feat!: simplify hack to a local-first core

.github/workflows/ci.yml

@@ -19,6 +19,43 @@ jobs:
       - name: Gitleaks scan
         uses: gacts/gitleaks@v1
 
+  runtime-images:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: "1.3.9"
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Install dependencies
+        run: bun install
+      - name: Build full runtime image
+        run: |
+          bun run scripts/build-node-runtime-image.ts \
+            --variant node-runtime \
+            --platform linux/amd64 \
+            --tag hack-runtime-ci:full
+      - name: Smoke full runtime image
+        run: |
+          docker run --rm --entrypoint hack hack-runtime-ci:full --help >/tmp/hack-full-help.txt
+          grep -q "hack" /tmp/hack-full-help.txt
+      - name: Build slim runtime image
+        run: |
+          bun run scripts/build-node-runtime-image.ts \
+            --variant slim \
+            --platform linux/amd64 \
+            --tag hack-runtime-ci:slim
+      - name: Smoke slim runtime image defaults
+        run: |
+          docker run --rm --entrypoint sh hack-runtime-ci:slim -lc 'command -v bun >/dev/null && command -v hack >/dev/null && test "${HACK_EXECUTION_MODE}" = "codex" && test "${HACK_DAEMON_DISABLE_DOCKER_EVENTS}" = "1" && test "${HACK_SETUP_SYNC_MODE}" = "warn" && hack --help >/tmp/hack-help.txt && grep -q "Usage:" /tmp/hack-help.txt'
+      - name: Smoke slim runtime mounted-project env flow
+        run: bash scripts/portable-container-smoke.sh hack-runtime-ci:slim linux/amd64
+
   test:
     runs-on: macos-14
     steps:

.github/workflows/release-node-runtime-image.yml

@@ -1,4 +1,4 @@
-name: Publish Node Runtime Image
+name: Publish Runtime Images
 
 on:
   workflow_dispatch:
@@ -35,6 +35,13 @@ jobs:
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v3
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Login to GHCR
         uses: docker/login-action@v3
         with:
@@ -64,31 +71,47 @@ jobs:
             exit 1
           fi
 
-          IMAGE="ghcr.io/${{ github.repository_owner }}/hack-node-runtime"
-          TAG_ARGS="--tag ${IMAGE}:${VERSION}"
+          DOCKERHUB_IMAGE="docker.io/hackdance/hack"
+          GHCR_IMAGE="ghcr.io/${{ github.repository_owner }}/hack"
+          FULL_TAG_ARGS="--tag ${DOCKERHUB_IMAGE}:${VERSION} --tag ${GHCR_IMAGE}:${VERSION}"
+          SLIM_TAG_ARGS="--tag ${DOCKERHUB_IMAGE}:${VERSION}-slim --tag ${GHCR_IMAGE}:${VERSION}-slim"
           if [ "${EVENT_NAME}" = "push" ] || [ "${INPUT_INCLUDE_LATEST}" = "true" ]; then
-            TAG_ARGS="${TAG_ARGS} --tag ${IMAGE}:latest"
+            FULL_TAG_ARGS="${FULL_TAG_ARGS} --tag ${DOCKERHUB_IMAGE}:latest --tag ${GHCR_IMAGE}:latest"
+            SLIM_TAG_ARGS="${SLIM_TAG_ARGS} --tag ${DOCKERHUB_IMAGE}:slim --tag ${GHCR_IMAGE}:slim"
           fi
 
           {
             echo "version=${VERSION}"
-            echo "image=${IMAGE}"
-            echo "tag_args=${TAG_ARGS}"
+            echo "dockerhub_image=${DOCKERHUB_IMAGE}"
+            echo "ghcr_image=${GHCR_IMAGE}"
+            echo "full_tag_args=${FULL_TAG_ARGS}"
+            echo "slim_tag_args=${SLIM_TAG_ARGS}"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Build and push node runtime image
+      - name: Build and push full runtime image
+        run: |
+          bun run scripts/build-node-runtime-image.ts \
+            --variant node-runtime \
+            --push \
+            --platform linux/amd64,linux/arm64 \
+            ${{ steps.tags.outputs.full_tag_args }}
+
+      - name: Build and push slim runtime image
         run: |
           bun run scripts/build-node-runtime-image.ts \
+            --variant slim \
             --push \
             --platform linux/amd64,linux/arm64 \
-            ${{ steps.tags.outputs.tag_args }}
+            ${{ steps.tags.outputs.slim_tag_args }}
 
       - name: Summary
         run: |
           {
-            echo "### Node runtime image published"
+            echo "### Runtime images published"
             echo ""
-            echo "- Image: \`${{ steps.tags.outputs.image }}\`"
             echo "- Version: \`${{ steps.tags.outputs.version }}\`"
-            echo "- Tags: \`${{ steps.tags.outputs.tag_args }}\`"
+            echo "- Docker Hub repo: \`${{ steps.tags.outputs.dockerhub_image }}\`"
+            echo "- GHCR repo: \`${{ steps.tags.outputs.ghcr_image }}\`"
+            echo "- Full tags: \`${{ steps.tags.outputs.full_tag_args }}\`"
+            echo "- Slim tags: \`${{ steps.tags.outputs.slim_tag_args }}\`"
           } >> "$GITHUB_STEP_SUMMARY"

.hack/docker-compose.yml

@@ -10,48 +10,6 @@ services:
     networks:
       - default
 
-  web:
-    image: imbios/bun-node:latest
-    working_dir: /app
-    volumes:
-      - ..:/app
-      - node_modules:/app/node_modules
-    depends_on:
-      deps:
-        condition: service_completed_successfully
-    command: bun run --cwd apps/web dev -- --hostname 0.0.0.0 --port 3000
-    environment:
-      CHOKIDAR_USEPOLLING: "true"
-      WATCHPACK_POLLING: "true"
-    labels:
-      caddy: "hack-cli.hack, hack-cli.hack.gy"
-      caddy.reverse_proxy: "{{upstreams 3000}}"
-      caddy.tls: internal
-    networks:
-      - hack-dev
-      - default
-
-  auth-broker:
-    image: imbios/bun-node:latest
-    working_dir: /app
-    volumes:
-      - ..:/app
-      - node_modules:/app/node_modules
-    depends_on:
-      deps:
-        condition: service_completed_successfully
-    command: bun run --cwd services/auth-broker start
-    environment:
-      PORT: "8080"
-      HOST: "0.0.0.0"
-    labels:
-      caddy: "auth.hack-cli.hack, auth.hack-cli.hack.gy"
-      caddy.reverse_proxy: "{{upstreams 8080}}"
-      caddy.tls: internal
-    networks:
-      - hack-dev
-      - default
-
 networks:
   hack-dev:
     external: true

.hack/hack.env.remote.yaml

@@ -2,14 +2,4 @@ version: 1
 environment: remote
 secretsprovider: project_key
 values:
-  web:
-    HACK_AUTH_BROKER_URL: https://auth.hack.broker
-    NEXT_PUBLIC_HACK_AUTH_BROKER_URL: https://auth.hack.broker
-  auth-broker:
-    AUTH_BROKER_PUBLIC_BASE_URL: https://auth.hack.broker
-    BETTER_AUTH_URL: https://auth.hack.broker
-    # Broker custom GitHub OAuth callback for Hack-owned flows.
-    # Better Auth browser social login uses:
-    #   ${BETTER_AUTH_URL}/api/auth/callback/github
-    GITHUB_REDIRECT_URI: https://auth.hack.broker/gh/callback
-    HACK_LINEAR_REDIRECT_URI: https://auth.hack.broker/linear/callback
+  global: {}