Twerkflows

Author: psedge

.dockerignore

@@ -1,4 +1,7 @@
 node_modules
 drawio
-!drawio/src/main/webapp/index.html
 dist
+recordings
+scripts
+demo.gif
+.github

.github/workflows/ci.yml

@@ -0,0 +1,70 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Restrict all jobs to read-only by default; grant write only where needed.
+permissions:
+  contents: read
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - run: npm ci
+      - run: npm test
+
+  build-and-push:
+    needs: test
+    runs-on: ubuntu-latest
+    # Only push the image on pushes to main, not on PRs
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract image metadata
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=sha,prefix=
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -1,6 +1,5 @@
 # Ours
 drawio/*
-!drawio/src/main/webapp/index.html
 
 
 # Theirs
@@ -108,6 +107,5 @@ dist
 
 # TernJS port file
 .tern-port
-drawio
 test-results
 recordings

Dockerfile

@@ -1,6 +1,8 @@
 # Stage 1 — clone draw.io (only the webapp is needed at runtime)
 FROM alpine/git AS drawio
-RUN git clone --depth 1 https://github.com/jgraph/drawio.git /drawio
+RUN git clone https://github.com/jgraph/drawio.git /drawio && \
+    cd /drawio && \
+    git checkout 907d09cc895ede8f7eeff7adcb2adf7c864dd273
 
 # Stage 2 — build the JS bundle
 FROM node:20-alpine AS builder
@@ -26,8 +28,8 @@ COPY --from=builder /app/dist ./dist
 
 # draw.io webapp only (the full repo is ~200MB; the webapp is ~30MB)
 COPY --from=drawio /drawio/src/main/webapp ./drawio/src/main/webapp
-# Overlay modeld's customized index.html (tracked in git, excluded from drawio clone)
-COPY drawio/src/main/webapp/index.html ./drawio/src/main/webapp/index.html
+# Overlay modeld's customized index.html
+COPY drawio-index.html ./drawio/src/main/webapp/index.html
 
 # MCP server
 COPY mcp ./mcp

Makefile

@@ -1,4 +1,4 @@
-.PHONY: install build test start
+.PHONY: install build test ci start
 
 drawio:
 	git clone https://github.com/jgraph/drawio.git drawio
@@ -12,5 +12,8 @@ build: install
 test:
 	npm test
 
+ci:
+	act push --job test --container-architecture linux/amd64
+
 start: build
 	npm start