feat: CI/CD pipeline, containerized deployment to Civo K8s

.dockerignore

@@ -0,0 +1,86 @@
+# Docker build context ignore (mirrors .containerignore)
+
+# Git
+.git
+.gitignore
+.gitattributes
+
+# Documentation
+*.md
+!README.md
+docs/
+tex_research/
+
+# IDE and Editor
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Node
+node_modules/
+npm-debug.log*
+pnpm-debug.log*
+.pnpm-store/
+.npm/
+
+# Build outputs
+.svelte-kit/
+build/
+dist/
+.output/
+
+# Tests
+tests/
+*.test.ts
+*.test.js
+*.spec.ts
+*.spec.js
+playwright.*.config.ts
+vitest.config.ts
+coverage/
+
+# Futhark build intermediates (keep .wasm, .mjs, .class.js)
+futhark/*.c
+futhark/*.h
+
+# Container files
+Dockerfile
+.dockerignore
+.containerignore
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+
+# Env files
+.env
+.env.*
+
+# Logs
+logs/
+*.log
+
+# Temporary files
+tmp/
+temp/
+
+# OS
+Thumbs.db
+.DS_Store
+
+# Nix / Bazel (not needed in container)
+flake.nix
+flake.lock
+nix/
+.bazelrc
+.bazelignore
+BUILD.bazel
+MODULE.bazel
+platforms/
+
+# Claude
+.claude/
+CLAUDE.md

.github/workflows/build-image.yml

@@ -0,0 +1,46 @@
+name: Build Container Image
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'src/**'
+      - 'futhark/**'
+      - 'server/**'
+      - 'static/**'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'Dockerfile'
+      - 'svelte.config.js'
+      - 'vite.config.ts'
+      - 'tailwind.config.ts'
+      - 'tsconfig.json'
+
+jobs:
+  build-push:
+    name: Build & Push to GHCR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/jesssullivan/pixelwise:latest
+            ghcr.io/jesssullivan/pixelwise:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/deploy.yml

@@ -0,0 +1,53 @@
+name: Deploy to Civo
+
+on:
+  workflow_run:
+    workflows: ['Build Container Image']
+    types: [completed]
+    branches: [master]
+
+jobs:
+  deploy:
+    name: Deploy to Civo
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install kubectl
+        uses: azure/setup-kubectl@v4
+
+      - name: Configure kubeconfig
+        run: |
+          mkdir -p ~/.kube
+          echo "${{ secrets.CIVO_KUBECONFIG }}" | base64 -d > ~/.kube/config
+          chmod 600 ~/.kube/config
+
+      - name: Get triggering commit SHA
+        id: sha
+        run: echo "sha=${{ github.event.workflow_run.head_sha }}" >> "$GITHUB_OUTPUT"
+
+      - name: Apply manifests
+        run: kubectl apply -f k8s/
+
+      - name: Update image
+        run: |
+          kubectl set image deployment/pixelwise \
+            pixelwise=ghcr.io/jesssullivan/pixelwise:${{ steps.sha.outputs.sha }} \
+            -n pixelwise
+
+      - name: Wait for rollout
+        run: kubectl rollout status deployment/pixelwise -n pixelwise --timeout=5m
+
+      - name: Smoke test
+        run: |
+          sleep 10
+          status=$(curl -sf -o /dev/null -w "%{http_code}" \
+            https://pixelwise.tinyland.dev/api/health || true)
+          if [ "$status" = "200" ]; then
+            echo "Health check passed"
+          else
+            echo "Health check failed (HTTP $status)"
+            exit 1
+          fi

.github/workflows/release.yml

@@ -0,0 +1,73 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+jobs:
+  create-release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          prev_tag=$(git tag --sort=-v:refname | head -2 | tail -1)
+          if [ -z "$prev_tag" ]; then
+            log=$(git log --oneline)
+          else
+            log=$(git log --oneline "${prev_tag}..HEAD")
+          fi
+          {
+            echo 'changelog<<EOF'
+            echo "$log"
+            echo 'EOF'
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          body: |
+            ## Changes
+
+            ${{ steps.changelog.outputs.changelog }}
+          generate_release_notes: true
+
+  build-container:
+    name: Build Release Container
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Extract version from tag
+        id: version
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ghcr.io/jesssullivan/pixelwise:${{ steps.version.outputs.version }}
+            ghcr.io/jesssullivan/pixelwise:latest
+            ghcr.io/jesssullivan/pixelwise:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max