ci: migrate to canonical hanzoai/.github/docker-build.yml reusable workflow

.dockerignore

@@ -0,0 +1,51 @@
+# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
+
+# dependencies
+/node_modules
+/.pnp
+.pnp.js
+bun.lockb
+yarn.lock
+package-lock.json
+
+# testing
+/coverage
+
+# database
+/prisma/db.sqlite
+/prisma/db.sqlite-journal
+
+# next.js
+/.next/
+/out/
+next-env.d.ts
+
+# production
+/build
+
+# misc
+.DS_Store
+*.pem
+
+# debug
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+.pnpm-debug.log*
+
+# local env files
+# do not commit any .env files to git, except for the .env.example file. https://create.t3.gg/en/usage/env-variables#using-environment-variables
+.env
+.env*.local
+/prisma/enums.ts
+/prisma/generated/*
+
+# vercel
+.vercel
+
+# typescript
+*.tsbuildinfo
+
+#local
+/local
+.vscode/

.env.example

@@ -9,17 +9,46 @@
 # When adding additional environment variables, the schema in "/src/env.js"
 # should be updated accordingly.
 
+# Next.js environment variables
+NODE_ENV="development"
+NEXT_PUBLIC_NODE_ENV="development"
+NEXT_PUBLIC_BASE_URL="http://localhost:3000"
+
+# Disable telemetry at run time
+NEXT_TELEMETRY_DISABLED=1 # Injected in Dockerfile
+
 # Prisma
-# https://www.prisma.io/docs/reference/database-reference/connection-urls#env
-DATABASE_URL="file:./db.sqlite"
+DATABASE_URL="postgres://captable:password@pg:5432/captable"
 
 # Next Auth
-# You can generate a new secret on the command line with:
-# openssl rand -base64 32
-# https://next-auth.js.org/configuration/options#secret
-# NEXTAUTH_SECRET=""
+# Run `openssl rand -base64 32` to generate a new secret
+NEXTAUTH_SECRET="xxxxxxxxxx"
 NEXTAUTH_URL="http://localhost:3000"
 
+# Hanzo IAM OAuth (required for production)
+IAM_URL="https://hanzo.id"
+IAM_CLIENT_ID=""
+IAM_CLIENT_SECRET=""
+# IAM_PROVIDER_NAME="Hanzo"
+
+## Auth Optional (deprecated — use Hanzo IAM above)
+# GOOGLE_CLIENT_ID=""
+# GOOGLE_CLIENT_SECRET=""
+
 # SMTP
-EMAIL_SERVER=smtp://username:password@smtp.example.com:587
-EMAIL_FROM=email@example.com
+EMAIL_FROM="'Captable, Inc.' <support@captable.inc>"
+EMAIL_SERVER=smtp://captable:password@localhost:1025
+
+# Uploads
+UPLOAD_ENDPOINT="http://127.0.0.1:9002"
+NEXT_PUBLIC_UPLOAD_DOMAIN="http://127.0.0.1:9002"
+UPLOAD_REGION="us-east-1" # value should be 'auto' while using r2
+UPLOAD_ACCESS_KEY_ID="captable"
+UPLOAD_SECRET_ACCESS_KEY="password"
+UPLOAD_BUCKET_PUBLIC="captable-public-bucket"
+UPLOAD_BUCKET_PRIVATE="captable-private-bucket"
+
+# Sentry
+SENTRY_ORG=YOUR_SENTRY_ORG
+SENTRY_PROJECT=YOUR_SENTRY_PROJECT
+NEXT_PUBLIC_SENTRY_DSN=YOUR_SENTRY_DSN

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Maintain dependencies for npm
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/build.yml

@@ -0,0 +1,50 @@
+name: "Build docker image"
+
+on:
+  pull_request:
+    branches: ["main"]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build_docker:
+    name: Build Docker Image
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false
+    steps:
+      - name: ⬇️ Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: ⛅ Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: 🎁 Cache Docker layers
+        uses: actions/cache@v4
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
+      - name: 🚀 Build Docker Image
+        uses: docker/build-push-action@v5
+        with:
+          push: false
+          context: .
+          file: ./docker/Dockerfile
+          tags: captable-${{ github.sha }}
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+
+      - # Temp fix
+        # https://github.com/docker/build-push-action/issues/252
+        # https://github.com/moby/buildkit/issues/1896
+        name: 🚚 Move cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

.github/workflows/clean-cache.yml

@@ -0,0 +1,29 @@
+name: Cleanup cache
+on:
+  pull_request:
+    types:
+      - closed
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Cleanup
+        run: |
+          gh extension install actions/gh-actions-cache
+
+          echo "Fetching list of cache key"
+          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH -L 100 | cut -f 1 )
+
+          ## Setting this to not fail the workflow while deleting cache keys.
+          set +e
+          echo "Deleting caches..."
+          for cacheKey in $cacheKeysForPR
+          do
+            gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
+          done
+          echo "Done"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/docker-deploy.yml

@@ -0,0 +1,25 @@
+name: Build & Deploy
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  docker:
+    uses: hanzoai/.github/.github/workflows/docker-build.yml@main
+    with:
+      image: ghcr.io/hanzoai/captable
+      dockerfile: docker/Dockerfile
+    secrets: inherit
+
+  deploy:
+    needs: docker
+    uses: hanzoai/universe/.github/workflows/reusable-deploy-service.yml@main
+    with:
+      service: captable
+      image: ghcr.io/hanzoai/captable:${{ github.sha }}
+      cluster: hanzo-k8s
+      namespace: hanzo
+    secrets:
+      HANZO_API_KEY: ${{ secrets.HANZO_API_KEY }}

.github/workflows/first-interaction.yml

@@ -0,0 +1,36 @@
+name: First interaction greeting
+
+on:
+  pull_request:
+    types: ["opened"]
+  issues:
+    types: ["opened"]
+
+permissions:
+  pull-requests: write
+  issues: write
+
+jobs:
+  greeting:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/first-interaction@v1
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-message: |
+            Welcome @${{github.actor}} :wave:
+
+            Thank you for creating your first Pull Request! 
+
+            One of our team members will review it and get back to you as soon as possible.
+
+            In the meantime feel free to hop into our community in [Discord](https://discord.gg/rCpqnD6G6p)
+
+            Thanks again, and welcome to the community! :smiley:
+
+          issue-message: |
+            Welcome @${{github.actor}} :wave:
+
+            thank you for opening your first issue! We will get back to you shortly.
+
+            Meanwhile, please feel free to hop into our community in [Discord](https://discord.gg/rCpqnD6G6p)

.github/workflows/release.yml

@@ -0,0 +1,63 @@
+name: Production
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  push_to_registries:
+    name: Publish docker image & deploy to production
+    runs-on: ubuntu-latest
+    concurrency:
+      group: release
+      cancel-in-progress: true
+    permissions:
+      packages: write
+      contents: read
+      id-token: write
+      attestations: write
+
+    steps:
+      - name: ✅ Check out the repo
+        uses: actions/checkout@v4
+
+      - name: 🐬 Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: 🗄️ Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: 🗃️ Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            captable/captable
+            ghcr.io/${{ github.repository }}
+
+      - name: 🚀 Build and push Docker images
+        id: push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./docker/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: 🪰 Setup flyctl
+        uses: superfly/flyctl-actions/setup-flyctl@master
+        with:
+          version: latest
+
+      - name: 🚀 Deploy Production
+        run: flyctl deploy --vm-cpu-kind=performance --remote-only --image captable/captable:latest
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}