[WIP] switch to yhub as a collab backend

.dockerignore

@@ -5,6 +5,10 @@ __pycache__
 **/*.pyc
 venv
 .venv
+# the pattern above only matches at the root, and every image is built from
+# there: without this one, the backend virtualenv travels to the daemon on
+# every build
+**/.venv
 
 # System-specific files
 .DS_Store
@@ -34,4 +38,7 @@ db.sqlite3
 
 # Frontend
 node_modules
+# same as .venv above: nested ones are not matched by the pattern above, and no
+# image copies them — every one of them runs its own install
+**/node_modules
 **/.next

.github/workflows/docker-hub.yml

@@ -60,11 +60,26 @@ jobs:
       should_push: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview') }}
       docker_user: 1001:127
 
+  build-and-push-yhub:
+    uses: ./.github/workflows/docker-publish.yml
+    permissions:
+      contents: read
+    secrets: inherit
+    with:
+      image_name: lasuite/impress-yhub
+      context: .
+      file: src/yhub-server/Dockerfile
+      target: yhub
+      should_push: ${{ github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview') }}
+      # no docker_user: the image defaults to uid 1000, the `node` user the
+      # base image already declares in /etc/passwd
+
   notify-argocd:
     needs:
       - build-and-push-backend
       - build-and-push-frontend
       - build-and-push-y-provider
+      - build-and-push-yhub
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'preview')
     steps:

.github/workflows/ghcr.yml

@@ -158,3 +158,50 @@ jobs:
         run: |
           docker system prune -af
           docker volume prune -f
+
+  build-and-push-yhub:
+    runs-on: ubuntu-latest
+    if: github.event.repository.fork == true
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ github.repository }}/yhub
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+      - name: Login to GHCR
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7
+        with:
+          context: .
+          file: ./src/yhub-server/Dockerfile
+          target: yhub
+          platforms: linux/amd64,linux/arm64
+          build-args: DOCKER_USER=${{ env.DOCKER_USER }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+      - name: Cleanup Docker after build
+        if: always()
+        run: |
+          docker system prune -af
+          docker volume prune -f

.github/workflows/impress.yml

@@ -27,10 +27,6 @@ jobs:
           fetch-depth: 0
       - name: show
         run: git log
-      - name: Enforce absence of print statements in code
-        if: always()
-        run: |
-          ! git diff origin/${{ github.event.pull_request.base.ref }}..HEAD -- src/backend ':(exclude)**/impress.yml' | grep "print("
       - name: Check absence of fixup commits
         if: always()
         run: |
@@ -132,6 +128,13 @@ jobs:
         # needed because the postgres container does not provide a healthcheck
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
 
+      # message stream for the collaboration server (see the yhub steps below)
+      valkey:
+        image: valkey/valkey:alpine
+        ports:
+          - 6379:6379
+        options: --health-cmd "valkey-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
+
     env:
       DJANGO_CONFIGURATION: Test
       DJANGO_SETTINGS_MODULE: impress.settings
@@ -146,6 +149,12 @@ jobs:
       AWS_S3_ENDPOINT_URL: http://localhost:9000
       AWS_S3_ACCESS_KEY_ID: impress
       AWS_S3_SECRET_ACCESS_KEY: password
+      # Collaboration server. The integration tests reach it over this url and
+      # skip themselves when nothing answers; yhub reads the JWKS back from the
+      # django server started alongside it, so both sides must share
+      # JWT_PRIVATE_KEY_FILE.
+      COLLABORATION_API_URL: http://localhost:3002/collaboration
+      JWT_PRIVATE_KEY_FILE: ${{ github.workspace }}/data/jwt/private.pem
 
     steps:
       - name: Checkout repository
@@ -207,8 +216,67 @@ jobs:
           sudo apt-get install -y gettext pandoc shared-mime-info
           sudo wget https://raw.githubusercontent.com/suitenumerique/django-lasuite/refs/heads/main/assets/conf/mime.types -O /etc/mime.types
 
+      # --- collaboration server -------------------------------------------
+      # The yhub integration tests drive a real collaboration server: it reads
+      # legacy documents out of MinIO and reads this backend's JWKS back to
+      # verify the admin token the tests mint, so the two must share the
+      # signing key. Tests skip themselves when nothing answers on
+      # COLLABORATION_API_URL.
+      - name: Generate the JWT signing key
+        working-directory: .
+        run: bin/generate-jwt-private-key.sh
+
       - name: Generate a MO file from strings extracted from the project
         run: uv run python manage.py compilemessages
 
+      - name: Set up Node
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: "22.x"
+
+      - name: Install the collaboration server
+        working-directory: src/yhub-server
+        run: npm ci --omit=dev
+
+      # yhub ships its own DDL and creates the database as well, so this needs
+      # the dependencies installed above — hence its place after them
+      - name: Create the collaboration server database
+        working-directory: src/yhub-server
+        env:
+          POSTGRES: postgres://dinum:pass@localhost:5432/yhub
+        run: npm run init-db
+
+      - name: Start the backend for the collaboration server to authenticate against
+        env:
+          DJANGO_ALLOWED_HOSTS: "*"
+        run: |
+          nohup uv run python manage.py runserver 0.0.0.0:8000 --noreload \
+            > /tmp/backend.log 2>&1 &
+          dockerize -wait http://localhost:8000/api/v1.0/jwks -timeout 60s
+
+      - name: Start the collaboration server
+        working-directory: src/yhub-server
+        env:
+          PORT: 3002
+          REDIS: redis://localhost:6379
+          POSTGRES: postgres://dinum:pass@localhost:5432/yhub
+          REDIS_PREFIX: yhub
+          COLLABORATION_BACKEND_BASE_URL: http://localhost:8000
+          COLLABORATION_SERVER_ORIGIN: http://localhost:3000
+          # the legacy Django bucket it migrates documents out of, named apart
+          # from the AWS_S3_* the job sets for django itself
+          SOFT_MIGRATION: "true"
+          LEGACY_S3_ENDPOINT_URL: http://localhost:9000
+          LEGACY_S3_ACCESS_KEY_ID: impress
+          LEGACY_S3_SECRET_ACCESS_KEY: password
+          LEGACY_S3_BUCKET_NAME: impress-media-storage
+        run: |
+          nohup node server.js > /tmp/yhub.log 2>&1 &
+          dockerize -wait tcp://localhost:3002 -timeout 30s
+
       - name: Run tests
         run: uv run pytest -n 2
+
+      - name: Collaboration server logs
+        if: failure()
+        run: cat /tmp/yhub.log /tmp/backend.log

.gitignore

@@ -47,6 +47,9 @@ env.d/terraform
 compose.override.yml
 docker/auth/*.local
 
+# yhub server local install
+src/yhub-server/node_modules/
+
 # npm
 node_modules
 
@@ -90,3 +93,4 @@ AGENTS.md
 .aider*
 .copilot/
 .github/copilot-instructions.md
+.playwright-mcp