Add docker:ci-check script mirroring Forgejo checks workflow #152

New issue

Closed

opened 2026-05-30 19:13:09 +00:00 by steve · 0 comments

steve commented

2026-05-30 19:13:09 +00:00

Owner

Local pnpm check:all passes but Forgejo CI sometimes fails because CI runs inside the lapis-ci container on Linux with a fresh install and smoke under xvfb.

Problem

Forgejo checks run inside the lapis-ci container on Linux with a fresh install and smoke under xvfb. CI-only failures are hard to debug without a local reproduction path.

Goal

Finish and harden pnpm docker:ci-check so it mirrors .forgejo/workflows/checks.yml locally in Docker with CI parity (platform, env, dependency isolation).

Scope

Audit-first: docker:ci-check, scripts/run-lapis-ci-check.mjs, and spec docs already exist; harden gaps and validate
Mirror CI steps: pnpm install --frozen-lockfile, e2e vault prep, pnpm check:all, make spec-lint, electron deps guard, xvfb-run -a pnpm test:smoke
Options: --build, --pull, --skip-smoke, --shell, --platform, --native-platform, --concurrency
Document in spec/src/80-maintenance/monorepo-scripts.md

Non-goals

Changing Forgejo workflows unless script uncovers obvious drift
Publishing a new lapis-ci image tag
Release asset upload or desktop version bumps

Acceptance Criteria

pnpm docker:ci-check --help documents all supported options
Default run uses the lapis-ci image and workdir /__w/lapis/lapis
Default platform is linux/amd64 for CI parity; --native-platform skips forced platform
--build, --pull, --skip-smoke, --shell, --platform <value>, and --concurrency <n> behave predictably
Host node_modules and package-local node_modules are not reused inside the container
Container run mirrors .forgejo/workflows/checks.yml in command order and meaningful environment
Smoke runs under xvfb-run -a unless --skip-smoke is passed
Local Docker smoke sets CI=true and LAPIS_SMOKE_DESKTOP_FULL_BUILD=1
Documentation in spec/src/80-maintenance/monorepo-scripts.md matches actual script behavior
pnpm check:all passes after the change

Implementation Notes

Audit-first status

Area	Status
Root `docker:ci-check` script entry	Done
`scripts/run-lapis-ci-check.mjs` CLI and CI script body	Done
`spec/src/80-maintenance/monorepo-scripts.md`	Partial — needs env/platform updates
Step order vs `checks.yml`	Matches

Parity table (Forgejo → local)

Forgejo checks step	Local Docker equivalent	Status
Container image `code.ju.ma/lapis-notes/lapis-ci:latest`	Same via `scripts/lapis-ci-image.mjs`	pass
Workdir `/__w/lapis/lapis`	Same	pass
`pnpm install --frozen-lockfile`	Same	pass
Prepare `~/Documents/vault-copy`	Same	pass
`pnpm check:all`	Same	pass
`make spec-lint`	Same	pass
Ensure `xauth`	Same	pass
`scripts/ensure-electron-linux-deps.sh`	Same	pass
`xvfb-run -a pnpm test:smoke`	Same unless `--skip-smoke`	pass
`CI=true`	Same	pass
`LAPIS_SMOKE_DESKTOP_FULL_BUILD=1`	Explicit env in container	gap → fix
`--build` / `--pull` platform parity	Forward resolved platform	gap → fix
Host + package `node_modules` isolation	Named Docker volumes	gap → verify/fix

Release desktop verify job uses the same verification shape (no asset build); local check does not need release builds.

Hardening tasks

Add LAPIS_SMOKE_DESKTOP_FULL_BUILD=1 to container env
Forward resolved --platform to docker pull and pnpm ci:image:build
Overlay named volumes on workspace package node_modules paths
Add scripts/run-lapis-ci-check-lib.mjs + unit tests
Update monorepo-scripts spec

Suggested Files or Specs To Inspect

.forgejo/workflows/checks.yml
.forgejo/workflows/release-desktop.yml
docker/lapis-ci/Dockerfile
scripts/run-lapis-ci-check.mjs
scripts/lapis-ci-image.mjs
scripts/build-lapis-ci-image.mjs
spec/src/80-maintenance/monorepo-scripts.md

Validation Commands

pnpm docker:ci-check --help
node --test scripts/run-lapis-ci-check.test.mjs
pnpm test:scripts
pnpm docker:ci-check --build --skip-smoke
pnpm check:all
make spec-lint
pnpm test:smoke
pnpm docker:ci-check --pull

Follow-up Tasks

Implementation Summary

Hardened pnpm docker:ci-check: added LAPIS_SMOKE_DESKTOP_FULL_BUILD=1, platform-aware image build (node scripts/build-lapis-ci-image.mjs) and pull (--platform linux/amd64), named-volume isolation for root and workspace package node_modules, startup logging, and run-lapis-ci-check-lib.mjs with 7 unit tests. Updated spec/src/80-maintenance/monorepo-scripts.md. Validated: docker:ci-check --help; pnpm test:scripts; pnpm check:all; make spec-lint; docker run confirmed CI=true, LAPIS_SMOKE_DESKTOP_FULL_BUILD=1, linux/amd64, and package volume mounts. Full docker:ci-check --skip-smoke reached check:all but failed on pre-existing @lapis-notes/lapis.md check:astro in container (unrelated to this script). --build blocked locally by Docker apt GPG errors; --pull blocked by disk space during layer extract.

Local `pnpm check:all` passes but Forgejo CI sometimes fails because CI runs inside the `lapis-ci` container on Linux with a fresh install and smoke under xvfb. ## Problem Forgejo checks run inside the `lapis-ci` container on Linux with a fresh install and smoke under xvfb. CI-only failures are hard to debug without a local reproduction path. ## Goal Finish and harden `pnpm docker:ci-check` so it mirrors `.forgejo/workflows/checks.yml` locally in Docker with CI parity (platform, env, dependency isolation). ## Scope - Audit-first: `docker:ci-check`, `scripts/run-lapis-ci-check.mjs`, and spec docs already exist; harden gaps and validate - Mirror CI steps: `pnpm install --frozen-lockfile`, e2e vault prep, `pnpm check:all`, `make spec-lint`, electron deps guard, `xvfb-run -a pnpm test:smoke` - Options: `--build`, `--pull`, `--skip-smoke`, `--shell`, `--platform`, `--native-platform`, `--concurrency` - Document in `spec/src/80-maintenance/monorepo-scripts.md` ## Non-goals - Changing Forgejo workflows unless script uncovers obvious drift - Publishing a new `lapis-ci` image tag - Release asset upload or desktop version bumps ## Acceptance Criteria - `pnpm docker:ci-check --help` documents all supported options - Default run uses the `lapis-ci` image and workdir `/__w/lapis/lapis` - Default platform is `linux/amd64` for CI parity; `--native-platform` skips forced platform - `--build`, `--pull`, `--skip-smoke`, `--shell`, `--platform <value>`, and `--concurrency <n>` behave predictably - Host `node_modules` and package-local `node_modules` are not reused inside the container - Container run mirrors `.forgejo/workflows/checks.yml` in command order and meaningful environment - Smoke runs under `xvfb-run -a` unless `--skip-smoke` is passed - Local Docker smoke sets `CI=true` and `LAPIS_SMOKE_DESKTOP_FULL_BUILD=1` - Documentation in `spec/src/80-maintenance/monorepo-scripts.md` matches actual script behavior - `pnpm check:all` passes after the change ## Implementation Notes ### Audit-first status | Area | Status | |------|--------| | Root `docker:ci-check` script entry | Done | | `scripts/run-lapis-ci-check.mjs` CLI and CI script body | Done | | `spec/src/80-maintenance/monorepo-scripts.md` | Partial — needs env/platform updates | | Step order vs `checks.yml` | Matches | ### Parity table (Forgejo → local) | Forgejo checks step | Local Docker equivalent | Status | |---|---|---| | Container image `code.ju.ma/lapis-notes/lapis-ci:latest` | Same via `scripts/lapis-ci-image.mjs` | pass | | Workdir `/__w/lapis/lapis` | Same | pass | | `pnpm install --frozen-lockfile` | Same | pass | | Prepare `~/Documents/vault-copy` | Same | pass | | `pnpm check:all` | Same | pass | | `make spec-lint` | Same | pass | | Ensure `xauth` | Same | pass | | `scripts/ensure-electron-linux-deps.sh` | Same | pass | | `xvfb-run -a pnpm test:smoke` | Same unless `--skip-smoke` | pass | | `CI=true` | Same | pass | | `LAPIS_SMOKE_DESKTOP_FULL_BUILD=1` | Explicit env in container | gap → fix | | `--build` / `--pull` platform parity | Forward resolved platform | gap → fix | | Host + package `node_modules` isolation | Named Docker volumes | gap → verify/fix | Release desktop `verify` job uses the same verification shape (no asset build); local check does not need release builds. ### Hardening tasks 1. Add `LAPIS_SMOKE_DESKTOP_FULL_BUILD=1` to container env 2. Forward resolved `--platform` to `docker pull` and `pnpm ci:image:build` 3. Overlay named volumes on workspace package `node_modules` paths 4. Add `scripts/run-lapis-ci-check-lib.mjs` + unit tests 5. Update monorepo-scripts spec ## Suggested Files or Specs To Inspect - `.forgejo/workflows/checks.yml` - `.forgejo/workflows/release-desktop.yml` - `docker/lapis-ci/Dockerfile` - `scripts/run-lapis-ci-check.mjs` - `scripts/lapis-ci-image.mjs` - `scripts/build-lapis-ci-image.mjs` - `spec/src/80-maintenance/monorepo-scripts.md` ## Validation Commands ```bash pnpm docker:ci-check --help node --test scripts/run-lapis-ci-check.test.mjs pnpm test:scripts pnpm docker:ci-check --build --skip-smoke pnpm check:all make spec-lint pnpm test:smoke pnpm docker:ci-check --pull ``` ## Related Issues ## Follow-up Tasks ## Implementation Summary Hardened pnpm docker:ci-check: added LAPIS_SMOKE_DESKTOP_FULL_BUILD=1, platform-aware image build (node scripts/build-lapis-ci-image.mjs) and pull (--platform linux/amd64), named-volume isolation for root and workspace package node_modules, startup logging, and run-lapis-ci-check-lib.mjs with 7 unit tests. Updated spec/src/80-maintenance/monorepo-scripts.md. Validated: docker:ci-check --help; pnpm test:scripts; pnpm check:all; make spec-lint; docker run confirmed CI=true, LAPIS_SMOKE_DESKTOP_FULL_BUILD=1, linux/amd64, and package volume mounts. Full docker:ci-check --skip-smoke reached check:all but failed on pre-existing @lapis-notes/lapis.md check:astro in container (unrelated to this script). --build blocked locally by Docker apt GPG errors; --pull blocked by disk space during layer extract.

steve added the

subsystem:backlog

subsystem:spec

open

labels

2026-05-30 19:13:09 +00:00

steve

2026-06-04 16:53:41 +00:00