wakeci is an automation tool which helps to execute repetitive tasks
- simple job configuration using YAML files with Ansible inspired syntax
- easy to install - just download a binary file from Releases
- automatic Let's Encrypt SSL certificates
- parameterized builds, artifacts, intervals and timeouts - see job configuration example below
- API keys limited to reading, running or editing jobs, and to the jobs you pick
- no plugins, no extensive configuration - focus on your project instead!
See full description here
desc: Build and release wake application
params:
- VERSION: master
tasks:
- name: Clone repository
run: git clone git@github.com:jsnjack/wakeci.git --recursive
- name: Checkout version
run: sh ${WAKE_CONFIG_DIR}utils/checkout.sh wakeci ${VERSION}
- name: Install npm dependencies
run: cd wakeci/src/frontend && npm install
- name: Build application
run: cd wakeci && make build
- name: Create a release on github
run: python ${WAKE_CONFIG_DIR}utils/release_on_github.py -f wakeci/bin/wakeci -r jsnjack/wakeci -t "v`cd wakeci && monova`"
timeout: 10m
on_failed:
- name: Send notification to Slack
run: >-
python ${WAKE_CONFIG_DIR}utils/notify_slack.py
-t "Job ${WAKE_JOB_NAME} has failed at '${WAKE_FAILED_TASK_NAME}' <${WAKE_URL}build/${WAKE_BUILD_ID}|#${WAKE_BUILD_ID}>"
-k error
on_finished:
- name: Send notification to Slack
run: >-
python ${WAKE_CONFIG_DIR}utils/notify_slack.py
-t "New wake version `cd wakeci && monova` <${WAKE_URL}build/${WAKE_BUILD_ID}|#${WAKE_BUILD_ID}>"
-k okUsage of ./bin/wakeci:
-V Print the version and exit (shorthand).
-compactdb
Reclaim space in the database which is no longer used
-config string
Configuration file location (default "Wakefile.yaml")
-version
Print the version and exit.
# Port to start the server on (default "8081")
port: 8081
# Hostname for autocert (active only when port is 443) and the default
# single sign-on URLs
hostname: ""
# Working directory (default ".wakeci/")
workdir: ./wakeci
# Configuration directory - all your job files (default "./"). Every .yaml file
# in it can be opened as a job, so keep this file and the secrets file outside it
jobdir: ./jobs
# Path to the file with secrets
secretsfile: ./secrets.yaml
# Scheduled jobs (via `interval` field) will use this timezone, if not specified
# in the job configuration
timezone: Europe/Amsterdam
# Optional single sign-on through a SAML identity provider such as Google
# Workspace, next to the password. See "Single sign-on" below.
sso:
# Metadata file downloaded from the identity provider. Keep it outside jobdir
idpmetadata: ./GoogleIDPMetadata.xml
# Comma-separated groups allowed to log in, as named in the "groups" attribute
groups: Developers, Ops
# Where the identity provider posts the response.
# Defaults to https://<hostname>/auth/sso/acs
acsurl: ""
# Identifies wakeci to the identity provider. Defaults to https://<hostname>
entityid: ""
To set it up with Google Workspace, add a custom SAML app in the Google Admin console (Apps, Web and mobile apps, Add app, Add custom SAML app):
- Download the IdP metadata and point
sso.idpmetadataat the file. - Service provider details: ACS URL
https://<hostname>/auth/sso/acs, Entity IDhttps://<hostname>, Name ID formatEMAIL, Name IDBasic Information > Primary email. - Attribute mapping: under "Group membership", pick the groups and set the app
attribute to
groups. List the same group names insso.groups. - User access: turn the app on for those groups.
Only accounts of your own Workspace can sign in to a custom SAML app, and of
those only members of a group in sso.groups can log in; a rejected login
logs the groups wakeci received. Opening wakeci from the Google apps menu
starts a normal login. SSO sessions last 12 hours, password sessions 5 days.
API calls use an API key (see below) or Basic auth with the password.
Serve wakeci over HTTPS, or on localhost: Google posts the response from
another site, which browsers only allow with a Secure login cookie. When
Google renews its certificate, download the metadata again and restart wakeci.
Scripts and other tools can call the API with a key instead of the password. Create one on the API keys page (the key icon), choose what it can do and on which jobs, and send it as a Bearer token:
curl -X POST -H "Authorization: Bearer wk_..." https://<hostname>/api/job/deploy/run| Scope | Allows |
|---|---|
read |
the job list, job files, the feed, builds, task logs and artifacts |
run |
running jobs, and aborting, starting or flushing their builds |
write |
creating, editing, deleting, enabling and disabling jobs |
A key covers all jobs, including jobs added later, or only the jobs you pick
and the ones whose names match a pattern such as test_*. write always
covers all jobs: jobs run commands on the server, so a key that can edit one
can reach everything wakeci can. The job list and the feed only show the key's
jobs. Keys never open the settings, key management, login or the websocket.
Run parameters sent with a key can't reference a secret ({{ secrets.NAME }})
or contain quotes or line breaks, and in builds a key starts, build.env
values aren't turned into secrets. A run key still chooses the job's parameters, so treat
them as untrusted input: quote them, and don't let one pick where a job sends
a secret, such as the URL a token is posted to.
The key is shown once, when it is created; wakeci only stores a hash of it. Revoking a key stops it at once. Keys don't depend on the password, and survive restarts.
Each key records who created it. Logged in with the admin password, the API keys page shows every key and who made it, and can revoke all keys of a person, which also signs them out. People who sign in with SSO only see and revoke the keys they created, and only the admin password can change the password. Everything else is open to them, including editing jobs, which runs commands on the server, so only give SSO access to people you trust.
wakeci can't tell on its own that a Google account is gone, so when someone leaves:
- Suspend or delete their Google account, so they can't sign in again.
- On the API keys page, logged in with the admin password, pick them under "Created by" (it lists everyone with a key or signed in) and click "Revoke access". That signs them out, closes their live updates and revokes their keys.
- If they knew the admin password, change it and restart wakeci to invalidate existing password sessions. This signs everyone out and interrupts running builds. Then revoke all keys created with the admin password, since those keys cannot be attributed to a person and survive password changes and restarts.
Default password is
admin. Don't forget to immediately change it!
See full description here
Requires golang 1.18+
go get golang.org/dl/go1.18.2
/home/$USER/go/bin/go1.18.2 download
# Manage different versions with `alternatives`
sudo alternatives --install /usr/bin/go go /home/$USERNAME/go/bin/go1.18.2 10
# Switch between different go versions
sudo alternatives --config goGolang downloads page https://golang.org/dl/
sudo dnf install entr
go install github.com/swaggo/swag/cmd/swag@latest
# cd src/frontend
npm install# frontend
make runf
# backend
make runbThe Playwright suite runs against isolated production backends in parallel. It requires Google Chrome. Each worker gets a temporary database, job directory, test secrets, and an available port; it does not use your running server.
make testprod # build, then run the full E2E suite
make testprod E2E_ARGS="--workers=4" # choose the worker count
make testprod E2E_ARGS="e2e/feed.spec.js" # run one spec
make testdev # run with visible browsers
make check # full project validation, including E2E
make testreport # open the last HTML report from the repo root
# After building, rerun tests without rebuilding:
cd src/frontend
npm test
npm run test:open # interactive Playwright UI
npm run test:report # inspect the last HTML reportThe default worker count is half the available CPUs, capped at ten. On a Ryzen AI 9 HX PRO 370 with 24 CPU threads, ten workers had the fastest measured median (13.7 seconds over nine full-suite runs); twelve took 15.3 seconds and twenty-four took 17.9 seconds.
Tests retain screenshots, browser traces, and backend logs on failure in
src/frontend/test-results/. To use Playwright's Chromium instead of Chrome,
install it explicitly with npx playwright install chromium and run with
E2E_BROWSER_CHANNEL=chromium.
npm outdated --json | jq -r 'keys[]' | xargs -I % npm i %@latest --saveGOWORK=off go-mod-upgrade