feat(delivery): publish immutable source images and declare release

.butler/README.md

@@ -0,0 +1,5 @@
+# Service release contract
+
+Butler resolves this repository's protected source revision to verified immutable images. The platform updates only image references in the existing production Compose file and restarts only the already running application services. It preserves current environment, storage, routes, and provider configuration. It retains previous application images and restores them if readiness fails.
+
+Migration and maintenance images are pinned when declared, but this release operation does not run database migrations or maintenance jobs. A release requiring a schema change needs the corresponding explicit platform migration first. No homelab image-pin commit is required for an ordinary compatible application release.

.butler/deployment.json

@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "deployment": "prepbot-release",
+  "environment": "production",
+  "images": {
+    "prepbot_release_prepbot_image": {
+      "name": "prepbot",
+      "tag": "sha-{revision}"
+    }
+  },
+  "revision_variable": "prepbot_release_revision"
+}

.dockerignore

@@ -0,0 +1,6 @@
+.git
+.github
+.gitea
+.env
+.idea
+prepbot

.gitea/workflows/build-and-push.yml

@@ -0,0 +1,88 @@
+name: Build and Push Container
+
+on:
+  push:
+    branches:
+    - main
+    tags:
+    - v*
+  workflow_dispatch: null
+  pull_request:
+    branches:
+    - main
+
+env:
+  REGISTRY: gitea.wayfinderak.com
+  IMAGE_NAME: wayfinderak/prepbot
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number
+    || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  docker:
+    runs-on: butler-ci
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Select relevant delivery work
+        id: delivery
+        env:
+          DELIVERY_EVENT: ${{ github.event_name }}
+          DELIVERY_REF: ${{ github.ref }}
+          DELIVERY_SHA: ${{ github.sha }}
+          DELIVERY_BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
+        run: |
+          cd .
+          bash scripts/ci-select.sh
+      - name: Set up QEMU
+        if: ${{ steps.delivery.outputs.run == 'true' }}
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        if: ${{ steps.delivery.outputs.run == 'true' }}
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Gitea registry
+        if: ${{ (steps.delivery.outputs.run == 'true') && github.event_name != 'pull_request' }}
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+
+      - name: Prepare image tags
+        if: ${{ steps.delivery.outputs.run == 'true' }}
+        id: prep
+        shell: bash
+        run: |
+          short_sha="${GITHUB_SHA::7}"
+          tags="${REGISTRY}/${IMAGE_NAME}:sha-${short_sha}"
+          tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA}"
+
+          if [[ "${GITHUB_REF_TYPE}" == "branch" && ("${GITHUB_REF_NAME}" == "master" || "${GITHUB_REF_NAME}" == "main") ]]; then
+            tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:latest"
+          fi
+
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            version="${GITHUB_REF_NAME#v}"
+            tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:${version}"
+          fi
+
+          {
+            echo 'tags<<EOF'
+            echo "$tags"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build and push image
+        if: ${{ steps.delivery.outputs.run == 'true' }}
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.prep.outputs.tags }}
+          labels: org.opencontainers.image.revision=${{ github.sha }}

.github/workflows/main.yml

@@ -1,64 +1,64 @@
-name: CI
+name: Build and Push Container
 
-# Controls when the action will run. Triggers the workflow on push to master or development 
-# with a tag like v1.0.0 or v1.0.0-dev
 on:
   push:
+    branches:
+      - master
+      - main
     tags:
-      - v[0-9]+.[0-9]+.[0-9]+
+      - v*
-      - v[0-9]+.[0-9]+.[0-9]+-[a-zA-Z]+
+  workflow_dispatch:
+
+env:
+  REGISTRY: gitea.wayfinderak.com
+  IMAGE_NAME: wayfinderak/prepbot
 
 jobs:
-  build:
+  docker:
     runs-on: ubuntu-latest
-
-    # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - name: Checkout
-      - uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
-      - name: Get Version
+      - name: Set up QEMU
-        id: get_version
+        uses: docker/setup-qemu-action@v3
-        uses: battila7/get-version-action@v2.0.0
 
-      - name: install buildx
+      - name: Set up Docker Buildx
-        id: buildx
+        uses: docker/setup-buildx-action@v3
-        uses: crazy-max/ghaction-docker-buildx@v1
+
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
         with:
-          version: latest
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
 
-      - name: Docker Login
+      - name: Prepare image tags
-        # You may pin to the exact commit or the version.
+        id: prep
-        # uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        shell: bash
-        uses: docker/login-action@v1.10.0
-        with:
-          registry: ${{ secrets.DR_URL }}
-          # Username used to log against the Docker registry
-          username: ${{ secrets.DH_USERNAME }}
-          # Password or personal access token used to log against the Docker registry
-          password: ${{ secrets.DH_PASSWORD }}
-          # Log out from the Docker registry at the end of a job
-          logout: true
-
-      - name: Docker Build & Push
-        env:
-          IMAGE_TAG: ${{ steps.get_version.outputs.version-without-v }}
         run: |
-          docker buildx build --push \
+          short_sha="${GITHUB_SHA::7}"
-          --tag ${{ secrets.DR_URL }}/prepbot:$IMAGE_TAG \
+          tags="${REGISTRY}/${IMAGE_NAME}:sha-${short_sha}"
-          --platform linux/amd64,linux/arm/v7,linux/arm64 . 
 
-      - name: Update deployment file
+          if [[ "${GITHUB_REF_TYPE}" == "branch" && ("${GITHUB_REF_NAME}" == "master" || "${GITHUB_REF_NAME}" == "main") ]]; then
-        run: TAG=${{ steps.get_version.outputs.version-without-v }} && sed -i 's|<IMAGE>|${{ secrets.DR_URL }}/prepbot:'${TAG}'|' $GITHUB_WORKSPACE/deployment.yml
+            tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:latest"
+          fi
 
-      - uses: azure/k8s-set-context@v1
+          if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            version="${GITHUB_REF_NAME#v}"
+            tags+=$'\n'"${REGISTRY}/${IMAGE_NAME}:${version}"
+          fi
+
+          {
+            echo 'tags<<EOF'
+            echo "$tags"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build and push image
+        uses: docker/build-push-action@v6
         with:
-          method: kubeconfig
+          context: .
-          kubeconfig: ${{ secrets.KUBE_CONFIG }}
+          push: true
-        id: setcontext
+          platforms: linux/amd64,linux/arm64
-
+          tags: ${{ steps.prep.outputs.tags }}
-      - name: Deploy to Kubernetes
-        run: kubectl apply -f $GITHUB_WORKSPACE/deployment.yml
-
-      - name: Verify deployment
-        run: kubectl rollout status -n discord-bots deployment/prepbot

.gitignore

@@ -15,3 +15,5 @@
 # vendor/
 
 .env
+
+portainer-app.env

Dockerfile

@@ -1,20 +1,18 @@
-FROM golang:1.15-alpine as dev
+FROM golang:1.22-alpine AS builder
 
-WORKDIR /go/src/prepbot
+WORKDIR /src
-COPY ./go.mod .
+RUN apk add --no-cache ca-certificates git tzdata
-COPY ./go.sum .
 
+COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN go install github.com/dustinpianalto/prepbot/...
+ARG TARGETARCH=amd64
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=$TARGETARCH go build -o /out/prepbot ./cmd/prepbot
 
-CMD [ "go", "run", "cmd/prepbot/main.go"]
+FROM alpine:3.20
+RUN apk add --no-cache ca-certificates tzdata
 
-from alpine
+COPY --from=builder /out/prepbot /usr/local/bin/prepbot
 
-WORKDIR /bin
+ENTRYPOINT ["/usr/local/bin/prepbot"]
-
-COPY --from=dev /go/bin/prepbot ./prepbot
-
-CMD [ "prepbot" ]

PORTAINER_DEPLOYMENT.md

@@ -0,0 +1,21 @@
+# Portainer deployment notes
+
+Generated from the current Kubernetes deployment in namespace `discord-bots`. Secret values are in the local `portainer-*.env` files.
+
+## Kubernetes source
+
+- Deployment: `prepbot`
+- Replicas: `1`
+- Rolling update: maxSurge `1`, maxUnavailable `1`
+- minReadySeconds: `120`
+- Labels/selectors: `app=prepbot`
+- Image pull secrets: `none required for Portainer stack`
+
+## Containers
+
+- `prepbot`: image `gitea.wayfinderak.com/wayfinderak/prepbot:latest`; env: DISCORD_TOKEN, LINK_CHANNEL, CHAT_CHANNEL; ports: none; requests: {'cpu': '1', 'memory': '512Mi'}; limits: {'cpu': '2', 'memory': '1Gi'}
+
+## Portainer files
+
+- `portainer-stack.yml` - Docker Compose stack to paste/use in Portainer.
+- `portainer-app.env` - bot runtime secrets/env.

cmd/prepbot/main.go

@@ -6,10 +6,10 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/bwmarrin/discordgo"
+	"github.com/dustinpianalto/discordgo"
 	"github.com/dustinpianalto/disgoman"
-	"github.com/dustinpianalto/prepbot/internal/exts/members"
+	"gitea.wayfinderak.com/wayfinderak/prepbot/internal/exts/members"
-	"github.com/dustinpianalto/prepbot/internal/exts/messages"
+	"gitea.wayfinderak.com/wayfinderak/prepbot/internal/exts/messages"
 )
 
 func main() {
@@ -21,6 +21,8 @@ func main() {
 	}
 	dg.State.MaxMessageCount = 100
 	dg.StateEnabled = true
+	dg.LogLevel = 3
+	dg.Debug = false
 	
 	dg.Identify = discordgo.Identify{
 		Intents: discordgo.MakeIntent(discordgo.IntentsAll),

deployment.yml

@@ -47,4 +47,4 @@ spec:
                   name: prepbot
                   key: chat_channel
       imagePullSecrets:
-        - name: registry-2
+        - name: registry-1

docker-compose.yml

@@ -0,0 +1,9 @@
+services:
+  prepbot:
+    image: ${IMAGE:-gitea.wayfinderak.com/wayfinderak/prepbot:${IMAGE_TAG:-latest}}
+    container_name: prepbot
+    restart: unless-stopped
+    environment:
+      DISCORD_TOKEN: ${DISCORD_TOKEN}
+      LINK_CHANNEL: ${LINK_CHANNEL}
+      CHAT_CHANNEL: ${CHAT_CHANNEL}

go.mod

@@ -1,8 +1,9 @@
-module github.com/dustinpianalto/prepbot
+module gitea.wayfinderak.com/wayfinderak/prepbot
 
 go 1.14
 
 require (
-	github.com/bwmarrin/discordgo v0.22.0
+	github.com/bwmarrin/discordgo v0.29.0 // indirect
-	github.com/dustinpianalto/disgoman v0.0.15
+	github.com/dustinpianalto/discordgo v0.0.4
+	github.com/dustinpianalto/disgoman v0.0.26
 )

go.sum

@@ -1,10 +1,17 @@
-github.com/bwmarrin/discordgo v0.20.2/go.mod h1:O9S4p+ofTFwB02em7jkpkV8M3R0/PUVOwN61zSZ0r4Q=
+github.com/bwmarrin/discordgo v0.29.0 h1:FmWeXFaKUwrcL3Cx65c20bTRW+vOb6k8AnaP+EgjDno=
-github.com/bwmarrin/discordgo v0.22.0 h1:uBxY1HmlVCsW1IuaPjpCGT6A2DBwRn0nvOguQIxDdFM=
+github.com/bwmarrin/discordgo v0.29.0/go.mod h1:NJZpH+1AfhIcyQsPeuBKsUtYrRnjkyu0kIVMCHkZtRY=
-github.com/bwmarrin/discordgo v0.22.0/go.mod h1:c1WtWUGN6nREDmzIpyTp/iD3VYt4Fpx+bVyfBG7JE+M=
+github.com/dustinpianalto/discordgo v0.0.4 h1:KlIkMzDH4jKRbs5IxeqeIXtNTDVcDi/sHV1gaKYEnPg=
-github.com/dustinpianalto/disgoman v0.0.15 h1:kdIw6jhC82WBut7+4BarqxBw06dozU+Hu47LQzkkoGM=
+github.com/dustinpianalto/discordgo v0.0.4/go.mod h1:LKY7UDCPJMChgrowLagHjDSj1gWbt3Hx+6bRFjpaVg8=
-github.com/dustinpianalto/disgoman v0.0.15/go.mod h1:v3FM6n+4dH9XlvO+IDx6MN3DUnGq6YVDBvy1A1k202g=
+github.com/dustinpianalto/disgoman v0.0.26 h1:7p6hDbNgEehUgOHigY/lHDY4P2VklJiZmOn674ka1h0=
-github.com/gorilla/websocket v1.4.0 h1:WDFjx/TMzVgy9VdMMQi2K2Emtwi2QcUQsztZ/zLaH/Q=
+github.com/dustinpianalto/disgoman v0.0.26/go.mod h1:WsDb+7XIm2MJ6xhxRAiXlzSPuSYIGSr4rWRmACeoing=
-github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
-golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16 h1:y6ce7gCWtnH+m3dCjzQ1PCuwl28DDIc3VNnvY29DlIA=
+golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b h1:7mWr3k41Qtv8XlltBkDkl8LoP3mpSgBW8BUoxtEdbXg=
-golang.org/x/crypto v0.0.0-20181030102418-4d3f4d9ffa16/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

internal/exts/members/member_logging.go

@@ -6,8 +6,8 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/bwmarrin/discordgo"
+	"github.com/dustinpianalto/discordgo"
-	"github.com/dustinpianalto/prepbot/internal/discord_utils"
+	"gitea.wayfinderak.com/wayfinderak/prepbot/internal/discord_utils"
 )
 
 var joinChannelID = "768571410133418037"
@@ -44,8 +44,6 @@ func OnGuildMemberAddLogging(s *discordgo.Session, member *discordgo.GuildMember
 		Inline: false,
 	}
 
-	joinTime, _ := member.JoinedAt.Parse()
-
 	embed := &discordgo.MessageEmbed{
 		Title:       title,
 		Description: fmt.Sprintf("%v (%v) Has Joined the Server", member.User.Mention(), member.User.ID),
@@ -53,9 +51,9 @@ func OnGuildMemberAddLogging(s *discordgo.Session, member *discordgo.GuildMember
 		Thumbnail:   thumb,
 		Footer: &discordgo.MessageEmbedFooter{
 			Text:    fmt.Sprintf("Current Member Count: %v", guild.MemberCount),
-			IconURL: guild.IconURL(),
+			IconURL: guild.IconURL("1024"),
 		},
-		Timestamp: joinTime.Format(time.RFC3339),
+		Timestamp: member.JoinedAt.Format(time.RFC3339),
 		Fields:    []*discordgo.MessageEmbedField{field},
 	}
 	s.ChannelMessageSendEmbed(joinChannelID, embed)
@@ -117,7 +115,7 @@ func OnGuildMemberRemoveLogging(s *discordgo.Session, member *discordgo.GuildMem
 		Thumbnail:   thumb,
 		Footer: &discordgo.MessageEmbedFooter{
 			Text:    fmt.Sprintf("Current Member Count: %v", guild.MemberCount),
-			IconURL: guild.IconURL(),
+			IconURL: guild.IconURL("1024"),
 		},
 		Timestamp: timeNow.Format(time.RFC3339),
 	}

internal/exts/messages/message_events.go

@@ -5,8 +5,9 @@ import (
 	"os"
 	"regexp"
 	"strings"
+	neturl "net/url"
 
-	"github.com/bwmarrin/discordgo"
+	"github.com/dustinpianalto/discordgo"
 )
 
 func CleanAmazonURLs(s *discordgo.Session, message *discordgo.MessageCreate) {
@@ -25,14 +26,11 @@ func CleanAmazonURLs(s *discordgo.Session, message *discordgo.MessageCreate) {
 	if len(urls) != 0 {
 
 		for _, url := range urls {
-			if strings.Contains(url, "ref=") || strings.Contains(url, "?") {
+			u, _ := neturl.Parse(url)
-				parts := strings.Split(url, "/")
+			u.RawQuery = ""
-				new := strings.Join(parts[:len(parts)-1], "/")
+			u.Fragment = ""
-				if strings.Contains(new, "ref=") {
+			if ( url != u.String() ) {
-					parts = strings.Split(new, "ref=")
+				content = strings.ReplaceAll(content, url, u.String())
-					new = parts[0]
-				}
-				content = strings.ReplaceAll(content, url, new)
 			}
 		}
 		_, err := sendWebhook(s, message, message.ChannelID, content)

portainer-app.env.example

@@ -0,0 +1,3 @@
+DISCORD_TOKEN=replace-me
+LINK_CHANNEL=replace-me
+CHAT_CHANNEL=replace-me

portainer-stack.yml

@@ -0,0 +1,9 @@
+services:
+  prepbot:
+    image: gitea.wayfinderak.com/wayfinderak/prepbot:latest
+    container_name: prepbot
+    restart: unless-stopped
+    env_file:
+      - ./portainer-app.env
+    mem_limit: 1g
+    cpus: "2.0"

scripts/ci-select.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Keep required jobs alive; only skip reviewed non-runtime documentation paths.
+set -euo pipefail
+base="${DELIVERY_BASE:-}"
+head="$(git rev-parse HEAD)"
+run=true
+if [[ "${DELIVERY_REF:-}" != refs/tags/* && "$head" == "${DELIVERY_SHA:-}" && "${DELIVERY_EVENT:-}" =~ ^(push|pull_request)$ && "$base" =~ ^[0-9a-f]{40}$ && "$base" != 0000000000000000000000000000000000000000 ]]; then
+  if ! git cat-file -e "$base^{commit}" 2>/dev/null; then
+    if [[ -n "${DELIVERY_FETCH_TOKEN:-}" ]]; then
+      git -c "http.extraHeader=Authorization: token ${DELIVERY_FETCH_TOKEN}" fetch --quiet --depth=1 origin "$base" >/dev/null 2>&1 || true
+    else
+      git fetch --quiet --depth=1 origin "$base" >/dev/null 2>&1 || true
+    fi
+  fi
+  if git cat-file -e "$base^{commit}" 2>/dev/null; then
+    paths="$(mktemp)"
+    trap 'rm -f -- "$paths"' EXIT
+    # Snapshot comparison is conservative when main advanced during a PR.
+    # Both rename sides remain visible, including names containing newlines.
+    if git diff --no-renames --name-only -z "$base" "$head" > "$paths"; then
+      run=false
+      while IFS= read -r -d '' path; do
+        case "$path" in
+          README.md|CHANGELOG.md|LICENSE|LICENSE.md) ;;
+          *) run=true; break ;;
+        esac
+      done < "$paths"
+    fi
+  fi
+fi
+if [[ "$run" == false ]]; then
+  echo 'Only reviewed non-runtime documentation changed; build and validation are not applicable.'
+else
+  echo 'Runtime, unknown inputs, or unavailable event history: run required validation.'
+fi
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  echo "run=$run" >> "$GITHUB_OUTPUT"
+fi
+printf '%s\n' "$run"