webgate 0.4.2__tar.gz → 2.3.0__tar.gz

webgate-2.3.0/.github/workflows/ci.yml

@@ -0,0 +1,106 @@
+name: CI
+
+# Everything that must be true before a release can be cut. The release workflow
+# runs this same suite again on the tag rather than trusting that main was green.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_call:        # release.yml reuses this instead of duplicating it
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # The floor from requires-python, and what development actually runs on.
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Install
+        run: uv sync --all-extras --dev --python ${{ matrix.python-version }}
+
+      - name: Lint
+        run: uv run ruff check src/ tests/ scripts/
+
+      - name: Format check
+        run: uv run ruff format --check src/ tests/ scripts/
+
+      - name: Tests
+        run: uv run pytest tests/ -q
+
+  docker:
+    # A Dockerfile only breaks when someone builds it, and nobody was.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build the runtime image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: false
+          load: true
+          tags: webgate:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: It starts, serves, and refuses the default secret key
+        run: |
+          set -euo pipefail
+
+          echo "--- refuses to start with the shipped default key ---"
+          # Refusing means a non-zero exit, so the run cannot sit inside a pipeline
+          # under `pipefail` -- that would report the refusal as this step failing.
+          rc=0
+          docker run --rm webgate:ci > /tmp/refusal 2>&1 || rc=$?
+          cat /tmp/refusal
+          if [ "$rc" -eq 0 ]; then
+            echo "FAILED: started under the default key"; exit 1
+          fi
+          grep -q "WEBGATE_SECRET_KEY is still the shipped default" /tmp/refusal \
+            || { echo "FAILED: refused, but not for the reason we expect"; exit 1; }
+          echo "ok: refused, with the message that says what to do"
+
+          echo "--- starts and answers with a real key ---"
+          docker run -d --name wg -p 8443:8443 \
+            -e WEBGATE_SECRET_KEY="$(openssl rand -hex 32)" webgate:ci
+          for i in $(seq 1 30); do
+            if curl -fsS http://localhost:8443/api/health >/dev/null 2>&1; then
+              echo "ok: healthy after ${i}s"
+              curl -fsS http://localhost:8443/openapi.json | grep -o '"version":"[^"]*"' | head -1
+              docker rm -f wg >/dev/null
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "FAILED: never became healthy"; docker logs wg; docker rm -f wg; exit 1
+
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - run: pip install mkdocs-material mkdocstrings mkdocstrings-python
+      - name: Build the site (strict — a broken link fails here, not on deploy)
+        run: mkdocs build --strict

webgate-2.3.0/.github/workflows/demo.yml

@@ -0,0 +1,63 @@
+name: Deploy demo
+
+# The public demo at webgate-demo.fly.dev. Deployed by hand until now, which is why
+# it spent months serving a version several releases behind the repository.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: demo
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: demo
+      url: https://webgate-demo.fly.dev/
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: superfly/flyctl-actions/setup-flyctl@master
+
+      - name: The demo must already hold a real secret key
+        # Without it the app refuses to start, and the deploy would replace a working
+        # demo with a crash loop. Checking first turns that into a clear failure here.
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+        run: |
+          set -euo pipefail
+          if flyctl secrets list --app webgate-demo | grep -q WEBGATE_SECRET_KEY; then
+            echo "ok: WEBGATE_SECRET_KEY is set"
+          else
+            echo "WEBGATE_SECRET_KEY is not set on the demo app. Run once:"
+            echo "  flyctl secrets set WEBGATE_SECRET_KEY=\$(openssl rand -hex 32) --app webgate-demo"
+            exit 1
+          fi
+
+      - name: Deploy
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+        run: flyctl deploy --remote-only
+
+      - name: It is up, and it is the version we just released
+        run: |
+          set -euo pipefail
+          for i in $(seq 1 30); do
+            got=$(curl -fsS https://webgate-demo.fly.dev/openapi.json 2>/dev/null \
+                  | grep -o '"version":"[^"]*"' | head -1 | cut -d'"' -f4) || got=""
+            if [ -n "$got" ]; then
+              echo "demo reports $got"
+              want="$(cat VERSION)"
+              [ "$got" = "$want" ] || { echo "expected $want"; exit 1; }
+              exit 0
+            fi
+            sleep 5
+          done
+          echo "the demo never answered"; exit 1

webgate-2.3.0/.github/workflows/release.yml

@@ -0,0 +1,123 @@
+name: Release
+
+# Cutting a release is `git tag vX.Y.Z && git push origin vX.Y.Z`. Everything after
+# that happens here, because doing it by hand is how PyPI and Docker Hub ended up
+# three minor versions behind the repository.
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Existing tag to (re)publish, e.g. v2.2.0"
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  # Nothing is published before the version agrees with itself and the tests pass.
+  verify:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.v.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - id: v
+        name: The tag, VERSION and pyproject must agree
+        run: |
+          set -euo pipefail
+          tag="${{ inputs.tag || github.ref_name }}"
+          version="${tag#v}"
+          file="$(cat VERSION)"
+          proj="$(grep -m1 '^version = ' pyproject.toml | cut -d'"' -f2)"
+          echo "tag=$version  VERSION=$file  pyproject=$proj"
+          [ "$version" = "$file" ] || { echo "tag does not match VERSION"; exit 1; }
+          [ "$version" = "$proj" ] || { echo "tag does not match pyproject.toml"; exit 1; }
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - uses: astral-sh/setup-uv@v5
+      - name: The changelog has an entry for it
+        run: uv run python scripts/release_notes.py "${{ steps.v.outputs.version }}" > /dev/null
+
+  test:
+    needs: verify
+    uses: ./.github/workflows/ci.yml
+
+  pypi:
+    needs: [verify, test]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/webgate/${{ needs.verify.outputs.version }}
+    permissions:
+      id-token: write     # trusted publishing: no API token is stored anywhere
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+      - uses: astral-sh/setup-uv@v5
+      - run: uv build
+      - uses: pypa/gh-action-pypi-publish@release/v1
+
+  docker:
+    needs: [verify, test]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            kalexnolasco/webgate:${{ needs.verify.outputs.version }}
+            kalexnolasco/webgate:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Keep the Docker Hub description in step with the README
+        uses: peter-evans/dockerhub-description@v4
+        continue-on-error: true
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          repository: kalexnolasco/webgate
+          readme-filepath: ./README.md
+
+  github_release:
+    needs: [verify, pypi, docker]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+      - uses: astral-sh/setup-uv@v5
+
+      - name: Notes come from CHANGELOG.md, not a second description of the same release
+        run: uv run python scripts/release_notes.py "${{ needs.verify.outputs.version }}" > notes.md
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.tag || github.ref_name }}
+          name: v${{ needs.verify.outputs.version }}
+          body_path: notes.md

{webgate-0.4.2 → webgate-2.3.0}/.gitignore

@@ -26,6 +26,8 @@ htmlcov/
 
 # Database
 *.db
+*.db.bak*
+*.db-journal
 
 # OS
 .DS_Store
@@ -35,5 +37,6 @@ Thumbs.db
 CLAUDE.md
 CLAUDE.local.md
 .claude/
+.cursor/
 .playwright-cli/
 site/