To support automatic deployments while also supporting immediate integration of translatewiki translations (T408866) I decided to adopt a Gitlab-Flow-like workflow:

• Continue using the main branch for development, with feature branches as needed.
• Create a staging branch for release stabilization. This branch to be deployed automatically to our beta server.
• Create a production branch for the latest stable release. This branch to be deployed automatically to our production server.
• Translatewiki to pull and push from the production branch for immediate deployment of translation updates (T408866).

This way, the main branch is the integration branch and staging and production branches are environment branches (i.e., they reflect each of our staging and production deployment environments).

Both staging and production branches, like the main branch, configured as protected branches in GitLab branch rules.

Regarding automatic deployments, I considered Tool-paulina's .gitlab-ci.yml as base example and built from there.

Implemented with 8e1a9091:

• Created a .gitlab-ci.yml pipeline configuration file.
• Defined one single pipeline stage: deploy.
• Defined one hidden template job: deploy_template.
• Tagged the job as cloud to be picked up by one of the Cloud Runners using lightweight alpine image.
• The job sets up an SSH client environment (in before_script) and then connects to Toolforge, becomes the corresponding tool (w2c-beta or web2cit) and runs the instructions in a deploy.sh bash file created.
• Defined two specific jobs extending from the template job for staging and production branches and environments: deploy_staging and deploy_production. Used rules to decide which to run when.
• Using Toolforge jobs to install and build w2c-server because running toolforge webservice shell non-interactively doesn't seem possible.

The job connects to Toolforge using my account:

• Created a new SSH key pair with: ssh-keygen -t ed25519 -C "w2c-server-gitlab-ci" -f temp_key.
• Added the public key to my account as trusted key in https://toolsadmin.wikimedia.org/profile/settings/ssh-keys/
• Added the private key as a CI/CD project variable in Gitlab's w2c-server project.

Adding such a wide-scoped private key as a variable may not be the most secure. To strengthen security:

• Set variable as masked and hidden. Because variable masking and hiding is only available for strings without spaces, saved a base64 encoded version of the private key instead: base64 -w 0 temp_key.
• Made the variable available only to pipelines running on protected branches.
• Added security warning on the .gitlab-ci.yml file that changes to this file should be carefully considered as they may leak the key.

Created 1.5.0-rc.0 release for automatic deploy to w2c-beta:

• Merge changes from main into staging locally.
• Set new version as release candidate in package.json and package-lock.json: npm version --no-git-tag-version preminor --preid=rc
• Update changelog by moving unreleased changes to new version section, with release date as "Unreleased".
• Link new version section to 1.4.0...staging diff, and unreleased section to staging...main diff.
• Commit as "Release v1.5.0-rc.0", tag as "v1.5.0-rc.0" and pushed both.

Note that because new version depends on newest changes in Web2Cit-Core not yet released, the web2cit library was temporarily changed to install from a specific commit from git: git+https://gitlab.wikimedia.org/diegodlh/w2c-core.git#68733f2a

• Pending update Docs/Server.

Pending update Docs/Server.

Updated: https://meta.wikimedia.org/w/index.php?title=Web2Cit%2FDocs%2FServer&diff=30859609&oldid=30825040