feat: dev branch for dev testing (#1692) (#1693)

.github/workflows/check.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - "main"
+      - "main-dev"
     paths:
       - "typescript/**"
       - "biome.json"
@@ -15,6 +16,7 @@ on:
   pull_request:
     branches:
       - "main"
+      - "main-dev"
     paths:
       - "typescript/**"
       - "biome.json"

.github/workflows/client.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - "main"
+      - "main-dev"
     paths:
       - "typescript/client/**"
       - "typescript/common/**"
@@ -12,6 +13,7 @@ on:
   pull_request:
     branches:
       - "main"
+      - "main-dev"
     paths:
       - "typescript/client/**"
       - "typescript/common/**"
@@ -27,7 +29,7 @@ jobs:
     container:
       image: ghcr.io/zkldi/tachi-ci:main
       options: --user root
-    if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
+    if: ${{ (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/main-dev') && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -38,6 +40,7 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Build Bokutachi
+        if: github.ref == 'refs/heads/main'
         run: bun run --filter tachi-client build
         env:
           VITE_GIT_REPO: "GitHub:zkldi/Tachi"
@@ -51,6 +54,7 @@ jobs:
           BUILD_OUT_DIR: /tmp/boku
 
       - name: Build Kamaitachi
+        if: github.ref == 'refs/heads/main'
         run: bun run --filter tachi-client build
         env:
           VITE_MANDATE_LOGIN: true
@@ -68,6 +72,7 @@ jobs:
           BUILD_OUT_DIR: /tmp/kamai
 
       - name: Build Dev
+        if: github.ref == 'refs/heads/main-dev'
         run: bun run --filter tachi-client build
         env:
           VITE_MANDATE_LOGIN: true
@@ -83,8 +88,13 @@ jobs:
           TACHI_NAME: "Tachi Dev"
           BUILD_OUT_DIR: /tmp/dev
 
-      - name: Bundle build outputs
-        run: tar -C /tmp -czf client-builds.tgz boku kamai dev
+      - name: Bundle build outputs (main)
+        if: github.ref == 'refs/heads/main'
+        run: tar -C /tmp -czf client-builds.tgz boku kamai
+
+      - name: Bundle build outputs (main-dev)
+        if: github.ref == 'refs/heads/main-dev'
+        run: tar -C /tmp -czf client-builds.tgz dev
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -95,7 +105,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     needs: build
-    if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
+    if: ${{ (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/main-dev') && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     steps:
       - name: Install rsync
         run: sudo apt-get update && sudo apt-get install -y rsync
@@ -119,10 +129,16 @@ jobs:
           chmod 600 ~/.ssh/id_rsa
           printf '%s' "$SSH_KNOWN_HOSTS" > ~/.ssh/known_hosts
 
-      - name: Deploy static to VPS (Caddy roots)
+      - name: Deploy static to Ceres — production (kamai + boku)
+        if: github.ref == 'refs/heads/main'
         env:
           TACHI_HOST: ${{ secrets.TACHI_HOST }}
         run: |
           rsync --recursive --compress --delete --progress /tmp/kamai/. "ci@${TACHI_HOST}:/srv/tachi-static/kamai/"
           rsync --recursive --compress --delete --progress /tmp/boku/. "ci@${TACHI_HOST}:/srv/tachi-static/boku/"
-          rsync --recursive --compress --delete --progress /tmp/dev/. "ci@${TACHI_HOST}:/srv/tachi-static/dev/"
+
+      - name: Deploy static to Ceres — dev
+        if: github.ref == 'refs/heads/main-dev'
+        env:
+          TACHI_HOST: ${{ secrets.TACHI_HOST }}
+        run: rsync --recursive --compress --delete --progress /tmp/dev/. "ci@${TACHI_HOST}:/srv/tachi-static/dev/"

.github/workflows/common.yml

@@ -4,12 +4,14 @@ on:
   push:
     branches:
       - "main"
+      - "main-dev"
     paths:
       - "typescript/common/**"
       - ".github/workflows/common.yml"
   pull_request:
     branches:
       - "main"
+      - "main-dev"
     paths:
       - "typescript/common/**"
       - ".github/workflows/common.yml"

.github/workflows/server.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - "main"
+      - "main-dev"
     paths:
       - "typescript/server/**"
       - "typescript/common/**"
@@ -15,6 +16,7 @@ on:
   pull_request:
     branches:
       - "main"
+      - "main-dev"
     paths:
       - "typescript/server/**"
       - "typescript/common/**"
@@ -170,20 +172,28 @@ jobs:
         id: build_time
         run: echo "value=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
 
+      - name: Compute floating image tags
+        id: floating_tags
+        run: |
+          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+            echo "value=ghcr.io/zkldi/tachi:main\nghcr.io/zkldi/tachi:latest" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=ghcr.io/zkldi/tachi:main-dev" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Build and push unified server image
         uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           file: docker/Dockerfile.server
           target: prod
-          push: ${{ github.ref == 'refs/heads/main' }}
+          push: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/main-dev' }}
           provenance: true
           sbom: true
           tags: |
             ghcr.io/zkldi/tachi:${{ steps.revision.outputs.image_tag }}
             ghcr.io/zkldi/tachi:${{ github.sha }}
-            ghcr.io/zkldi/tachi:main
-            ghcr.io/zkldi/tachi:latest
+            ${{ steps.floating_tags.outputs.value }}
           build-args: |
             VERSION=${{ steps.server_version.outputs.version }}
             VERSION_DETAIL=${{ steps.revision.outputs.image_tag }}
@@ -192,17 +202,16 @@ jobs:
           cache-from: type=gha,scope=server-${{ github.ref_name }}
           cache-to: type=gha,mode=max,scope=server-${{ github.ref_name }}
 
-  dispatch-deploy:
-    # Fire a repository_dispatch at server-ceres (private). That repo's workflow
-    # owns the SSH key and Kamal output — keeping deploy logs out of this
-    # public repo. See server-ceres/.github/workflows/tachi-deploy.yml.
+  dispatch-deploy-prod:
+    # Deploys boku and kamai from main.
+    # See server.yml for rationale — deploy logs live in the private server-ceres repo.
     runs-on: ubuntu-latest
     needs: [test, docker-push]
     if: ${{ github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
     strategy:
       fail-fast: false
       matrix:
-        destination: [boku, kamai, dev]
+        destination: [boku, kamai]
     permissions:
       contents: read
     steps:
@@ -221,3 +230,27 @@ jobs:
             -F "client_payload[sha]=${SHA}" \
             -F "client_payload[image_tag]=${IMAGE_TAG}"
           echo "::notice::Dispatched server@${DEST} ${IMAGE_TAG} (${SHA}) — logs: https://github.com/zkldi/server-ceres/actions/workflows/tachi-deploy.yml"
+
+  dispatch-deploy-dev:
+    # Deploys dev from main-dev.
+    # See server.yml for rationale — deploy logs live in the private server-ceres repo.
+    runs-on: ubuntu-latest
+    needs: [test, docker-push]
+    if: ${{ github.ref == 'refs/heads/main-dev' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
+    permissions:
+      contents: read
+    steps:
+      - name: Dispatch deploy
+        env:
+          # Fine-grained PAT, repo-scoped to zkldi/server-ceres, Contents: write.
+          GH_TOKEN: ${{ secrets.DEPLOY_DISPATCH_TOKEN }}
+          SHA: ${{ github.sha }}
+          IMAGE_TAG: ${{ needs.docker-push.outputs.image_tag }}
+        run: |
+          gh api repos/zkldi/server-ceres/dispatches \
+            -f event_type=deploy \
+            -F "client_payload[app]=server" \
+            -F "client_payload[dest]=dev" \
+            -F "client_payload[sha]=${SHA}" \
+            -F "client_payload[image_tag]=${IMAGE_TAG}"
+          echo "::notice::Dispatched server@dev ${IMAGE_TAG} (${SHA}) — logs: https://github.com/zkldi/server-ceres/actions/workflows/tachi-deploy.yml"