Merge branch 'main' of https://github.com/input-output-hk/wsc-poc int…

…o kat/fe-cors-fix

.github/workflows/ci-oci.yaml

@@ -6,18 +6,48 @@ name: "ci-oci"
 on:
   pull_request:
   push:
-    branches:
-      - main
+    tags:
+      - "v*"
+
+permissions:
+  packages: write
+
+env:
+  REGISTRY_USER: ${{ github.actor }}
+  REGISTRY_PASSWORD: ${{ github.token }}
+  IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
 
 concurrency:
   group: "ci-oci-${{ github.ref }}"
   cancel-in-progress: true
 
 jobs:
   tests:
+    strategy:
+      matrix:
+        image: [wst, wst-poc-mock-server]
     runs-on: ubuntu-latest
     steps:
 
+    - name: Determine image tag for git tag
+      if: ${{ github.event_name == 'push' }}
+      run: |
+        IMAGE_TAG=$(git rev-parse --abbrev-ref "${{ github.event.push.ref }}")
+        echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
+
+    - name: Determine image tag for PR
+      if: ${{ github.event_name == 'pull_request' }}
+      run: |
+        IMAGE_TAG=pr-${{ github.event.pull_request.number }}
+        echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV
+
+    - name: Log in to ghcr.io
+      uses: redhat-actions/podman-login@v1
+      with:
+        username: ${{ env.REGISTRY_USER }}
+        password: ${{ env.REGISTRY_PASSWORD }}
+        registry: ${{ env.IMAGE_REGISTRY }}
+
     - uses: actions/checkout@v4
 
     - name: Install nix
@@ -44,7 +74,15 @@ jobs:
         # except the version with the `primary-key`, if it exists
         purge-primary-key: never
 
-    - run: nix build --accept-flake-config .#containers.x86_64-linux.wst.copyTo
-    - run: ./result/bin/copy-to oci-archive:oci.tar
-    - run: ls -alh oci.tar
+    # TODO: matrix build for two images (mock server and wst)
+    - name: Build image with nix
+      run: nix build --accept-flake-config .#containers.x86_64-linux.${{ matrix.image }}.copyTo
+    - name: Publish tagged image with podman
+      run: |
+        IMAGE_NAME=ghcr.io/${{github.repository_owner}}/${{ matrix.image }}:$IMAGE_TAG
+        ./result/bin/copy-to oci-archive:oci.tar
+        IMAGE_HASH=$(podman load --quiet -i oci.tar | sed 's/.*sha256://')
+        podman tag $IMAGE_HASH $IMAGE_NAME
+        podman push $IMAGE_NAME
+
 

nix/containers.nix

@@ -1,35 +1,29 @@
 { repoRoot, inputs, pkgs, lib, system }: let
 
-staticFilesDerivation = pkgs.stdenv.mkDerivation {
-  name = "staticFiles";
-  src = ../generated;
-  unpackPhase = "true";
+frontendNpm = pkgs.buildNpmPackage rec {
+  name = "frontend";
+  src = ../frontend;
+  npmDepsHash = "sha256-Oz7pdTMJVgGj5rzjIMvDjaOV7JU+hYLHoSSb+OcJARk=";
+  npmPackFlags = [ "--ignore-scripts" ];
   installPhase = ''
-    ls -alh "$src"
-    mkdir -p "$out"
-    cp -r $src/html $out
-    ls -alh $out
+    mkdir -p $out/frontend
+    cp -r out/* $out/frontend
   '';
 };
 
-staticFiles = pkgs.buildEnv {
-  name = "staticFiles";
-  paths = [
-    # the actual payload we want
-    staticFilesDerivation
-    # allow interactivity with the image
-    pkgs.bashInteractive
-    pkgs.coreutils
-  ];
-  pathsToLink = [ "/html" "/bin" ];
-  extraOutputsToInstall = [ "/html" ];
+frontend = pkgs.buildEnv {
+  name = "frontend";
+  paths = [ frontendNpm ];
 };
 
 in rec {
 
   # Builds a docker container for the cabal executable given as input. First we
   # build the container json itself. Note the explicit architecture.
   #
+  # NOTE: I don't think iogx.mkContainerFromCabalExe enables linking in the base image correctly. Hence the more manual construction below.
+  # TODO: Consider patching iogx if that is the case?
+  #
   # NOTE: The following commands produce a nice test environment for the container
   # Build via nix first
   #
@@ -40,7 +34,7 @@ in rec {
   #$ ./result/bin/copy-to dir:./tmp
   #
   # Now we can run the container (the tx is just some random I copied from the explorer)
-  #$ podman run --publish 8080:8080 --env WST_BLOCKFROST_TOKEN=REPLACE_ME_APIKEY dir:./tmp manage 76e2cfb0b087873ef50a3f709fa6ab3df21bdd5b67c1254837cc353613524251.0 start --static-files /html
+  #$ podman run --publish 8080:8080 --env WST_BLOCKFROST_TOKEN=REPLACE_ME_APIKEY dir:./tmp manage 76e2cfb0b087873ef50a3f709fa6ab3df21bdd5b67c1254837cc353613524251.0 start --static-files /frontend
   #
   # NOTE: To build the oci container image run:
   #
@@ -50,31 +44,21 @@ in rec {
     name = "wst";
     config = {
       Entrypoint = lib.singleton (lib.getExe inputs.self.packages.wst-poc-cli);
+      Labels = {
+        "org.opencontainers.image.source"      = "https://github.com/input-output-hk/wsc-poc";
+        "org.opencontainers.image.description" = "Programmable token and regulated stablecoin proof-of-concept";
+      };
     };
     layers = [
+      # npm-created data for frontend
       (inputs.n2c.packages.nix2container.buildLayer {
-        copyToRoot = [staticFiles];
+        copyToRoot = [frontend];
       })
     ];
   };
 
-  # NOTE: I don't think iogx.mkContainerFromCabalExe enables linking in the base image correctly. Hence the more manual construction above.
-  # TODO: Consider patching iogx if that is the case?
-
-  # Builds a docker container for the cabal executable given as input. First we
-  # build the container json itself. Note the explicit architecture.
-  #
-  # $ nix build .#containers.x86_64-linux.wstBinary
-  #
-  # wstBinary = lib.iogx.mkContainerFromCabalExe {
-  #   exe = inputs.self.packages.wst-poc-cli;
-  #   name = "wst-poc";
-  #   description = "WST Proof of Concept";
-  #   # packages = [ staticFiles staticFilesDerivation ];
-  #   sourceUrl = "https://github.com/input-output-hk/wsc-poc";
-  # };
 
-  mockserver = lib.iogx.mkContainerFromCabalExe {
+  wst-poc-mock-server = lib.iogx.mkContainerFromCabalExe {
     exe = inputs.self.packages.wst-poc-mock-server;
     name = "wst-poc-mock-server";
     description = "WST mockserver";