ConusAI vendor v0.1.0-dev.20261027+ab5c16b3

2026-10-27 16:27:40 +00:00
commit e2b9d1c8b0
538 changed files with 80203 additions and 0 deletions
@@ -0,0 +1,77 @@
+# SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
+# The gate for this repository, on Gitea Actions. The syntax also runs on GitHub, but nothing here
+# references a hosted action, a public image registry or an external font: the checkout is open
+# coded and the toolchain comes from the runner's own image.
+name: ci
+
+on:
+  push:
+    branches: [main]
+    paths-ignore: ["**/*.md"]
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ gitea.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  gate:
+    name: gate
+    runs-on: linux-amd64-docker
+    container:
+      image: node:24-slim
+    timeout-minutes: 25
+    steps:
+      - name: Checkout
+        run: |
+          git init -q .
+          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          git -c http.extraheader="AUTHORIZATION: token ${{ gitea.token }}" fetch -q --depth 1 origin "${{ gitea.sha }}"
+          git checkout -q FETCH_HEAD
+      - name: Install
+        env:
+          # The ConusAI vendor registry serves the @conusai-kit and @conusai-sdk scopes. The token
+          # is a repository secret, written to the user-level ~/.npmrc, which is the only config
+          # pnpm trusts for credentials, and never to a file in the checkout.
+          CONUSAI_NPM_TOKEN: ${{ secrets.CONUSAI_NPM_TOKEN }}
+          CONUSAI_NPM_REGISTRY: ${{ secrets.CONUSAI_NPM_REGISTRY }}
+          COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+        run: |
+          corepack enable pnpm
+          umask 077
+          {
+            echo "@conusai-kit:registry=${CONUSAI_NPM_REGISTRY}"
+            echo "@conusai-sdk:registry=${CONUSAI_NPM_REGISTRY}"
+            echo "${CONUSAI_NPM_REGISTRY#https:}:_authToken=${CONUSAI_NPM_TOKEN}"
+          } > "$HOME/.npmrc"
+          # The committed pnpm-lock.yaml makes this a frozen install in CI: the gate runs against
+          # exactly the dependency graph the Dockerfile's deps stage later builds.
+          pnpm install --ignore-scripts
+      - name: Gate
+        run: pnpm gate
+      - name: Build the image
+        # The Dockerfile's install stage reads the registry credentials from the mounted secret;
+        # without it the vendor scopes 404 against the public registry.
+        run: docker build --secret id=npmrc,src="$HOME/.npmrc" --target runtime -t "app:${{ gitea.sha }}" .
+      - name: Software bill of materials
+        run: |
+          pnpm licenses list --json > sbom-licences.json
+          # Fails on a dependency whose licence is not on the allow-list.
+          node -e '
+            const allowed = new Set(["MIT", "ISC", "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "0BSD", "CC0-1.0", "Unlicense", "BlueOak-1.0.0", "Python-2.0", "LicenseRef-ConusAI-Template-1.0"])
+            const licences = JSON.parse(require("node:fs").readFileSync("sbom-licences.json", "utf8"))
+            const refused = Object.keys(licences).filter((name) => !allowed.has(name))
+            if (refused.length > 0) {
+              console.error(`licences that are not on the allow-list: ${refused.join(", ")}`)
+              process.exit(1)
+            }
+          '
+      - name: Dependency audit
+        run: pnpm audit --audit-level high