Establish secure account and managed AI backend

Provide the production foundation for Apple identity, immutable credits, referrals, integrity checks, managed providers, and hardened Docker deployment.
2026-08-16 14:46:23 +08:00
commit 0af35d44f4
124 changed files with 21052 additions and 0 deletions
@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "21"
+      - uses: gradle/actions/setup-gradle@v4
+      - name: Verify Docker for MySQL integration tests
+        run: docker info
+      - name: Validate production Compose
+        env:
+          APP_STORE_URL: https://apps.apple.com/app/id1234567890
+          DATABASE_URL: jdbc:mysql://mysql:3306/osg_account
+          DATABASE_USER: runtime
+          DATABASE_PASSWORD: runtime-password
+          DATABASE_MIGRATION_USER: migrator
+          DATABASE_MIGRATION_PASSWORD: migration-password
+          JWT_SECRET: 01234567890123456789012345678901
+          FIELD_ENCRYPTION_KEY: BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc=
+          IDENTITY_HMAC_KEY: CAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg=
+          APPLE_TEAM_ID: X329MZU23S
+          APPLE_KEY_ID: CI_KEY
+          APPLE_PRIVATE_KEY_PEM: ci-private-key-placeholder
+          VOLCENGINE_API_KEY: ci-volcengine-key
+          DEEPSEEK_API_KEY: ci-deepseek-key
+        run: docker compose -f compose.yaml config --quiet
+      - name: Test
+        run: ./gradlew --no-daemon clean test
+      - name: Build deployable JAR
+        run: ./gradlew --no-daemon buildFatJar
+      - name: Build container
+        run: docker build -t osg-account-server:ci .