milestone 9: react spa admin ui, frontend ci and embedded dist

.gitea/workflows/ci.yml

@@ -8,6 +8,7 @@ on:
 
 env:
   ZIG_VERSION: "0.16.0"
+  NODE_VERSION: "24"
 
 jobs:
   test:
@@ -24,6 +25,43 @@ jobs:
       - name: Run test suite (unit + hermetic loopback integration)
         run: zig build test -Dintegration
 
+  frontend:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+
+      - name: Install dependencies
+        working-directory: web
+        run: npm ci
+
+      - name: Check formatting
+        working-directory: web
+        run: npm run format:check
+
+      - name: Lint
+        working-directory: web
+        run: npm run lint
+
+      - name: Typecheck
+        working-directory: web
+        run: npm run typecheck
+
+      - name: Run tests
+        working-directory: web
+        run: npm test
+
+      - name: Build
+        working-directory: web
+        run: npm run build
+
   cross:
     runs-on: ubuntu-24.04
 
@@ -35,19 +73,42 @@ jobs:
         with:
           version: ${{ env.ZIG_VERSION }}
 
-      - name: Build static musl executables
-        run: zig build cross
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: web/package-lock.json
 
-      - name: Install file(1)
+      - name: Build the web UI
+        working-directory: web
         run: |
-          if ! command -v file >/dev/null 2>&1; then
+          npm ci
+          npm run build
+
+      # ReleaseSafe because the < 15 MB budget (PLAN §18) is for release
+      # binaries; a Debug build strips to ~25 MB and can never meet it.
+      - name: Build static musl executables
+        run: zig build cross -Dweb-dist=web/dist -Doptimize=ReleaseSafe
+
+      - name: Install file(1) and strip tooling
+        run: |
+          missing=""
+          command -v file >/dev/null 2>&1 || missing="$missing file"
+          command -v objcopy >/dev/null 2>&1 || missing="$missing binutils"
+          command -v aarch64-linux-gnu-objcopy >/dev/null 2>&1 || missing="$missing binutils-aarch64-linux-gnu"
+          if [ -n "$missing" ]; then
             sudo apt-get update -qq
-            sudo apt-get install -qq -y file
+            sudo apt-get install -qq -y $missing
           fi
 
-      - name: Assert executables exist and are statically linked
+      # The size budget applies to stripped binaries (PLAN §18) and
+      # `zig build cross` does not strip, so the assert measures a
+      # stripped copy and leaves the built artifact untouched.
+      - name: Assert executables are statically linked and within the size budget
         run: |
           set -euo pipefail
+          size_limit=$((15 * 1024 * 1024))
           for triple in x86_64-linux-musl aarch64-linux-musl; do
             binary="zig-out/cross/$triple/nxdns"
             if [ ! -f "$binary" ]; then
@@ -63,4 +124,15 @@ jobs:
                 exit 1
                 ;;
             esac
+            case "$triple" in
+              x86_64-*) strip_tool=objcopy ;;
+              aarch64-*) strip_tool=aarch64-linux-gnu-objcopy ;;
+            esac
+            "$strip_tool" --strip-all "$binary" "$binary.stripped"
+            size=$(stat -c %s "$binary.stripped")
+            echo "$triple: stripped size $size bytes"
+            if [ "$size" -ge "$size_limit" ]; then
+              echo "stripped executable exceeds the 15 MB budget: $binary"
+              exit 1
+            fi
           done