gowalk-cicd 1.0.21 → 1.0.23

package/README.md

@@ -39,6 +39,36 @@ Re-run the same command anytime to pull the latest version.
 5. The existing metadata-rich form
    `*(key_id_<KEY_ID>_issuer_<UUID>_vendor_id_<ID>).p8` is also accepted.
 
+## Backend deploy (Python + Postgres, Docker)
+
+When a repo carries a Dockerized backend — a `backend/` (or `server/`) directory
+with a `docker-compose.yml` — the installer also vendors a backend deploy path:
+`.github/actions/backend-app/` and `.github/workflows/deploy-backend.yml`. A
+mobile-only repo is unaffected (the backend path is not installed).
+
+The backend workflow runs on a GitHub-hosted runner and, on a push touching
+`backend/**`, deploys to the gowalk host (`138.197.36.107`, publicly reachable):
+it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
+`docker compose up -d --build`, auto-detects the published `127.0.0.1:<port>`,
+wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
+
+Requirements on the consumer repo:
+
+- **`backend/docker-compose.yml`** that publishes the API on a **loopback host
+  port** (`127.0.0.1:<port>:<container-port>`) so nginx can proxy it. Include a
+  Postgres service (or use a per-app database) and a `/health` endpoint.
+- A **`Dockerfile`** the compose file builds; pin the base image, run non-root,
+  never bake secrets in. A generated `.env` (with `POSTGRES_PASSWORD`) is created
+  on the host on first deploy and preserved across deploys (rsync excludes it).
+- Repo **secret** `BACKEND_DEPLOY_SSH_KEY` (a private key with access to the host).
+- Repo **variables** (optional): `BACKEND_API_DOMAIN` (its DNS A record must point
+  at the host for the cert; empty = deploy the container only, skip nginx/cert),
+  `BACKEND_APP_NAME` (defaults to the repo name), `BACKEND_HEALTH_PATH`
+  (default `/health`), `BACKEND_DEPLOY_HOST` (default `138.197.36.107`).
+
+The action directory is canonical here (like the iOS/Android actions): edit it in
+`backend-action/`, never in a consumer's vendored copy.
+
 ## Android credentials
 
 Place these files under `creds/`:
@@ -103,6 +133,18 @@ in Play Console; every later run detects API readiness and uploads to the
 `internal` track automatically. Override the track or status with repository
 variables `GOOGLE_PLAY_TRACK` and `GOOGLE_PLAY_STATUS`.
 
+### Gradle daemon heap
+
+A `gradle.properties` sized for a workstation does not fit a CI runner.
+`-Xmx8G` with a 4 GB metaspace reserves 12 GB for the Gradle daemon alone,
+before the Kotlin compile daemon spawns its own JVM — on a 16 GB runner the
+build is killed mid-compile, and GitHub reports that as a **cancelled** job
+rather than a failure, so it reads as a flake rather than an out-of-memory.
+
+Before building, the Android job caps `-Xmx` at 4 GB and `MaxMetaspaceSize` at
+2 GB in the checkout, with a `::warning::` naming the original value. Projects
+already at or below those numbers are left untouched. Linux only.
+
 ### Google Play upload retry
 
 A Play edit is a short-lived server-side object, and an AAB upload that runs

package/action/.daemux-version

@@ -1 +1 @@
-1.0.21
+1.0.23

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.21
+1.0.23

package/backend-action/.daemux-version

@@ -0,0 +1 @@
+1.0.23

package/backend-action/action.yml

@@ -0,0 +1,98 @@
+name: gowalk-cicd backend deploy
+description: >
+  Build and deploy a Dockerized Python+Postgres backend to the gowalk deploy
+  host (138.197.36.107) — rsync the backend dir, `docker compose up -d --build`,
+  wire an nginx vhost + Let's Encrypt cert for the API domain, and health-check.
+  The deploy host is publicly reachable, so this runs on a GitHub-hosted runner.
+
+inputs:
+  host:
+    description: SSH host of the deploy server.
+    required: false
+    default: "138.197.36.107"
+  ssh-user:
+    description: SSH user on the deploy server.
+    required: false
+    default: "root"
+  ssh-key:
+    description: Private SSH key with access to the deploy host (from a secret).
+    required: true
+  app-name:
+    description: Stable slug — the compose project and /opt/gowalk-backends/<app-name> dir.
+    required: true
+  api-domain:
+    description: >
+      Public domain for the API (e.g. api.myapp.gowalk.com). Its DNS A record
+      must already point at the deploy host. Empty = deploy the container only,
+      skip nginx + cert.
+    required: false
+    default: ""
+  backend-dir:
+    description: Path to the backend (holds Dockerfile + docker-compose.yml).
+    required: false
+    default: "backend"
+  health-path:
+    description: HTTP path the service answers 2xx on once healthy.
+    required: false
+    default: "/health"
+  cert-email:
+    description: Email for the Let's Encrypt registration.
+    required: false
+    default: "admin@gowalk.com"
+
+runs:
+  using: composite
+  steps:
+    - name: Validate inputs
+      shell: bash
+      run: |
+        set -euo pipefail
+        test -f "${{ inputs.backend-dir }}/docker-compose.yml" \
+          || { echo "::error::no ${{ inputs.backend-dir }}/docker-compose.yml"; exit 1; }
+        case "${{ inputs.app-name }}" in
+          *[!a-z0-9-]*|"") echo "::error::app-name must be [a-z0-9-]"; exit 1;;
+        esac
+
+    - name: Configure SSH
+      shell: bash
+      env:
+        DEPLOY_SSH_KEY: ${{ inputs.ssh-key }}
+      run: |
+        set -euo pipefail
+        mkdir -p ~/.ssh && chmod 700 ~/.ssh
+        printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/backend_deploy
+        chmod 600 ~/.ssh/backend_deploy
+        ssh-keyscan -t ed25519,rsa,ecdsa "${{ inputs.host }}" >> ~/.ssh/known_hosts 2>/dev/null
+        chmod 644 ~/.ssh/known_hosts
+
+    - name: Sync backend to the host
+      shell: bash
+      run: |
+        set -euo pipefail
+        SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
+        DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
+        $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" "mkdir -p '$DEST'"
+        # --delete keeps the mirror true; exclude .env so server-side secrets
+        # (generated DB password, etc.) survive across deploys.
+        rsync -az --delete --exclude '.env' --exclude '.git' \
+          -e "$SSH" "${{ inputs.backend-dir }}/" \
+          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
+        # ship the remote deploy script (kept out of the app checkout)
+        rsync -az -e "$SSH" "${{ github.action_path }}/remote_deploy.sh" \
+          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/.remote_deploy.sh"
+
+    - name: Deploy on the host
+      shell: bash
+      run: |
+        set -euo pipefail
+        SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
+        DEST="/opt/gowalk-backends/${{ inputs.app-name }}"
+        $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
+          "bash '$DEST/.remote_deploy.sh' \
+             '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
+             '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
+
+    - name: Cleanup key
+      if: always()
+      shell: bash
+      run: rm -f ~/.ssh/backend_deploy

package/backend-action/remote_deploy.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# Runs ON the deploy host, inside /opt/gowalk-backends/<app>. Brings up the
+# compose stack, then (when a domain is given) wires an nginx vhost + LE cert
+# and health-checks the public URL. Idempotent; safe to re-run.
+set -euo pipefail
+
+APP="$1"           # slug — compose project + dir name
+DOMAIN="${2:-}"    # api.<app>.gowalk.com, or empty to skip nginx/cert
+HEALTH="${3:-/health}"
+CERT_EMAIL="${4:-admin@gowalk.com}"
+DIR="/opt/gowalk-backends/$APP"
+cd "$DIR"
+
+log() { echo "[deploy $APP] $*"; }
+
+# ── secrets: generate a per-app .env once, then preserve it (rsync excludes it)
+if [ ! -f .env ]; then
+  log "first deploy — generating .env (POSTGRES_PASSWORD)"
+  {
+    echo "POSTGRES_PASSWORD=$(openssl rand -hex 24)"
+    echo "APP_NAME=$APP"
+  } > .env
+  chmod 600 .env
+fi
+
+# ── bring the stack up
+log "docker compose up -d --build"
+docker compose --project-name "$APP" up -d --build --remove-orphans
+
+# ── discover the host port the service published on 127.0.0.1.
+# The text `ps` PORTS column reliably shows `127.0.0.1:<port>-><target>/tcp`.
+detect_port() {
+  # Capture ONLY the published port after 127.0.0.1: (not the IP's own digits).
+  docker compose --project-name "$APP" ps 2>/dev/null \
+    | sed -nE 's/.*127\.0\.0\.1:([0-9]+)->.*/\1/p' | head -1
+}
+PORT="$(detect_port || true)"
+[ -n "${PORT:-}" ] || { log "ERROR: no 127.0.0.1:<port> publish found in compose ps"; \
+  docker compose --project-name "$APP" ps; exit 1; }
+log "service published on 127.0.0.1:$PORT"
+
+# ── local health-check first (fast failure, no DNS/cert dependency).
+# Generous: a first-ever deploy cold-inits Postgres and pulls base images.
+HEALTHY=""
+for i in $(seq 1 90); do
+  if curl -fsS "http://127.0.0.1:$PORT$HEALTH" >/dev/null 2>&1; then
+    log "container healthy on :$PORT$HEALTH (after ${i}x2s)"; HEALTHY=1; break
+  fi
+  [ $((i % 15)) -eq 0 ] && log "waiting for health… (${i}x2s)"
+  sleep 2
+done
+if [ -z "$HEALTHY" ]; then
+  log "ERROR: container never became healthy on :$PORT$HEALTH"
+  docker compose --project-name "$APP" ps
+  docker compose --project-name "$APP" logs --tail 60
+  exit 1
+fi
+
+# ── container-only deploy (no domain): stop here
+if [ -z "$DOMAIN" ]; then
+  log "no domain given — container deployed, skipping nginx/cert"
+  exit 0
+fi
+
+# ── nginx vhost → proxy the domain to the published port
+VHOST="/etc/nginx/conf.d/backend-$APP.conf"
+if [ ! -f "$VHOST" ] || ! grep -q "127.0.0.1:$PORT" "$VHOST"; then
+  log "writing nginx vhost $VHOST → 127.0.0.1:$PORT"
+  cat > "$VHOST" <<NGINX
+server {
+    listen 80;
+    server_name $DOMAIN;
+    client_max_body_size 100m;
+    location / {
+        proxy_pass http://127.0.0.1:$PORT;
+        proxy_http_version 1.1;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_read_timeout 120s;
+    }
+}
+NGINX
+  nginx -t && systemctl reload nginx
+fi
+
+# ── Let's Encrypt cert (idempotent; certbot skips if current)
+if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
+  log "requesting LE cert for $DOMAIN"
+  certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
+    --email "$CERT_EMAIL" --redirect || log "warn: certbot failed (DNS not pointed yet?)"
+else
+  log "cert for $DOMAIN already present"
+fi
+
+# ── public health-check (best effort — cert/DNS may still be propagating)
+if curl -fsSk "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
+  log "public https://$DOMAIN$HEALTH healthy"
+else
+  log "warn: public URL not answering yet (DNS/cert propagation) — container is up on :$PORT"
+fi
+log "done"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {
@@ -15,6 +15,9 @@
     "android-action/",
     "!android-action/**/__pycache__/**",
     "!android-action/**/*.py[cod]",
+    "backend-action/",
+    "!backend-action/**/__pycache__/**",
+    "!backend-action/**/*.py[cod]",
     "templates/",
     "README.md",
     "CLAUDE.md"

package/src/install.mjs

@@ -26,16 +26,29 @@ const PACKAGE_DIR = resolve(__dirname, '..');
 
 const ACTION_SRC = join(PACKAGE_DIR, 'action');
 const ANDROID_ACTION_SRC = join(PACKAGE_DIR, 'android-action');
+const BACKEND_ACTION_SRC = join(PACKAGE_DIR, 'backend-action');
 const WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy.yml');
+const BACKEND_WORKFLOW_TEMPLATE = join(PACKAGE_DIR, 'templates', 'deploy-backend.yml');
 const PACKAGE_JSON = join(PACKAGE_DIR, 'package.json');
 
 // Target paths inside the consumer repo. These are relative to the repo
 // root we discover below.
 const ACTION_DEST_REL = join('.github', 'actions', 'swift-app');
 const ANDROID_ACTION_DEST_REL = join('.github', 'actions', 'android-app');
+const BACKEND_ACTION_DEST_REL = join('.github', 'actions', 'backend-app');
 const WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy.yml');
+const BACKEND_WORKFLOW_DEST_REL = join('.github', 'workflows', 'deploy-backend.yml');
 const VERSION_MARKER_REL = join('.github', 'actions', 'swift-app', '.daemux-version');
 const ANDROID_VERSION_MARKER_REL = join('.github', 'actions', 'android-app', '.daemux-version');
+const BACKEND_VERSION_MARKER_REL = join('.github', 'actions', 'backend-app', '.daemux-version');
+
+// A repo has a backend when a backend/ or server/ dir carries a compose file.
+function backendDir(repoRoot) {
+  for (const d of ['backend', 'server']) {
+    if (existsSync(join(repoRoot, d, 'docker-compose.yml'))) return d;
+  }
+  return null;
+}
 
 // Lines we treat as ignoring credentials. If any appears in the consumer's
 // .gitignore, CI will not see one or both platform keys. We warn instead of
@@ -113,6 +126,18 @@ function copyWorkflow(repoRoot, dryRun) {
   return { dest, existed };
 }
 
+function copyBackendWorkflow(repoRoot, dryRun) {
+  const dest = join(repoRoot, BACKEND_WORKFLOW_DEST_REL);
+  const existed = existsSync(dest);
+  if (dryRun) {
+    console.log(`  [dry-run] ${existed ? 'overwrite' : 'create'} ${BACKEND_WORKFLOW_DEST_REL}`);
+    return;
+  }
+  ensureDir(dirname(dest));
+  cpSync(BACKEND_WORKFLOW_TEMPLATE, dest, { force: true });
+  console.log(`  ${existed ? 'Overwrote' : 'Created'} ${BACKEND_WORKFLOW_DEST_REL}`);
+}
+
 function writeVersionMarkers(repoRoot, dryRun) {
   // Reads this package's own version from package.json and stamps it
   // into the consumer repo as the source of truth for autoupdate's
@@ -195,6 +220,19 @@ export async function runInstall({ dryRun = false } = {}) {
   writeVersionMarkers(repoRoot, dryRun);
   copyWorkflow(repoRoot, dryRun);
 
+  // Backend deploy path — installed only when the repo has a Dockerized
+  // backend (backend/ or server/ with a docker-compose.yml). Mobile-only
+  // repos are unaffected, so this is backward compatible.
+  const bdir = backendDir(repoRoot);
+  if (bdir) {
+    console.log(`  Backend detected (${bdir}/docker-compose.yml) — installing backend deploy`);
+    copyAction(BACKEND_ACTION_SRC, BACKEND_ACTION_DEST_REL, repoRoot, dryRun);
+    if (!dryRun) writeFileSync(
+      join(repoRoot, BACKEND_VERSION_MARKER_REL),
+      String(JSON.parse(readFileSync(PACKAGE_JSON, 'utf8')).version || '').trim());
+    copyBackendWorkflow(repoRoot, dryRun);
+  }
+
   const gi = checkGitignore(repoRoot);
   printGitignoreWarning(gi);
 

package/templates/deploy-backend.yml

@@ -0,0 +1,41 @@
+name: Backend Deploy
+
+# Deploys the Dockerized Python+Postgres backend to the gowalk host. Installed
+# by gowalk-cicd only when a backend/ (or server/) dir with a docker-compose.yml
+# is present. Mobile deploy stays in deploy.yml — this is the backend's own path.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "backend/**"
+      - "server/**"
+      - ".github/workflows/deploy-backend.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: backend-deploy-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      # Pick backend/ or server/, whichever holds the compose file.
+      - id: dir
+        run: |
+          if [ -f backend/docker-compose.yml ]; then echo "path=backend" >> "$GITHUB_OUTPUT"
+          elif [ -f server/docker-compose.yml ]; then echo "path=server" >> "$GITHUB_OUTPUT"
+          else echo "::error::no backend/ or server/ docker-compose.yml"; exit 1; fi
+
+      - name: Deploy backend
+        uses: ./.github/actions/backend-app
+        with:
+          ssh-key: ${{ secrets.BACKEND_DEPLOY_SSH_KEY }}
+          host: ${{ vars.BACKEND_DEPLOY_HOST || '138.197.36.107' }}
+          app-name: ${{ vars.BACKEND_APP_NAME || github.event.repository.name }}
+          api-domain: ${{ vars.BACKEND_API_DOMAIN }}
+          backend-dir: ${{ steps.dir.outputs.path }}
+          health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}

package/templates/deploy.yml

@@ -183,6 +183,38 @@ jobs:
           echo "::add-mask::$GIT_PRIVATE_TOKEN"
           git config --global url."https://x-access-token:${GIT_PRIVATE_TOKEN}@github.com/".insteadOf "https://github.com/"
           echo "Configured authenticated github.com remotes for pub."
+      # A Gradle daemon sized for a workstation does not fit a CI runner. Asking
+      # for -Xmx8G with a 4G metaspace reserves 12 GB before the Kotlin compile
+      # daemon spawns its own JVM, and the runner is killed mid-compile — which
+      # GitHub reports as "cancelled", not as a failure, so it reads as a flake
+      # rather than an out-of-memory. Clamp to a size that leaves room, in the
+      # checkout only.
+      - name: Cap the Gradle daemon heap for this runner
+        if: ${{ steps.mode.outputs.mode == 'local' && runner.os == 'Linux' }}
+        shell: bash
+        env:
+          MAX_HEAP_GB: '4'
+          MAX_META_GB: '2'
+        run: |
+          shopt -s nullglob
+          for f in android/gradle.properties gradle.properties; do
+            [ -f "$f" ] || continue
+            before=$(grep -m1 '^org.gradle.jvmargs' "$f" || true)
+            [ -n "$before" ] || continue
+            heap=$(sed -nE 's/.*-Xmx([0-9]+)[Gg].*/\1/p' <<<"$before")
+            meta=$(sed -nE 's/.*MaxMetaspaceSize=([0-9]+)[Gg].*/\1/p' <<<"$before")
+            changed=""
+            if [ -n "$heap" ] && [ "$heap" -gt "$MAX_HEAP_GB" ]; then
+              sed -i -E "s/-Xmx${heap}[Gg]/-Xmx${MAX_HEAP_GB}G/" "$f"; changed=1
+            fi
+            if [ -n "$meta" ] && [ "$meta" -gt "$MAX_META_GB" ]; then
+              sed -i -E "s/MaxMetaspaceSize=${meta}[Gg]/MaxMetaspaceSize=${MAX_META_GB}G/" "$f"; changed=1
+            fi
+            if [ -n "$changed" ]; then
+              echo "::warning::$f asked for more heap than this runner has; capped it for this build only ($before)"
+              grep -m1 '^org.gradle.jvmargs' "$f"
+            fi
+          done
       # Same reason as the iOS job: apps using AppLocalizations must generate it
       # before anything analyses or compiles them. No-op for apps without l10n.
       - name: Generate localizations