Publish DevRunbook source

2026-09-03 04:09:17 +02:00
commit cfd2804e27
928 changed files with 161642 additions and 0 deletions
@@ -0,0 +1,109 @@
+name: Managed validation
+
+on:
+  push:
+    branches:
+      - main
+      - 'codex/**'
+      - 'chatgpt/**'
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: Allowlisted validation profile
+        required: true
+        default: full
+        type: choice
+        options: [test, lint, typecheck, build, security, full]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  full:
+    name: full
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      CI: 'true'
+      DATABASE_URL: postgresql://devrunbook:ci-only-password@postgres:5432/devrunbook
+      PUBLIC_BASE_URL: http://127.0.0.1:3000
+      SESSION_SECRET: ci-only-session-secret-01234567890123456789
+      INTEGRATION_ENCRYPTION_KEY: Y2ktb25seS1lbmNyeXB0aW9uLWtleS0wMDAwMDAwMDA=
+      INTEGRATION_ENCRYPTION_KEY_VERSION: ci-v1
+      CONTENT_ROOT: ${{ gitea.workspace }}/content
+      ARTIFACT_ROOT: /tmp/devrunbook-artifacts
+      BOOTSTRAP_TOKEN: ci-only-bootstrap-token
+    services:
+      postgres:
+        image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
+        env:
+          POSTGRES_DB: devrunbook
+          POSTGRES_USER: devrunbook
+          POSTGRES_PASSWORD: ci-only-password
+        options: >-
+          --health-cmd "pg_isready -U devrunbook -d devrunbook"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24.18.0
+      - name: Validate exact DevRunbook contracts
+        shell: bash
+        env:
+          REQUESTED_PROFILE: ${{ inputs.profile }}
+        run: |
+          set -euo pipefail
+          profile="${REQUESTED_PROFILE:-full}"
+          case "${profile}" in
+            test|lint|typecheck|build|security|full) ;;
+            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
+          esac
+
+          git diff --check
+          if git grep -nE '^(<<<<<<< |>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
+            echo "Unresolved merge markers detected" >&2
+            exit 1
+          fi
+
+          corepack enable
+          corepack prepare pnpm@10.33.0 --activate
+          pnpm config set store-dir /tmp/devrunbook-pnpm-store
+          pnpm install --frozen-lockfile
+          python3 -m venv /tmp/devrunbook-validation-venv
+          . /tmp/devrunbook-validation-venv/bin/activate
+          python -m pip install --disable-pip-version-check --requirement scripts/requirements-validate.txt
+          mkdir -p "${ARTIFACT_ROOT}"
+
+          if [[ "${profile}" == lint ]]; then
+            pnpm format:check
+            pnpm lint
+          elif [[ "${profile}" == typecheck ]]; then
+            pnpm typecheck
+          elif [[ "${profile}" == test ]]; then
+            pnpm test
+            python3 scripts/validate_pack.py
+            python3 scripts/reference_compose.py --check
+            pnpm db:migrate
+            pnpm test:integration
+          elif [[ "${profile}" == build ]]; then
+            pnpm build
+          elif [[ "${profile}" == security ]]; then
+            pnpm db:migrate
+            pnpm test:security
+            pnpm audit --prod --audit-level high
+          else
+            pnpm verify
+            pnpm db:migrate
+            pnpm test:integration
+            pnpm test:security
+            pnpm audit --prod --audit-level high
+          fi