn on the server
+#
+# Required Actions secrets — both already exist at user scope on vh from
+# the nevermore/task-board wiring, so there is nothing new to provision:
+#
+#   DEPLOY_SSH_KEY    Private SSH key authorized for lkraven@ana-docker.
+#   MGMT_REPO_TOKEN   Gitea PAT (read:repository) on vh/esh-pfi-infrastructure.
+#                     Needed to clone elway from the management repo.
+#
+# NOT handled here: .env. It is host-owned, 0600, holds the bearer token,
+# and is provisioned once from vault item ana-docker/hrafn/bearer-token.
+# The playbook refuses to deploy if it is missing or not 0600.
+
+name: Deploy hrafn
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    runs-on: pfi-fleet
+
+    steps:
+      - name: Install playbook prerequisites
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            python3 python3-yaml openssh-client tar
+          rm -rf /var/lib/apt/lists/*
+
+      - name: Checkout hrafn (triggering repo)
+        uses: actions/checkout@v4
+
+      - name: Checkout management repo (for elway)
+        uses: actions/checkout@v4
+        with:
+          repository: vh/esh-pfi-infrastructure
+          token: ${{ secrets.MGMT_REPO_TOKEN }}
+          path: _mgmt
+
+      - name: Configure SSH to ana-docker
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          cat > ~/.ssh/config <<'EOF'
+          Host ana-docker
+            HostName 10.250.50.70
+            User lkraven
+            IdentityFile ~/.ssh/id_ed25519
+            StrictHostKeyChecking accept-new
+          EOF
+          chmod 600 ~/.ssh/config
+
+      - name: Build the deploy context
+        # Only what the Dockerfile actually consumes, plus compose.yaml.
+        # Deliberately excludes tests/, docs/, persistent-memory.md,
+        # ROADMAP.md, CLAUDE.md, LICENSE and .env — none of them belong
+        # in a production compose directory.
+        run: |
+          mkdir -p dist
+          tar czf dist/hrafn-context.tgz \
+            Dockerfile compose.yaml pyproject.toml README.md src
+          echo "context contents:"
+          tar tzf dist/hrafn-context.tgz
+
+      - name: Deploy hrafn (in-repo elway playbook)
+        # hrafn_sha becomes the image tag and is written to
+        # /opt/docker/compose/hrafn/.deployed on the host.
+        run: |
+          _mgmt/scripts/elway ana-docker \
+            --playbook playbooks/deploy.yaml \
+            --var hrafn_sha=${GITHUB_SHA::12}