Add Home Assistant App runtime foundation

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
 
       - name: Shell syntax
         run: |
-          for script in scripts/proxmox/inkpanel-lxc.sh scripts/proxmox/files/inkpanel-update scripts/build-firmware.sh scripts/compile-mini-firmware.sh scripts/firmware-input-hash.sh; do
+          for script in scripts/proxmox/inkpanel-lxc.sh scripts/proxmox/files/inkpanel-update scripts/build-firmware.sh scripts/compile-mini-firmware.sh scripts/firmware-input-hash.sh scripts/verify-firmware-package.sh; do
             echo "checking $script"
             bash -n "$script"
           done
@@ -86,15 +86,7 @@ jobs:
         run: bash scripts/compile-mini-firmware.sh
 
       - name: Check published full-size and Mini firmware outputs
-        run: |
-          test -s firmware/dist/manifest.json
-          test -s firmware/dist/input.sha256
-          test -n "$(find firmware/dist -maxdepth 1 -name '*.bin' -type f -size +0c -print -quit)"
-          test -s firmware/dist/mini/manifest.json
-          test -n "$(find firmware/dist/mini -maxdepth 1 -name '*.bin' -type f -size +0c -print -quit)"
-          test "$(node -e "const m=require('./firmware/dist/manifest.json'); process.stdout.write(m.target)")" = "full"
-          test "$(node -e "const m=require('./firmware/dist/mini/manifest.json'); process.stdout.write(m.target)")" = "mini"
-          test "$(cat firmware/dist/input.sha256)" = "$(bash scripts/firmware-input-hash.sh)"
+        run: bash scripts/verify-firmware-package.sh
 
       - name: Check Mini validation package
         run: |

.github/workflows/home-assistant-image.yml

@@ -0,0 +1,177 @@
+name: Home Assistant App image
+
+on:
+  push:
+    branches: [Home-Assistant]
+    paths:
+      - Dockerfile.home-assistant
+      - home-assistant/**
+      - repository.yaml
+      - package*.json
+      - public/**
+      - arduino/**
+      - firmware/**
+      - scripts/build-firmware.sh
+      - scripts/compile-mini-firmware.sh
+      - scripts/firmware-input-hash.sh
+      - scripts/verify-firmware-package.sh
+      - scripts/home-assistant-start.mjs
+      - src/**
+      - .github/workflows/home-assistant-image.yml
+  pull_request:
+    branches: [main]
+    paths:
+      - Dockerfile.home-assistant
+      - home-assistant/**
+      - repository.yaml
+      - package*.json
+      - public/**
+      - arduino/**
+      - firmware/**
+      - scripts/build-firmware.sh
+      - scripts/compile-mini-firmware.sh
+      - scripts/firmware-input-hash.sh
+      - scripts/verify-firmware-package.sh
+      - scripts/home-assistant-start.mjs
+      - src/**
+      - .github/workflows/home-assistant-image.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+
+env:
+  IMAGE_NAME: inkpanel-home-assistant
+  VERSION: 0.1.0-ha.12
+  ARCHITECTURES: '["amd64", "aarch64"]'
+
+jobs:
+  init:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.prepare.outputs.matrix }}
+    steps:
+      - id: prepare
+        uses: home-assistant/builder/actions/prepare-multi-arch-matrix@4de35182ce1e329181bffcbcc84d33db5e2c7e10
+        with:
+          architectures: ${{ env.ARCHITECTURES }}
+          image-name: ${{ env.IMAGE_NAME }}
+          registry-prefix: ghcr.io/ctrlaltcouk
+
+  firmware:
+    name: Build production firmware packages
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Install Arduino CLI
+        uses: arduino/setup-arduino-cli@v2
+
+      - name: Cache Arduino ESP32 core
+        uses: actions/cache@v4
+        with:
+          path: ~/.arduino15
+          key: arduino-esp32-${{ runner.os }}-v1
+
+      - name: Install ESP32 board core
+        run: |
+          arduino-cli config init --overwrite --additional-urls https://raw.githubusercontent.com/espressif/arduino-esp32/gh-pages/package_esp32_index.json
+          arduino-cli core update-index
+          arduino-cli core install esp32:esp32
+
+      - name: Build production firmware packages
+        run: ./scripts/build-firmware.sh
+
+      - name: Verify full-size and Mini packages
+        run: bash scripts/verify-firmware-package.sh
+
+      - name: Upload production firmware packages
+        uses: actions/upload-artifact@v4
+        with:
+          name: inkpanel-production-firmware-${{ github.sha }}
+          path: firmware/dist/
+          if-no-files-found: error
+          retention-days: 1
+
+  build:
+    needs: [init, firmware]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJSON(needs.init.outputs.matrix) }}
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Download production firmware packages
+        uses: actions/download-artifact@v4
+        with:
+          name: inkpanel-production-firmware-${{ github.sha }}
+          path: firmware/dist
+
+      - name: Verify firmware build context
+        run: bash scripts/verify-firmware-package.sh
+
+      - uses: home-assistant/builder/actions/build-image@4de35182ce1e329181bffcbcc84d33db5e2c7e10
+        with:
+          image: ${{ matrix.image }}
+          arch: ${{ matrix.arch }}
+          version: ${{ env.VERSION }}
+          image-tags: ${{ env.VERSION }}
+          context: .
+          file: Dockerfile.home-assistant
+          push: ${{ github.event_name == 'push' }}
+          load: ${{ github.event_name == 'pull_request' }}
+          cosign: ${{ github.event_name == 'push' }}
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Verify firmware packages in pull-request image
+        if: github.event_name == 'pull_request'
+        env:
+          IMAGE_REF: ${{ matrix.image }}:${{ env.VERSION }}
+        run: |
+          expected_hash="$(bash scripts/firmware-input-hash.sh)"
+          docker run --rm --entrypoint bash "$IMAGE_REF" /app/scripts/verify-firmware-package.sh /app/firmware/dist "$expected_hash"
+          docker run --rm --entrypoint node "$IMAGE_REF" -e 'if (process.env.INKPANEL_HA_RELEASE !== process.argv[1]) process.exit(1)' '${{ env.VERSION }}'
+
+  publish:
+    if: github.event_name == 'push'
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: home-assistant/builder/actions/publish-multi-arch-manifest@4de35182ce1e329181bffcbcc84d33db5e2c7e10
+        with:
+          image-name: ${{ env.IMAGE_NAME }}
+          image-tags: ${{ env.VERSION }}
+          architectures: ${{ env.ARCHITECTURES }}
+          registry-prefix: ghcr.io/ctrlaltcouk
+          container-registry-password: ${{ secrets.GITHUB_TOKEN }}
+
+  inspect-published:
+    name: Inspect published Home Assistant App image
+    if: github.event_name == 'push'
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+
+      - name: Pull generic multi-architecture tag anonymously
+        env:
+          IMAGE_REF: ghcr.io/ctrlaltcouk/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
+        run: docker pull "$IMAGE_REF"
+
+      - name: Verify production firmware packages in published image
+        env:
+          IMAGE_REF: ghcr.io/ctrlaltcouk/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
+        run: |
+          expected_hash="$(bash scripts/firmware-input-hash.sh)"
+          docker run --rm --entrypoint bash "$IMAGE_REF" /app/scripts/verify-firmware-package.sh /app/firmware/dist "$expected_hash"
+          docker run --rm --entrypoint node "$IMAGE_REF" -e 'if (process.env.INKPANEL_HA_RELEASE !== process.argv[1]) process.exit(1)' '${{ env.VERSION }}'

Dockerfile.home-assistant

@@ -0,0 +1,32 @@
+# This version must match the Playwright package, as enforced by the existing
+# Docker regression test.
+FROM mcr.microsoft.com/playwright:v1.62.1-noble
+
+ARG BUILD_VERSION
+ARG BUILD_ARCH
+LABEL io.hass.version="${BUILD_VERSION}" \
+      io.hass.arch="${BUILD_ARCH}" \
+      io.hass.type="app"
+
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
+
+COPY . .
+
+ENV DATA_DIR=/data \
+    INKPANEL_HA_RELEASE=${BUILD_VERSION} \
+    PORT=8080 \
+    HTTPS_PORT=8443 \
+    HOME_ASSISTANT_MODE=1 \
+    HOME_ASSISTANT_INGRESS_PORT=8099 \
+    HOME_ASSISTANT_BASE_URL=http://supervisor/core/api
+
+VOLUME ["/data"]
+EXPOSE 8080 8443 8099
+
+HEALTHCHECK --interval=60s --timeout=5s --start-period=20s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:8080/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+CMD ["node", "scripts/home-assistant-start.mjs"]