.gitea/workflows/build-push.yml

@@ -2,7 +2,7 @@ name: Build and Push to ACR
 
 on:
   push:
-    branches: [ "dev" ]
+    branches: [ dev ]
   workflow_dispatch: {}
 
 concurrency:
@@ -16,6 +16,11 @@ jobs:
   build:
     name: Build and Push
     runs-on: ubuntu-latest
+    if: >-
+      github.ref != 'refs/heads/main' && (
+        github.event_name == 'workflow_dispatch' ||
+        (github.event_name == 'push' && github.event.before != '0000000000000000000000000000000000000000')
+      )
     permissions:
       contents: read
       id-token: write
@@ -23,52 +28,16 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      - name: Set up JDK 17
-        uses: actions/setup-java@v4
-        with:
-          distribution: 'temurin'
-          java-version: '17'
-      - name: Install Maven
-        run: |
-          if ! command -v mvn &>/dev/null; then
-            apt-get update -qq && apt-get install -y maven
-          fi
-          mvn --version
-      - name: Build with Maven
-        run: mvn clean package -DskipTests -Dcheckstyle.skip=true -B
-      - name: Run tests
-        # Exclude PostgresIntegrationTests — it hardcodes spring.docker.compose.skip.in-tests=false
-        # in its @SpringBootTest annotation, making it impossible to override via -D flags.
-        # docker-compose is not available in the act runner container.
-        # -Dtest=!ClassName is the correct Surefire 2.19+ CLI exclusion syntax.
-        # -Dcheckstyle.skip=true — platform-scaffolded files (score.yaml, k6/) contain
-        # internal http:// URLs that trip the NoHttp checkstyle plugin.
-        run: mvn test -B '-Dtest=!PostgresIntegrationTests' -Dcheckstyle.skip=true
-
-
-      - name: Security Scan - Trivy
-        continue-on-error: true
-        run: |
-          # Download release tarball directly — avoids install.sh which calls
-          # api.github.com/releases/tags/... and fails in network-restricted runners.
-          TRIVY_VERSION="0.57.1"
-          TRIVY_BIN="/tmp/trivy-bin/trivy"
-          if ! command -v trivy &>/dev/null; then
-            mkdir -p /tmp/trivy-bin
-            curl -sfLo /tmp/trivy.tar.gz               "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-            tar -xzf /tmp/trivy.tar.gz -C /tmp/trivy-bin trivy
-            chmod +x "${TRIVY_BIN}"
-          else
-            TRIVY_BIN="$(command -v trivy)"
-          fi
-          # Filesystem scan — exit-code 0 so findings are reported but never block the build
-          "${TRIVY_BIN}" fs             --severity HIGH,CRITICAL             --exit-code 0             --format table             --skip-db-update --offline-scan             .             || "${TRIVY_BIN}" fs                  --severity HIGH,CRITICAL                  --exit-code 0                  --format table                  .
 
       - name: Install Azure CLI
         run: |
-          if ! command -v az &>/dev/null; then
+          command -v az &>/dev/null || curl -sL https://aka.ms/InstallAzureCLIDeb | bash
-            curl -sL https://aka.ms/InstallAzureCLIDeb | bash
+
-          fi
+      - name: Install Docker CLI
+        run: |
+          command -v docker &>/dev/null || (apt-get update -qq && apt-get install -y docker.io)
+          docker --version
+
       - name: Azure login (OIDC)
         run: |
           az login \
@@ -76,13 +45,40 @@ jobs:
             --username "$AZURE_CLIENT_ID" \
             --tenant "$AZURE_TENANT_ID" \
             --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)"
-      - name: Build and push via ACR Tasks
+          echo "✓ Azure login successful"
+
+      - name: Get ACR details
         run: |
-          SHORT_SHA=$(echo "${{ gitea.sha }}" | cut -c1-7)
+          ACR_NAME=$(az acr list --query "[0].name" -o tsv)
-          az acr build \
+          ACR_NAME="${ACR_NAME:-bstagecjotdevacr}"
-            --registry bstagecjotdevacr \
+          echo "ACR_NAME=$ACR_NAME" >> $GITHUB_ENV
-            --image demo-ally-1:$SHORT_SHA \
+          echo "ACR_LOGIN_SERVER=${ACR_NAME}.azurecr.io" >> $GITHUB_ENV
-            --image demo-ally-1:latest \
+          echo "✓ Using ACR: ${ACR_NAME}.azurecr.io"
-            --file Dockerfile \
+
-            .
+      - name: ACR Login
-          echo "✓ Pushed: bstagecjotdevacr.azurecr.io/demo-ally-1:$SHORT_SHA"
+        run: |
+          ACR_TOKEN=$(az acr login --name "$ACR_NAME" --expose-token --output tsv --query accessToken)
+          docker login "$ACR_LOGIN_SERVER" \
+            --username 00000000-0000-0000-0000-000000000000 \
+            --password "$ACR_TOKEN"
+          echo "✓ ACR login successful"
+
+      - name: Build and Push Docker image
+        run: |
+          IMAGE_TAG="${{ gitea.sha }}"
+          IMAGE_FULL="${ACR_LOGIN_SERVER}/demo-ally-1:${IMAGE_TAG}"
+          IMAGE_LATEST="${ACR_LOGIN_SERVER}/demo-ally-1:latest"
+          docker build -t "$IMAGE_FULL" -t "$IMAGE_LATEST" .
+          docker push "$IMAGE_FULL"
+          docker push "$IMAGE_LATEST"
+          echo "IMAGE_FULL=$IMAGE_FULL" >> $GITHUB_ENV
+          echo "✓ Pushed: $IMAGE_FULL"
+
+      - name: Build Summary
+        run: |
+          echo "### ✅ Build Successful" >> $GITHUB_STEP_SUMMARY
+          echo "| | |" >> $GITHUB_STEP_SUMMARY
+          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
+          echo "| **Service** | demo-ally-1 |" >> $GITHUB_STEP_SUMMARY
+          echo "| **Commit** | ${{ gitea.sha }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| **Image** | $IMAGE_FULL |" >> $GITHUB_STEP_SUMMARY

.gitea/workflows/deploy.yml

@@ -1,4 +1,4 @@
-name: Deploy to Humanitec v2
+name: Deploy to Orchestrator
 
 on:
   workflow_run:
@@ -12,104 +12,175 @@ on:
         required: true
         default: 'dev'
         type: choice
-        options: [dev, staging, production]
+        options:
+          - dev
+          - staging
+          - prod
 
 env:
-  HUMANITEC_ORG: skillful-wild-chicken-2617
+  PO_API_URL: https://api.dev.orchestrator.crucible.kyndemo.live
-  HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }}
+  PO_ORG_ID: crucible
+  PO_AUTH_TOKEN: ${{ secrets.PO_AUTH_TOKEN }}
+  # ONE ORCHESTRATOR PROJECT PER APPLICATION.
+  #
+  # This used to be the shared `apps-cluster` project with one environment per app, which
+  # made every app a peer of every other: the Orchestrator tab on any component listed the
+  # entire estate, and an app had exactly one environment named after itself, so there was
+  # nowhere for dev/staging/prod to live.
+  #
+  # That shape existed to avoid a Terraform pull request against config/projects.tf for every
+  # scaffolded app. That constraint turned out not to be real -- `octl create project`,
+  # `octl create runner-rule` and `octl create environment` are all runtime operations, so
+  # the workflow below builds the whole thing on first deploy and needs no repository change.
   PROJECT_ID: demo-ally-1
-  DEFAULT_ENV_ID: dev
+  # The runner a project's workloads execute on. This is NOT cosmetic: the Kubernetes and
-  ACR_REGISTRY: bstagecjotdevacr.azurecr.io
+  # Helm providers are ambient, so a workload lands in whichever cluster its runner lives in,
+  # and Terraform state is keyed per runner. A project bound to the wrong runner deploys to
+  # the wrong cluster, and repointing it afterwards orphans the state it already owns.
+  PO_RUNNER_ID: crucible-orchestrator-dev-apps-dev-runner
+  OCTL_VERSION: 1.0.0
+  IMAGE: bstagecjotdevacr.azurecr.io/demo-ally-1
 
 jobs:
-  deploy:
+  guard:
-    name: Deploy to Humanitec v2
+    name: Platform guard
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    outputs:
+      ready: ${{ steps.check.outputs.ready }}
     steps:
       - uses: actions/checkout@v4
-      - name: Install dependencies
+      - name: Check platform initialized
-        run: apt-get update -qq && apt-get install -y jq
+        id: check
-      - name: Install hctl CLI
         run: |
-          HCTL_VERSION=$(curl -s https://api.github.com/repos/humanitec/hctl/releases/latest | jq -r '.tag_name')
+          if [ -f ".platform/initialized.md" ]; then
-          mkdir -p /tmp/hctl-install
+            echo "ready=true" >> $GITHUB_OUTPUT
-          curl -sLo /tmp/hctl-install/hctl.tar.gz "https://github.com/humanitec/hctl/releases/download/${HCTL_VERSION}/hctl_${HCTL_VERSION#v}_linux_amd64.tar.gz"
-          tar -xzf /tmp/hctl-install/hctl.tar.gz -C /tmp/hctl-install
-          install -m 755 /tmp/hctl-install/hctl /usr/local/bin/hctl
-      - name: Ensure Humanitec project and environment exist
-        env:
-          HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }}
-        run: |
-          DISPATCH_ENV="${{ github.event.inputs.environment }}"
-          ENV_ID="${DISPATCH_ENV:-$DEFAULT_ENV_ID}"
-          # Create project if it doesn't exist (hctl exits 0 if already exists)
-          hctl create project "$PROJECT_ID"             --set display_name="demo-ally-1" 2>&1 | grep -v "already exists" || true
-          # Create environment if it doesn't exist
-          hctl create environment "$PROJECT_ID" "$ENV_ID"             --set env_type_id=development             --set display_name="Development" 2>&1 | grep -v "already exists" || true
-          echo "✓ Project $PROJECT_ID / env $ENV_ID ready"
-      - name: Deploy with Score
-        env:
-          HUMANITEC_AUTH_TOKEN: ${{ secrets.HUMANITEC_TOKEN }}
-        run: |
-          DISPATCH_ENV="${{ github.event.inputs.environment }}"
-          ENV_ID="${DISPATCH_ENV:-$DEFAULT_ENV_ID}"
-          DEFAULT_IMAGE="$ACR_REGISTRY/demo-ally-1:latest"
-          # Pre-flight: wait for any deployment from a prior run to finish before calling hctl.
-          # hctl refuses to start a new deployment while one is still executing.
-          echo "Pre-flight: checking for in-progress deployments..."
-          MAX_PREFLIGHT=420
-          PREFLIGHT_WAITED=0
-          while [ $PREFLIGHT_WAITED -lt $MAX_PREFLIGHT ]; do
-            PREFLIGHT_STATUS=$(curl -sf               -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN"               "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true"               | jq -r '.items[0].status // "none"' 2>/dev/null || echo "none")
-            if [ "$PREFLIGHT_STATUS" != "in progress" ] && [ "$PREFLIGHT_STATUS" != "pending" ] && [ "$PREFLIGHT_STATUS" != "executing" ]; then
-              echo "Pre-flight passed (status=$PREFLIGHT_STATUS). Proceeding."
-              break
-            fi
-            echo "  Prior deployment still running ($PREFLIGHT_WAITED s elapsed, status=$PREFLIGHT_STATUS)..."
-            sleep 15
-            PREFLIGHT_WAITED=$((PREFLIGHT_WAITED + 15))
-          done
-          # First deploy — provisions all resources. On a brand-new Humanitec project the
-          # dns-k8s-ingress Terraform module runs before the K8s Service exists, so the
-          # ingress backend port falls back to 3000. A second deploy (below) corrects it
-          # once the Service is up, which is essential for Java/Python apps on port 8080.
-          HCTL_EXIT=0
-          timeout 300 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml             --no-prompt             --default-image "$DEFAULT_IMAGE" || HCTL_EXIT=$?
-          if [ "$HCTL_EXIT" -eq 0 ]; then
-            echo "✓ First deployment complete for demo-ally-1 to $ENV_ID"
-          elif [ "$HCTL_EXIT" -eq 124 ]; then
-            echo "✓ First deployment submitted (polling timed out — waiting for K8s to settle)"
           else
-            echo "✗ hctl failed with exit code $HCTL_EXIT"
+            echo "ready=false" >> $GITHUB_OUTPUT
-            exit $HCTL_EXIT
+            echo "Skipping: .platform/initialized.md not found"
           fi
-          # Poll Humanitec API until the first deployment is no longer in-progress before
+
-          # re-deploying. A flat sleep is unreliable — Terraform DNS modules can take 4-6 min.
+  deploy:
-          echo "Waiting for first deployment to finish (polling Humanitec API)..."
+    name: Deploy to Orchestrator
-          MAX_WAIT=360
+    needs: guard
-          WAITED=0
+    if: >-
-          while [ $WAITED -lt $MAX_WAIT ]; do
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && needs.guard.outputs.ready == 'true') ||
-            DEPLOY_STATUS=$(curl -sf               -H "Authorization: Bearer $HUMANITEC_AUTH_TOKEN"               "https://api.humanitec.dev/orgs/$HUMANITEC_ORG/last-deployments?env_id=$ENV_ID&project_id=$PROJECT_ID&state_change_only=true"               | jq -r '.items[0].status // "unknown"' 2>/dev/null || echo "unknown")
+      (github.event_name == 'workflow_dispatch')
-            if [ "$DEPLOY_STATUS" != "in progress" ] && [ "$DEPLOY_STATUS" != "pending" ] && [ "$DEPLOY_STATUS" != "executing" ]; then
+    runs-on: ubuntu-latest
-              echo "First deployment finished with status: $DEPLOY_STATUS"
+    steps:
-              break
+      - name: Checkout code
-            fi
+        uses: actions/checkout@v4
-            echo "  Still running ($WAITED s elapsed, status=$DEPLOY_STATUS)..."
+
-            sleep 15
+      - name: Install octl
-            WAITED=$((WAITED + 15))
+        run: |
-          done
+          set -euo pipefail
-          if [ $WAITED -ge $MAX_WAIT ]; then
+          curl -fsSLo /tmp/octl.tar.gz \
-            echo "Warning: first deployment still running after $MAX_WAIT s — proceeding anyway"
+            "https://github.com/stellwerk-labs/platform-orchestrator-cli/releases/download/v${OCTL_VERSION}/platform-orchestrator-cli_${OCTL_VERSION}_linux_amd64.tar.gz"
-          fi
+          tar xzf /tmp/octl.tar.gz -C /tmp
-          # Second deploy — dns module now reads the real K8s Service port, fixing the ingress
+          install -m 755 /tmp/octl /usr/local/bin/octl
-          HCTL_EXIT2=0
+          octl --version
-          timeout 120 hctl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml             --no-prompt             --default-image "$DEFAULT_IMAGE" || HCTL_EXIT2=$?
+
-          if [ "$HCTL_EXIT2" -eq 0 ]; then
+      - name: Derive environment
-            echo "✓ Deployment finalised for demo-ally-1 to $ENV_ID"
+        run: |
-          elif [ "$HCTL_EXIT2" -eq 124 ]; then
+          # The environment is now a STAGE of this application -- dev, staging, prod -- because
-            echo "✓ Second deployment submitted for demo-ally-1 to $ENV_ID (polling timed out)"
+          # the project is the application. It used to be the component id, which was the only
+          # option while every app shared one project and had to be distinguishable inside it.
+          DISPATCH_ENV="${{ github.event.inputs.environment }}"
+          if [ -n "$DISPATCH_ENV" ]; then
+            ENV_ID="$DISPATCH_ENV"
           else
-            echo "✗ Second hctl deploy failed with exit code $HCTL_EXIT2"
+            # On a workflow_run the branch is the triggering run's, not this job's checkout.
-            exit $HCTL_EXIT2
+            BRANCH="${{ github.event.workflow_run.head_branch }}"
+            BRANCH="${BRANCH:-${GITHUB_REF_NAME}}"
+            case "$BRANCH" in
+              staging) ENV_ID=staging ;;
+              prod|main|master) ENV_ID=prod ;;
+              *) ENV_ID=dev ;;
+            esac
+            echo "Branch '$BRANCH' maps to environment '$ENV_ID'"
           fi
+          echo "ENV_ID=$ENV_ID" >> $GITHUB_ENV
+          echo "Deploying $PROJECT_ID to environment: $ENV_ID"
+
+      - name: Ensure the project and its runner binding exist
+        run: |
+          set -euo pipefail
+          # Created on first deploy rather than by a pull request against config/projects.tf.
+          # None of this needs a repository change: project, runner rule and environment are
+          # all runtime objects.
+          #
+          # Neither create is idempotent, so both fall through to a read on the second run.
+          octl create project "$PROJECT_ID" \
+            --set display_name='demo-ally-1' || \
+            octl get project "$PROJECT_ID"
+
+          # The runner rule is what routes this project's deployments to the apps cluster.
+          # Creating it twice would leave two rules matching the same project, so it is
+          # created only when absent -- `create` would happily add a duplicate.
+          if octl get runner-rules -o json 2>/dev/null | grep -q "\"project_id\": *\"$PROJECT_ID\""; then
+            echo "Runner rule for '$PROJECT_ID' already exists."
+          else
+            octl create runner-rule \
+              --set project_id="$PROJECT_ID" \
+              --set runner_id="$PO_RUNNER_ID" \
+              --no-prompt
+          fi
+
+      - name: Ensure the environment exists
+        run: |
+          set -euo pipefail
+          # Project and environment ids are POSITIONAL; only env_type_id and display_name go
+          # through --set. `dev` and `stable` are the only environment TYPES that exist, so
+          # staging rides on the dev type -- the type governs policy, the id governs identity.
+          case "$ENV_ID" in
+            prod) ENV_TYPE=stable ;;
+            *)    ENV_TYPE=dev ;;
+          esac
+          octl create environment "$PROJECT_ID" "$ENV_ID" \
+            --set env_type_id="$ENV_TYPE" \
+            --set display_name="$ENV_ID" || \
+            octl get environment "$PROJECT_ID" "$ENV_ID"
+
+      - name: Deploy the Score workload
+        run: |
+          set -euo pipefail
+          # `octl score deploy` is ADDITIVE — it adds or updates a workload in the manifest and
+          # never removes one. That is the opposite of `octl deploy`, where omission is
+          # deletion. Do not substitute one for the other.
+          # No --show-logs: octl 1.0.0 has no such flag and exits 1 with `unknown flag`
+          # BEFORE contacting the orchestrator, so the whole deploy dies on an argument
+          # typo. Its nearest relatives are --runner-logs-level (default `info`, already
+          # what we want) and --skip-logs (which suppresses storage). Neither streams the
+          # runner's logs into this job, so there is nothing to substitute -- the runner
+          # logs are read from the orchestrator, not from here.
+          # The tag must be the commit the BUILD built, and it must be the WHOLE sha.
+          #
+          # build-push.yml tags with `` -- all 40 characters -- so the
+          # 7-character `${GITHUB_SHA:0:7}` this used to pass named a tag that has never
+          # existed in the registry.
+          #
+          # And on a workflow_run, GITHUB_SHA is the DEFAULT branch's head, while the build
+          # that produced the image ran on `dev`. They coincide only while the branches are
+          # level. `workflow_run.head_sha` is the triggering run's own commit, which is by
+          # definition the one that was built; `github.sha` covers the workflow_dispatch case,
+          # where there is no triggering run.
+          IMAGE_TAG="${{ github.event.workflow_run.head_sha || github.sha }}"
+          echo "Deploying ${IMAGE}:${IMAGE_TAG}"
+
+          octl score deploy "$PROJECT_ID" "$ENV_ID" score.yaml \
+            --default-image "${IMAGE}:${IMAGE_TAG}" \
+            --no-prompt
+
+      - name: Deployment summary
+        if: always()
+        run: |
+          # Same commit the deploy step resolved, abbreviated for reading only -- the
+          # deployed tag is the full sha.
+          DEPLOYED_SHA="${{ github.event.workflow_run.head_sha || github.sha }}"
+          SHORT_SHA="${DEPLOYED_SHA:0:7}"
+          echo "## Deployment Result" >> $GITHUB_STEP_SUMMARY
+          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|---|---|" >> $GITHUB_STEP_SUMMARY
+          echo "| Project | \`$PROJECT_ID\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Environment | \`$ENV_ID\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Commit | \`$SHORT_SHA\` |" >> $GITHUB_STEP_SUMMARY
+          echo "[View in Orchestrator Console](https://console.dev.orchestrator.crucible.kyndemo.live/orgs/$PO_ORG_ID/projects/$PROJECT_ID/environments/$ENV_ID)" >> $GITHUB_STEP_SUMMARY