Bounty Submission: Universal One-Click Deployment (Docker + K8s + Tilt) for FinMind

.do/app.yaml

@@ -0,0 +1,85 @@
+name: finmind
+region: nyc
+jobs:
+  - name: migrate
+    kind: PRE_DEPLOY
+    environment_slug: docker
+    dockerfile_path: packages/backend/Dockerfile
+    source_dir: /
+    git:
+      repo_clone_url: https://github.com/juzigu40-ui/FinMind.git
+      branch: codex/finmind-144-deploy-bounty
+      deploy_on_push: false
+    instance_count: 1
+    instance_size_slug: basic-xxs
+    run_command: python -m flask --app wsgi:app init-db
+    envs:
+      - key: DATABASE_URL
+        scope: RUN_TIME
+        value: ${finmind-db.DATABASE_URL}
+      - key: REDIS_URL
+        scope: RUN_TIME
+        value: ${finmind-redis.REDIS_URL}
+      - key: JWT_SECRET
+        scope: RUN_TIME
+        type: SECRET
+      - key: LOG_LEVEL
+        scope: RUN_TIME
+        value: INFO
+      - key: GEMINI_MODEL
+        scope: RUN_TIME
+        value: gemini-1.5-flash
+services:
+  - name: backend
+    environment_slug: docker
+    dockerfile_path: packages/backend/Dockerfile
+    source_dir: /
+    git:
+      repo_clone_url: https://github.com/juzigu40-ui/FinMind.git
+      branch: codex/finmind-144-deploy-bounty
+      deploy_on_push: false
+    http_port: 8000
+    instance_count: 1
+    instance_size_slug: basic-xxs
+    health_check:
+      http_path: /health/ready
+    envs:
+      - key: DATABASE_URL
+        scope: RUN_TIME
+        value: ${finmind-db.DATABASE_URL}
+      - key: REDIS_URL
+        scope: RUN_TIME
+        value: ${finmind-redis.REDIS_URL}
+      - key: JWT_SECRET
+        scope: RUN_TIME
+        type: SECRET
+      - key: LOG_LEVEL
+        scope: RUN_TIME
+        value: INFO
+      - key: GEMINI_MODEL
+        scope: RUN_TIME
+        value: gemini-1.5-flash
+      - key: CORS_ALLOWED_ORIGINS
+        scope: RUN_TIME
+        value: ${frontend.PUBLIC_URL}
+static_sites:
+  - name: frontend
+    git:
+      repo_clone_url: https://github.com/juzigu40-ui/FinMind.git
+      branch: codex/finmind-144-deploy-bounty
+      deploy_on_push: false
+    source_dir: app
+    build_command: npm ci && npm run build
+    output_dir: dist
+    envs:
+      - key: VITE_API_URL
+        scope: BUILD_TIME
+        value: ${backend.PUBLIC_URL}
+databases:
+  - name: finmind-db
+    engine: PG
+    production: false
+    version: "16"
+  - name: finmind-redis
+    engine: REDIS
+    production: false

.dockerignore

@@ -0,0 +1,10 @@
+.git
+.github
+app/dist
+app/node_modules
+packages/backend/.pytest_cache
+packages/backend/__pycache__
+packages/backend/app/__pycache__
+**/__pycache__
+**/*.pyc
+tmp

.env.example

@@ -7,11 +7,13 @@ JWT_SECRET="change-me"
 OPENAI_API_KEY=""
 GEMINI_API_KEY=""
 GEMINI_MODEL="gemini-1.5-flash"
+CORS_ALLOWED_ORIGINS="http://localhost:5173,http://127.0.0.1:5173,http://localhost:8081,http://127.0.0.1:8081,http://frontend,http://frontend:80"
 TWILIO_ACCOUNT_SID=""
 TWILIO_AUTH_TOKEN=""
 TWILIO_WHATSAPP_FROM=""
 EMAIL_FROM=""
 SMTP_URL=""
+MAX_UPLOAD_BYTES="10485760"
 
-VITE_API_URL="http://localhost:8000"
+VITE_API_URL=""
 LOG_LEVEL="INFO"

.github/workflows/deploy-artifacts.yml

@@ -0,0 +1,104 @@
+name: Deploy Artifacts
+
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - 'docker-compose.prod.yml'
+      - 'render.yaml'
+      - 'railway.toml'
+      - 'heroku.yml'
+      - 'app.json'
+      - 'netlify.toml'
+      - 'vercel.json'
+      - '.do/app.yaml'
+      - 'deploy/**'
+      - 'Tiltfile'
+      - 'scripts/review-deploy.sh'
+      - 'scripts/collect-review-artifacts.sh'
+      - 'scripts/smoke-deploy.py'
+      - 'scripts/validate-deploy.sh'
+      - 'scripts/validate-observability.sh'
+      - 'docs/demo/**'
+      - 'app/**'
+      - 'packages/backend/**'
+  pull_request:
+    paths:
+      - 'docker-compose.prod.yml'
+      - 'render.yaml'
+      - 'railway.toml'
+      - 'heroku.yml'
+      - 'app.json'
+      - 'netlify.toml'
+      - 'vercel.json'
+      - '.do/app.yaml'
+      - 'deploy/**'
+      - 'Tiltfile'
+      - 'scripts/review-deploy.sh'
+      - 'scripts/collect-review-artifacts.sh'
+      - 'scripts/smoke-deploy.py'
+      - 'scripts/validate-deploy.sh'
+      - 'scripts/validate-observability.sh'
+      - 'docs/demo/**'
+      - 'app/**'
+      - 'packages/backend/**'
+
+permissions:
+  contents: read
+
+jobs:
+  compose-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare env
+        run: cp .env.example .env
+
+      - name: Run full review path
+        run: FINMIND_REVIEW_KEEP_RUNNING=1 ./scripts/review-deploy.sh
+
+      - name: Collect review artifacts
+        run: ./scripts/collect-review-artifacts.sh .artifacts/review
+
+      - name: Upload review artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: finmind-review-artifacts
+          path: .artifacts/review
+
+      - name: Compose logs on failure
+        if: failure()
+        run: docker compose -f docker-compose.prod.yml --profile observability logs --no-color
+
+      - name: Shutdown compose
+        if: always()
+        run: docker compose -f docker-compose.prod.yml --profile observability down -v
+
+  helm-render:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Lint Helm chart
+        run: |
+          docker run --rm \
+            -v "$PWD":/work \
+            -w /work \
+            alpine/helm:3.16.2 \
+            lint deploy/helm/finmind
+
+      - name: Render Helm chart
+        run: |
+          docker run --rm \
+            -v "$PWD":/work \
+            -w /work \
+            alpine/helm:3.16.2 \
+            template finmind deploy/helm/finmind > /tmp/finmind-helm.yaml
+
+      - name: Ensure ingress and backend exist in rendered chart
+        run: |
+          grep -q "kind: Ingress" /tmp/finmind-helm.yaml
+          grep -q "name: finmind-backend" /tmp/finmind-helm.yaml
+          grep -q "name: finmind-prometheus" /tmp/finmind-helm.yaml
+          grep -q "name: finmind-grafana" /tmp/finmind-helm.yaml

.github/workflows/k8s-runtime.yml

@@ -0,0 +1,75 @@
+name: K8s Runtime
+
+on:
+  push:
+    branches: ["**"]
+    paths:
+      - 'Dockerfile.fullstack'
+      - 'deploy/helm/**'
+      - 'Tiltfile'
+      - 'scripts/review-k8s.sh'
+      - 'scripts/smoke-deploy.py'
+      - 'packages/backend/**'
+      - 'app/**'
+  pull_request:
+    paths:
+      - 'Dockerfile.fullstack'
+      - 'deploy/helm/**'
+      - 'Tiltfile'
+      - 'scripts/review-k8s.sh'
+      - 'scripts/smoke-deploy.py'
+      - 'packages/backend/**'
+      - 'app/**'
+
+permissions:
+  contents: read
+
+jobs:
+  kind-helm-runtime:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Kind
+        run: |
+          curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.24.0/kind-linux-amd64
+          chmod +x ./kind
+          sudo mv ./kind /usr/local/bin/kind
+
+      - name: Install Helm
+        run: |
+          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+
+      - name: Install Tilt
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/tilt-dev/tilt/master/scripts/install.sh | bash
+
+      - name: Run kind + Helm runtime review
+        env:
+          FINMIND_RUN_TILT_CI: "1"
+        run: ./scripts/review-k8s.sh
+
+      - name: Collect cluster diagnostics on failure
+        if: failure()
+        run: |
+          mkdir -p "$RUNNER_TEMP/k8s-diagnostics"
+          kubectl get all -A -o wide > "$RUNNER_TEMP/k8s-diagnostics/get-all.txt" || true
+          kubectl get events -A --sort-by=.metadata.creationTimestamp > "$RUNNER_TEMP/k8s-diagnostics/events.txt" || true
+          kubectl describe pods -n finmind > "$RUNNER_TEMP/k8s-diagnostics/describe-pods.txt" || true
+          kubectl describe jobs -n finmind > "$RUNNER_TEMP/k8s-diagnostics/describe-jobs.txt" || true
+          kubectl logs -n finmind job/finmind-migrate > "$RUNNER_TEMP/k8s-diagnostics/migrate.log" || true
+          helm status finmind -n finmind > "$RUNNER_TEMP/k8s-diagnostics/helm-status.txt" || true
+          helm test finmind -n finmind --logs > "$RUNNER_TEMP/k8s-diagnostics/helm-test.log" || true
+          tilt dump engine > "$RUNNER_TEMP/k8s-diagnostics/tilt-engine.txt" || true
+          tilt doctor > "$RUNNER_TEMP/k8s-diagnostics/tilt-doctor.txt" || true
+
+      - name: Upload K8s diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: k8s-runtime-diagnostics
+          path: ${{ runner.temp }}/k8s-diagnostics
+
+      - name: Delete kind cluster
+        if: always()
+        run: kind delete cluster --name finmind-review

.gitignore

@@ -33,15 +33,14 @@ logs/
 npm-debug.log*
 yarn-debug.log*
 pnpm-debug.log*
+output/
+tmp/
 plan.md
 checklist.md
 continuation_prompt.md
 deployment.md
 SESSION_SUMMARY.md
-
-docker-compose.prod.yml
-
 FEATURES.md
 
 create_issues.ps1
-bounty_issues.ps1
+bounty_issues.ps1