gowalk-cicd 1.0.42 → 1.0.44

package/CLAUDE.md

@@ -64,11 +64,6 @@ workflow (`.github/workflows/publish.yml`):
    attach the `publish.yml` trusted-publisher relationship; the workflow
    supplies that token as a fallback and uses OIDC after trust is configured.
 
-An explicitly dispatched run may publish a tested feature ref by setting its
-`release` boolean input. The input defaults to false, so ordinary manual runs
-remain test-only. Use this path when a deploy repair must ship without pushing
-the feature branch directly to `main`.
-
 Manual publish (from repo root):
 
 ```bash

package/README.md

@@ -58,22 +58,25 @@ account or domain.
 
 ## Backend deploy (Python + Postgres, Docker)
 
-When a repo carries a Dockerized backend — a `backend/` (or `server/`) directory
-with a `docker-compose.yml` — the installer also vendors a backend deploy path:
+When a repo carries a Dockerized backend, the installer also vendors a backend deploy path:
 `.github/actions/backend-app/` and `.github/workflows/deploy-backend.yml`. A
 mobile-only repo is unaffected (the backend path is not installed).
 
+Both supported layouts keep application source under `backend/` or `server/`:
+
+- the compose file can live beside that source as `backend/docker-compose.yml`; or
+- it can live at the repository root as `docker-compose.yml` and build `./backend`
+  (equivalently for `server/`).
+
 The backend workflow runs on a GitHub-hosted runner and, on a push touching
 `backend/**`, deploys to the gowalk host (`138.197.36.107`, publicly reachable):
 it rsyncs the backend dir to `/opt/gowalk-backends/<app>/`, runs
 `docker compose up -d --build`, auto-detects the published `127.0.0.1:<port>`,
 wires an nginx vhost + Let's Encrypt cert for the API domain, and health-checks.
-Certificate issuance and the public health check are strict: a deploy fails if
-the hostname cannot present a trusted matching certificate and reach the API.
 
 Requirements on the consumer repo:
 
-- **`backend/docker-compose.yml`** that publishes the API on a **loopback host
+- A supported **`docker-compose.yml`** that publishes the API on a **loopback host
   port** (`127.0.0.1:<port>:<container-port>`) so nginx can proxy it. Include a
   Postgres service (or use a per-app database) and a `/health` endpoint.
 - A **`Dockerfile`** the compose file builds; pin the base image, run non-root,
@@ -86,9 +89,7 @@ Requirements on the consumer repo:
 - Repo **variables** (optional): `BACKEND_API_DOMAIN` (its DNS A record must point
   at the host for the cert; empty = deploy the container only, skip nginx/cert),
   `BACKEND_APP_NAME` (defaults to the repo name), `BACKEND_HEALTH_PATH`
-  (default `/health`), `BACKEND_DEPLOY_HOST` (default `138.197.36.107`), and
-  `BACKEND_CERTBOT_ACCOUNT` (optional account ID for hosts with multiple ACME
-  accounts; otherwise the sole or host-created account is selected).
+  (default `/health`), `BACKEND_DEPLOY_HOST` (default `138.197.36.107`).
 
 The action directory is canonical here (like the iOS/Android actions): edit it in
 `backend-action/`, never in a consumer's vendored copy.

package/action/.daemux-version

@@ -1 +1 @@
-1.0.42
+1.0.44

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.42
+1.0.44

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.42
+1.0.44

package/backend-action/action.yml

@@ -28,9 +28,15 @@ inputs:
     required: false
     default: ""
   backend-dir:
-    description: Path to the backend (holds Dockerfile + docker-compose.yml).
+    description: Path to the backend source directory.
     required: false
     default: "backend"
+  compose-file:
+    description: >
+      Compose file path. Empty defaults to <backend-dir>/docker-compose.yml;
+      docker-compose.yml supports a root compose file that builds ./backend or ./server.
+    required: false
+    default: ""
   health-path:
     description: HTTP path the service answers 2xx on once healthy.
     required: false
@@ -39,12 +45,6 @@ inputs:
     description: Email for the Let's Encrypt registration.
     required: false
     default: "admin@gowalk.com"
-  certbot-account:
-    description: >
-      Optional Certbot account ID. When omitted, the deploy selects the sole
-      account or the account created on the current host.
-    required: false
-    default: ""
   runtime-env:
     description: >
       Optional newline-delimited KEY=value secrets written to a mode-0600
@@ -57,14 +57,33 @@ runs:
   using: composite
   steps:
     - name: Validate inputs
+      id: layout
       shell: bash
+      env:
+        BACKEND_DIR: ${{ inputs.backend-dir }}
+        COMPOSE_FILE_INPUT: ${{ inputs.compose-file }}
       run: |
         set -euo pipefail
-        test -f "${{ inputs.backend-dir }}/docker-compose.yml" \
-          || { echo "::error::no ${{ inputs.backend-dir }}/docker-compose.yml"; exit 1; }
+        COMPOSE_FILE="${COMPOSE_FILE_INPUT:-$BACKEND_DIR/docker-compose.yml}"
+        test -d "$BACKEND_DIR" \
+          || { echo "::error::no backend directory $BACKEND_DIR"; exit 1; }
+        test -f "$COMPOSE_FILE" \
+          || { echo "::error::no compose file $COMPOSE_FILE"; exit 1; }
+        case "$BACKEND_DIR" in
+          /*|../*|*/../*|*/..|.) echo "::error::backend-dir must be a safe relative path"; exit 1;;
+        esac
+        case "$COMPOSE_FILE" in
+          /*|../*|*/../*|*/..) echo "::error::compose-file must be a safe relative path"; exit 1;;
+        esac
+        if [ "$COMPOSE_FILE" != "$BACKEND_DIR/docker-compose.yml" ] \
+          && [ "$COMPOSE_FILE" != "docker-compose.yml" ]; then
+          echo "::error::compose-file must be docker-compose.yml or $BACKEND_DIR/docker-compose.yml"
+          exit 1
+        fi
         case "${{ inputs.app-name }}" in
           *[!a-z0-9-]*|"") echo "::error::app-name must be [a-z0-9-]"; exit 1;;
         esac
+        echo "compose-file=$COMPOSE_FILE" >> "$GITHUB_OUTPUT"
 
     - name: Configure SSH
       shell: bash
@@ -80,6 +99,9 @@ runs:
 
     - name: Sync backend to the host
       shell: bash
+      env:
+        BACKEND_DIR: ${{ inputs.backend-dir }}
+        COMPOSE_FILE: ${{ steps.layout.outputs.compose-file }}
       run: |
         set -euo pipefail
         SSH="ssh -i ~/.ssh/backend_deploy -o IdentitiesOnly=yes"
@@ -87,9 +109,19 @@ runs:
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" "mkdir -p '$DEST'"
         # --delete keeps the mirror true; exclude .env so server-side secrets
         # (generated DB password, etc.) survive across deploys.
-        rsync -az --delete --exclude '.env' --exclude '.git' \
-          -e "$SSH" "${{ inputs.backend-dir }}/" \
-          "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
+        if [ "$COMPOSE_FILE" = "$BACKEND_DIR/docker-compose.yml" ]; then
+          rsync -az --delete --exclude '.env' --exclude '.git' \
+            -e "$SSH" "$BACKEND_DIR/" \
+            "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/"
+        else
+          $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
+            "mkdir -p '$DEST/$BACKEND_DIR'"
+          rsync -az --delete --exclude '.env' --exclude '.git' \
+            -e "$SSH" "$BACKEND_DIR/" \
+            "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/$BACKEND_DIR/"
+          rsync -az -e "$SSH" "$COMPOSE_FILE" \
+            "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/docker-compose.yml"
+        fi
         # ship the remote deploy script (kept out of the app checkout)
         rsync -az -e "$SSH" "${{ github.action_path }}/remote_deploy.sh" \
           "${{ inputs.ssh-user }}@${{ inputs.host }}:$DEST/.remote_deploy.sh"
@@ -110,8 +142,7 @@ runs:
         $SSH "${{ inputs.ssh-user }}@${{ inputs.host }}" \
           "bash '$DEST/.remote_deploy.sh' \
              '${{ inputs.app-name }}' '${{ inputs.api-domain }}' \
-             '${{ inputs.health-path }}' '${{ inputs.cert-email }}' \
-             '${{ inputs.certbot-account }}'"
+             '${{ inputs.health-path }}' '${{ inputs.cert-email }}'"
 
     - name: Cleanup key
       if: always()

package/backend-action/remote_deploy.sh

@@ -8,37 +8,11 @@ APP="$1"           # slug — compose project + dir name
 DOMAIN="${2:-}"    # api.<app>.gowalk.com, or empty to skip nginx/cert
 HEALTH="${3:-/health}"
 CERT_EMAIL="${4:-admin@gowalk.com}"
-CERT_ACCOUNT="${5:-}"
 DIR="/opt/gowalk-backends/$APP"
 cd "$DIR"
 
 log() { echo "[deploy $APP] $*"; }
 
-select_certbot_account() {
-  [ -n "$CERT_ACCOUNT" ] && return
-  local accounts_root host account_dir creation_host
-  local -a accounts=()
-  accounts_root="/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory"
-  [ -d "$accounts_root" ] || return
-  host="$(hostname)"
-  while IFS= read -r account_dir; do
-    accounts+=("$(basename "$account_dir")")
-    creation_host="$(sed -nE \
-      's/.*"creation_host"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/p' \
-      "$account_dir/meta.json" 2>/dev/null | head -1)"
-    if [ "$creation_host" = "$host" ]; then
-      CERT_ACCOUNT="$(basename "$account_dir")"
-    fi
-  done < <(find "$accounts_root" -mindepth 1 -maxdepth 1 -type d | sort)
-  if [ -z "$CERT_ACCOUNT" ] && [ "${#accounts[@]}" -eq 1 ]; then
-    CERT_ACCOUNT="${accounts[0]}"
-  fi
-  if [ -z "$CERT_ACCOUNT" ] && [ "${#accounts[@]}" -gt 1 ]; then
-    log "ERROR: multiple Certbot accounts; set BACKEND_CERTBOT_ACCOUNT"
-    return 1
-  fi
-}
-
 # ── secrets: generate a per-app .env once, then preserve it (rsync excludes it)
 if [ ! -f .env ]; then
   log "first deploy — generating .env (POSTGRES_PASSWORD)"
@@ -121,20 +95,16 @@ fi
 # ── Let's Encrypt cert (idempotent; certbot skips if current)
 if ! certbot certificates 2>/dev/null | grep -q "Domains: $DOMAIN\b"; then
   log "requesting LE cert for $DOMAIN"
-  select_certbot_account
-  CERTBOT_ARGS=()
-  if [ -n "$CERT_ACCOUNT" ]; then
-    log "using Certbot account ${CERT_ACCOUNT:0:4}…"
-    CERTBOT_ARGS+=(--account "$CERT_ACCOUNT")
-  fi
   certbot --nginx -d "$DOMAIN" --non-interactive --agree-tos \
-    --email "$CERT_EMAIL" --redirect "${CERTBOT_ARGS[@]}"
+    --email "$CERT_EMAIL" --redirect || log "warn: certbot failed (DNS not pointed yet?)"
 else
   log "cert for $DOMAIN already present"
 fi
 
-# ── public health-check: validates DNS, certificate/SNI, routing and service.
-curl -fsS --retry 6 --retry-all-errors --retry-delay 2 \
-  "https://$DOMAIN$HEALTH" >/dev/null
-log "public https://$DOMAIN$HEALTH healthy with verified TLS"
+# ── public health-check (best effort — cert/DNS may still be propagating)
+if curl -fsSk "https://$DOMAIN$HEALTH" >/dev/null 2>&1; then
+  log "public https://$DOMAIN$HEALTH healthy"
+else
+  log "warn: public URL not answering yet (DNS/cert propagation) — container is up on :$PORT"
+fi
 log "done"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.42",
+  "version": "1.0.44",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {

package/src/install.mjs

@@ -44,10 +44,22 @@ const VERSION_MARKER_REL = join('.github', 'actions', 'swift-app', '.daemux-vers
 const ANDROID_VERSION_MARKER_REL = join('.github', 'actions', 'android-app', '.daemux-version');
 const BACKEND_VERSION_MARKER_REL = join('.github', 'actions', 'backend-app', '.daemux-version');
 
-// A repo has a backend when a backend/ or server/ dir carries a compose file.
-function backendDir(repoRoot) {
+// A repo has a backend when backend/ or server/ either carries the compose file
+// or is referenced by a root compose file. The latter is Flutter's common
+// full-stack layout: docker-compose.yml stays at the repo root so it can build
+// ./backend while the deploy action still syncs only backend-owned files.
+function backendLayout(repoRoot) {
   for (const d of ['backend', 'server']) {
-    if (existsSync(join(repoRoot, d, 'docker-compose.yml'))) return d;
+    if (existsSync(join(repoRoot, d, 'docker-compose.yml'))) {
+      return { backendDir: d, composeFile: join(d, 'docker-compose.yml') };
+    }
+  }
+  if (existsSync(join(repoRoot, 'docker-compose.yml'))) {
+    for (const d of ['backend', 'server']) {
+      if (existsSync(join(repoRoot, d, 'Dockerfile'))) {
+        return { backendDir: d, composeFile: 'docker-compose.yml' };
+      }
+    }
   }
   return null;
 }
@@ -235,12 +247,12 @@ export async function runInstall({ dryRun = false } = {}) {
     }
   }
 
-  // Backend deploy path — installed only when the repo has a Dockerized
-  // backend (backend/ or server/ with a docker-compose.yml). Mobile-only
-  // repos are unaffected, so this is backward compatible.
-  const bdir = backendDir(repoRoot);
-  if (bdir) {
-    console.log(`  Backend detected (${bdir}/docker-compose.yml) — installing backend deploy`);
+  // Backend deploy path — installed only for a supported nested or root
+  // compose layout. Mobile-only repos are unaffected, so this is backward
+  // compatible.
+  const layout = backendLayout(repoRoot);
+  if (layout) {
+    console.log(`  Backend detected (${layout.composeFile}) — installing backend deploy`);
     copyAction(BACKEND_ACTION_SRC, BACKEND_ACTION_DEST_REL, repoRoot, dryRun);
     if (!dryRun) writeFileSync(
       join(repoRoot, BACKEND_VERSION_MARKER_REL),

package/templates/deploy-backend.yml

@@ -1,17 +1,21 @@
 name: Backend Deploy
 
 # Deploys the Dockerized Python+Postgres backend to the gowalk host. Installed
-# by gowalk-cicd only when a backend/ (or server/) dir with a docker-compose.yml
-# is present. Mobile deploy stays in deploy.yml — this is the backend's own path.
+# by gowalk-cicd when backend/ or server/ has a compose file, or when a root
+# compose file builds one of those directories. Mobile deploy stays in deploy.yml.
 on:
   push:
     branches: [main]
     paths:
       - "backend/**"
       - "server/**"
+      - "docker-compose.yml"
       - ".github/workflows/deploy-backend.yml"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: backend-deploy-${{ github.ref }}
   cancel-in-progress: true
@@ -21,14 +25,27 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      # Pick backend/ or server/, whichever holds the compose file.
+      # Pick the source dir and either its nested compose file or a root one.
       - id: dir
         run: |
-          if [ -f backend/docker-compose.yml ]; then echo "path=backend" >> "$GITHUB_OUTPUT"
-          elif [ -f server/docker-compose.yml ]; then echo "path=server" >> "$GITHUB_OUTPUT"
-          else echo "::error::no backend/ or server/ docker-compose.yml"; exit 1; fi
+          if [ -f backend/docker-compose.yml ]; then
+            echo "path=backend" >> "$GITHUB_OUTPUT"
+            echo "compose=backend/docker-compose.yml" >> "$GITHUB_OUTPUT"
+          elif [ -f server/docker-compose.yml ]; then
+            echo "path=server" >> "$GITHUB_OUTPUT"
+            echo "compose=server/docker-compose.yml" >> "$GITHUB_OUTPUT"
+          elif [ -f docker-compose.yml ] && [ -f backend/Dockerfile ]; then
+            echo "path=backend" >> "$GITHUB_OUTPUT"
+            echo "compose=docker-compose.yml" >> "$GITHUB_OUTPUT"
+          elif [ -f docker-compose.yml ] && [ -f server/Dockerfile ]; then
+            echo "path=server" >> "$GITHUB_OUTPUT"
+            echo "compose=docker-compose.yml" >> "$GITHUB_OUTPUT"
+          else
+            echo "::error::no supported backend compose layout"
+            exit 1
+          fi
 
       - name: Deploy backend
         uses: ./.github/actions/backend-app
@@ -38,6 +55,6 @@ jobs:
           app-name: ${{ vars.BACKEND_APP_NAME || github.event.repository.name }}
           api-domain: ${{ vars.BACKEND_API_DOMAIN }}
           backend-dir: ${{ steps.dir.outputs.path }}
+          compose-file: ${{ steps.dir.outputs.compose }}
           health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}
-          certbot-account: ${{ vars.BACKEND_CERTBOT_ACCOUNT }}
           runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}

package/templates/deploy.yml

@@ -410,14 +410,29 @@ jobs:
           && github.ref_name != github.event.repository.default_branch }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - id: dir
         shell: bash
         run: |
-          if [ -f backend/docker-compose.yml ]; then echo "path=backend" >> "$GITHUB_OUTPUT"
-          elif [ -f server/docker-compose.yml ]; then echo "path=server" >> "$GITHUB_OUTPUT"
-          else echo "path=" >> "$GITHUB_OUTPUT"; fi
+          if [ -f backend/docker-compose.yml ]; then
+            echo "path=backend" >> "$GITHUB_OUTPUT"
+            echo "compose=backend/docker-compose.yml" >> "$GITHUB_OUTPUT"
+          elif [ -f server/docker-compose.yml ]; then
+            echo "path=server" >> "$GITHUB_OUTPUT"
+            echo "compose=server/docker-compose.yml" >> "$GITHUB_OUTPUT"
+          elif [ -f docker-compose.yml ] && [ -f backend/Dockerfile ]; then
+            echo "path=backend" >> "$GITHUB_OUTPUT"
+            echo "compose=docker-compose.yml" >> "$GITHUB_OUTPUT"
+          elif [ -f docker-compose.yml ] && [ -f server/Dockerfile ]; then
+            echo "path=server" >> "$GITHUB_OUTPUT"
+            echo "compose=docker-compose.yml" >> "$GITHUB_OUTPUT"
+          else
+            echo "path=" >> "$GITHUB_OUTPUT"
+            echo "compose=" >> "$GITHUB_OUTPUT"
+          fi
       - name: Deploy backend from feature branch
         if: ${{ steps.dir.outputs.path != '' }}
         uses: ./.github/actions/backend-app
@@ -427,6 +442,6 @@ jobs:
           app-name: ${{ vars.BACKEND_APP_NAME || github.event.repository.name }}
           api-domain: ${{ vars.BACKEND_API_DOMAIN }}
           backend-dir: ${{ steps.dir.outputs.path }}
+          compose-file: ${{ steps.dir.outputs.compose }}
           health-path: ${{ vars.BACKEND_HEALTH_PATH || '/health' }}
-          certbot-account: ${{ vars.BACKEND_CERTBOT_ACCOUNT }}
           runtime-env: ${{ secrets.BACKEND_RUNTIME_ENV }}