ci-cd

name: ci-cd description: Manage and extend the CI/CD pipeline (GitHub Actions, Docker, build scripts)

CI/CD Pipeline Manager

You help maintain and extend Theatrum's CI/CD infrastructure. Use $ARGUMENTS to specify what you need (e.g., /ci-cd add linting, /ci-cd fix failing workflow, /ci-cd add coverage).

Current Infrastructure

Before making changes, read the current CI/CD files:

• .github/workflows/ci.yml — GitHub Actions pipeline (test, build, release)
• Dockerfile — Multi-stage Docker build (Go builder + Alpine runtime with FFmpeg)
• scripts/local-build.sh — Local test + build script

GitHub Actions Workflow (ci.yml)

Triggers: All pushes and PRs to any branch.

Jobs:

1. test — go test ./... in src/ with Go 1.24
2. build — CGO_ENABLED=0 go build -o theatrum ./cmd/main.go
3. release — Only on push to main, after test+build pass. Cross-compiles for linux/amd64, linux/arm64, windows/amd64. Creates GitHub release via softprops/action-gh-release@v2 tagged latest.

Dockerfile

Multi-stage:

• Builder: golang:1.24.2, downloads deps, builds static binary
• Runtime: alpine:latest, installs ca-certificates tzdata ffmpeg, runs as non-root appuser, exposes port 8080

Local Build Script

scripts/local-build.sh: Runs tests then builds the binary. Uses set -euo pipefail.

What's Not Yet Configured

These are areas you can help add:

Rules When Modifying CI/CD

GitHub Actions

• Keep Go version consistent across all jobs (currently 1.24)
• Always use working-directory: src for Go commands (source is in src/)
• Use cache-dependency-path: src/go.sum for Go setup action
• Release job must depend on test + build: needs: [test, build]
• Release only on main: if: github.ref == 'refs/heads/main' && github.event_name == 'push'
• Use CGO_ENABLED=0 for static binaries

Dockerfile

• Keep multi-stage build pattern (builder + runtime)
• Runtime must include ffmpeg (required for live streaming)
• Run as non-root user (appuser)
• Binary name in Dockerfile is main, release binaries are theatrum-*
• Port 8080 for HTTP, port 1935 for RTMP (add EXPOSE 1935 if RTMP is needed)

Build Script

• Must run from repo root (script uses cd "$(dirname "$0")/../src")
• Always run tests before build
• Use set -euo pipefail for strict error handling

Common Tasks

Adding Linting

1. Create .golangci.yml at repo root with appropriate linters
2. Add a lint job to .github/workflows/ci.yml:

lint:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-go@v5
      with:
        go-version: "1.24"
        cache-dependency-path: src/go.sum
    - uses: golangci/golangci-lint-action@v6
      with:
        working-directory: src

Adding Code Coverage

Add to the test job:

- name: Run tests with coverage
  working-directory: src
  run: go test ./... -coverprofile=coverage.out -covermode=atomic

- name: Upload coverage
  uses: codecov/codecov-action@v4
  with:
    files: src/coverage.out

Adding Docker Build to CI

docker:
  needs: [test, build]
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: docker/setup-buildx-action@v3
    - uses: docker/build-push-action@v6
      with:
        push: false
        tags: theatrum:${{ github.sha }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

Verification

After any CI/CD change:

1. Check YAML syntax: python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))"
2. Verify Dockerfile builds: docker build -t theatrum:test .
3. Verify local script: bash scripts/local-build.sh
4. If adding a new job, ensure it has the right needs: dependencies
5. Check that secrets/permissions are correctly scoped