deploy slice B + F: deploy/ artifacts + image-build + container smoke CI + tag-push publish (#26)

Co-authored-by: Aaron D. Lee <himself@adlee.work>
Co-committed-by: Aaron D. Lee <himself@adlee.work>

.github/workflows/ci.yml

@@ -168,3 +168,243 @@ jobs:
           RUTSTER_TWILIO_TEST_TO: ${{ secrets.TWILIO_TEST_TO }}
           RUTSTER_TWILIO_TEST_FROM: ${{ secrets.TWILIO_TEST_FROM }}
         run: cargo test --all --features=twilio-live -- --include-ignored
+
+  # deploy-B §6.1 image-build — builds all four first-party images via
+  # `docker buildx build --target` against deploy/Dockerfile. Runs AFTER the
+  # fmt/clippy/test/deny/sim-bench matrix gates: the smoke job downstream
+  # depends on these built images.
+  #
+  # Single builder invocation that builds all four --targets would be ideal
+  # (shared cache), but buildx's `--target` is one-per-invocation — so four
+  # build steps share the GHA cache via `cache-from/cache-to: type=gha`.
+  # Warm caches take image-build from ~6 min to ~90s.
+  image-build:
+    name: image-build (4 images)
+    runs-on: ubuntu-latest
+    needs: [fmt, clippy, test, deny, sim-bench]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # libopus-dev — the headers the `opus` crate's build.rs expects.
+      # (The builder stage of deploy/Dockerfile already installs this
+      # inside the build image; this is a belt-and-braces step so a local
+      # buildx cache root has the headers if the cache misses.)
+      - name: Build-time host deps (belt-and-braces)
+        run: sudo apt-get update && sudo apt-get install -y libopus-dev
+
+      - name: Build rutster-engine image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-engine
+          tags: rutster-engine:ci-${{ github.sha }}
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-engine
+          cache-to: type=gha,mode=max,scope=rutster-engine
+
+      - name: Build rutster-brain image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-brain
+          tags: rutster-brain:ci-${{ github.sha }}
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-brain
+          cache-to: type=gha,mode=max,scope=rutster-brain
+
+      - name: Build rutster-edge image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-edge
+          tags: rutster-edge:ci-${{ github.sha }}
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-edge
+          cache-to: type=gha,mode=max,scope=rutster-edge
+
+      - name: Build rutster-allinone image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          tags: rutster-allinone:ci-${{ github.sha }}
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-allinone
+          cache-to: type=gha,mode=max,scope=rutster-allinone
+
+      - name: Smoke-tag the images for the downstream smoke job
+        # The smoke job references images as `:smoke`
+        # (deploy/smoke/compose_smoke.sh tags images with the
+        # RUTSTER_IMAGES_TAG env). Tag the freshly-built :ci-<sha> images as
+        # :smoke too, so the smoke job picks them up.
+        run: |
+          for img in rutster-engine rutster-brain rutster-edge rutster-allinone; do
+            docker tag "${img}:ci-${{ github.sha }}" "${img}:smoke"
+          done
+          docker images | grep rutster
+
+      - name: caddy validate
+        # Validate the Caddyfile inside the freshly-built rutster-edge image.
+        # Cheap regression against malformed Caddyfile (the local `caddy
+        # validate` in Task 3 is optional; this one is mandatory in CI).
+        run: |
+          docker run --rm \
+            -e RUTSTER_DOMAIN=pbx.example.com \
+            -e RUTSTER_ACME_EMAIL=test@example.com \
+            -v "$PWD/deploy/Caddyfile:/etc/caddy/Caddyfile:ro" \
+            rutster-edge:smoke \
+            caddy validate --config /etc/caddy/Caddyfile --adapter caddyfile
+
+  # deploy-B §9 all-in-one smoke — boots rutster-allinone with
+  # RUTSTER_LOCAL_CERTS=true (Caddy internal CA, no ACME in CI), extracts
+  # the CA root cert from /data, opens wss:// to /twilio/media-stream,
+  # sends Twilio's connected+start handshake frames, streams 200 PCM-zeroed
+  # frames at 20ms cadence, asserts the engine replies with at least one
+  # text frame through the real edge->FOB WS path. Spec §9 acceptance:
+  #   * "boots"
+  #   * "Caddy terminates TLS via its internal CA (no ACME in CI)"
+  #   * "full sim call through the real edge->FOB WS path"
+  # The reload-during-call smoke (Task 9 below) and compose smoke (Task 9)
+  # are separate jobs that depend on this one.
+  smoke:
+    name: smoke (all-in-one TLS sim call)
+    runs-on: ubuntu-latest
+    needs: [image-build]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python (stdlib-only; no pip)
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      # Pull the freshly-built image from the image-build job. Since
+      # jobs run on separate runners + `push: false` in image-build means
+      # the image isn't in any registry, the smoke job rebuilds from the
+      # GHA cache (warm — image-build populated it). This adds ~30s vs
+      # an image-download artifact, but avoids the registry-auth + image-
+      # save/load plumbing.
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Rebuild rutster-allinone:smoke (warm cache from image-build)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          tags: rutster-allinone:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-allinone
+
+      - name: Run all-in-one smoke (deploy/smoke/allinone_smoke.py)
+        run: |
+          python3 deploy/smoke/allinone_smoke.py
+        env:
+          RUTSTER_ALLINONE_IMAGE: rutster-allinone:smoke
+          RUTSTER_ALLINONE_PORT: "18443"
+
+  # deploy-B §9 compose smoke — T2 four-service compose stack boots + all
+  # services healthy + Caddy TLS /healthz + /readyz. Lighter than the
+  # all-in-one smoke (which already proved the WS path) — its job is the
+  # orchestrator shape + the network_mode: "service:engine" brain->engine tap
+  # posture across the four services.
+  smoke-compose:
+    name: smoke (T2 compose four-service)
+    runs-on: ubuntu-latest
+    needs: [image-build]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Rebuild all three first-party images from the warm GHA cache
+      # populated by image-build. Valkey is upstream (no rebuild needed).
+      - name: Rebuild rutster-edge:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-edge
+          tags: rutster-edge:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-edge
+
+      - name: Rebuild rutster-engine:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-engine
+          tags: rutster-engine:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-engine
+
+      - name: Rebuild rutster-brain:smoke
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-brain
+          tags: rutster-brain:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-brain
+
+      # jq is pre-installed on ubuntu-latest GHA runners.
+      - name: Run compose smoke (deploy/smoke/compose_smoke.sh)
+        run: bash deploy/smoke/compose_smoke.sh
+        env:
+          RUTSTER_IMAGES_TAG: smoke
+
+  # deploy-B §9 + spec §3.2 + TLS brief §5 risk 1: Caddy config-reload
+  # during a live simulated call, asserting zero frame drops. The
+  # stream_close_delay 24h mitigation in deploy/Caddyfile is the load-
+  # bearing fixture; caddy #6420 / #7222 are open upstream bugs — the
+  # smoke is "don't trust untested" made CI-regressed.
+  smoke-reload:
+    name: smoke (caddy reload during live call, zero drops)
+    runs-on: ubuntu-latest
+    needs: [smoke]   # reuses the rutster-allinone:smoke image, warm cache
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python (stdlib-only; no pip)
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Rebuild rutster-allinone:smoke (warm cache)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          tags: rutster-allinone:smoke
+          push: false
+          load: true
+          cache-from: type=gha,scope=rutster-allinone
+
+      - name: Run reload-during-call smoke (deploy/smoke/reload_during_call.py)
+        run: python3 deploy/smoke/reload_during_call.py
+        env:
+          RUTSTER_ALLINONE_IMAGE: rutster-allinone:smoke
+          RUTSTER_ALLINONE_PORT: "18444"

.github/workflows/publish-images.yml

@@ -0,0 +1,202 @@
+# .github/workflows/publish-images.yml — slice F (spec §6.3 + §11).
+#
+# Tag-push workflow: builds + pushes all four first-party images to the
+# git.adlee.work/alee/rutster-* registry namespace. linux/amd64 only (spec
+# §1.2 / ADR-0011 — arm64 is a named deferral).
+#
+# Gating: runs AFTER and gated on the existing fmt/clippy/test/deny/sim-bench
+# + image-build pipeline. The publish workflow re-runs the fmt/clippy/test/
+# deny matrix as a `needs:` chain (cheap when nothing changed) + builds all
+# four images from the same Dockerfile CI's image-build job uses. This makes
+# the published image byte-identical to the one CI tested — the "registry tag
+# points at a tested image" invariant operators rely on.
+#
+# Registry namespace: git.adlee.work/alee/rutster-* (matches the `alee` tea
+# login per AGENTS.md Git workflow + the root Cargo.toml's `repository`
+# field). If your Gitea registry uses a different owner segment, replace
+# `alee` throughout this file (REGISTRY_NAMESPACE below).
+
+name: Publish Images
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+env:
+  REGISTRY: git.adlee.work
+  REGISTRY_NAMESPACE: alee
+  PLATFORMS: linux/amd64
+
+jobs:
+  # The publish workflow is its own pipeline; it re-runs fmt/clippy/test/deny
+  # + builds the images + then publishes. The fmt/clippy/test/deny re-runs
+  # are cheap on a green repo (cache hits, fast fmt + clippy + test), and
+  # they make a critical guarantee: the version published under a `v*` tag
+  # has ALL the repo's quality gates green at that exact commit. Without
+  # this `needs:` chain, a tag could be pushed at a commit where the matrix
+  # failed but image-build happened to succeed on a flake.
+  fmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - run: cargo fmt --check
+
+  clippy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Install libopus (media crate FFI dep)
+        run: apt-get update && apt-get install -y libopus-dev
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo clippy --all --all-targets -- -D warnings
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        toolchain: [stable, "1.85"]
+    steps:
+      - uses: actions/checkout@v4
+
+      # Seam gate (mirror of .github/workflows/ci.yml's test job —
+      # loop_driver.rs + rtc_session.rs stay byte-identical to slice-3/5).
+      - name: Seam gate — loop_driver frozen + rtc_session pinned
+        run: |
+          EXPECTED_LOOP_DRIVER='744bf314edf7f4925c8bb3bd0f5176dbc88f8113'
+          EXPECTED_RTC_SESSION='f47d63b9a2883d37066a93c9daa0e2cf8816bec4'
+          GOT_LOOP_DRIVER=$(git hash-object crates/rutster-media/src/loop_driver.rs)
+          GOT_RTC_SESSION=$(git hash-object crates/rutster-media/src/rtc_session.rs)
+          [ "$GOT_LOOP_DRIVER" = "$EXPECTED_LOOP_DRIVER" ] || exit 1
+          [ "$GOT_RTC_SESSION" = "$EXPECTED_RTC_SESSION" ] || exit 1
+      - uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: ${{ matrix.toolchain }}
+      - name: Install libopus (media crate FFI dep)
+        run: apt-get update && apt-get install -y libopus-dev
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --all
+
+  deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check
+
+  sim-bench:
+    name: sim-bench (stable)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - name: Install libopus (media crate FFI dep)
+        run: apt-get update && apt-get install -y libopus-dev
+      - uses: Swatinem/rust-cache@v2
+      - name: cargo fmt + clippy on sim-bench feature paths
+        run: |
+          cargo fmt --all --check
+          cargo clippy --all --all-targets --features=sim-bench -- -D warnings
+      - name: Run sim-bench threshold sweep
+        run: cargo test --all --features=sim-bench -- --test-threads=1
+
+  publish:
+    name: Publish 4 images to git.adlee.work/alee/rutster-*
+    runs-on: ubuntu-latest
+    needs: [fmt, clippy, test, deny, sim-bench]
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build-time host deps (belt-and-braces)
+        run: sudo apt-get update && sudo apt-get install -y libopus-dev
+
+      - name: Log in to Gitea registry
+        # GITEA_REGISTRY_USERNAME + GITEA_REGISTRY_PASSWORD are repo secrets
+        # set by the maintainer (per AGENTS.md Git workflow — the `alee`
+        # tea login). The username is `alee` (matches REGISTRY_NAMESPACE).
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.GITEA_REGISTRY_USERNAME }}
+          password: ${{ secrets.GITEA_REGISTRY_PASSWORD }}
+
+      - name: Determine tags
+        id: tags
+        # Two tags per image: the version tag (github.ref_name, e.g. v0.1.0)
+        # + `latest`. Operators can pin to either; `latest` is the
+        # convenience tag that always points at the most recent release.
+        run: |
+          echo "version_tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
+          echo "namespace=${REGISTRY}/${REGISTRY_NAMESPACE}" >> $GITHUB_OUTPUT
+
+      - name: Build + push rutster-engine
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-engine
+          platforms: ${{ env.PLATFORMS }}
+          tags: |
+            ${{ steps.tags.outputs.namespace }}/rutster-engine:${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.namespace }}/rutster-engine:latest
+          push: true
+          cache-from: type=gha,scope=rutster-engine
+          cache-to: type=gha,mode=max,scope=rutster-engine
+
+      - name: Build + push rutster-brain
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-brain
+          platforms: ${{ env.PLATFORMS }}
+          tags: |
+            ${{ steps.tags.outputs.namespace }}/rutster-brain:${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.namespace }}/rutster-brain:latest
+          push: true
+          cache-from: type=gha,scope=rutster-brain
+          cache-to: type=gha,mode=max,scope=rutster-brain
+
+      - name: Build + push rutster-edge
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-edge
+          platforms: ${{ env.PLATFORMS }}
+          tags: |
+            ${{ steps.tags.outputs.namespace }}/rutster-edge:${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.namespace }}/rutster-edge:latest
+          push: true
+          cache-from: type=gha,scope=rutster-edge
+          cache-to: type=gha,mode=max,scope=rutster-edge
+
+      - name: Build + push rutster-allinone
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: deploy/Dockerfile
+          target: rutster-allinone
+          platforms: ${{ env.PLATFORMS }}
+          tags: |
+            ${{ steps.tags.outputs.namespace }}/rutster-allinone:${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.namespace }}/rutster-allinone:latest
+          push: true
+          cache-from: type=gha,scope=rutster-allinone
+          cache-to: type=gha,mode=max,scope=rutster-allinone