110 lines
3.6 KiB
YAML
110 lines
3.6 KiB
YAML
name: Managed validation
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- 'codex/**'
|
|
- 'chatgpt/**'
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
profile:
|
|
description: Allowlisted validation profile
|
|
required: true
|
|
default: full
|
|
type: choice
|
|
options: [test, lint, typecheck, build, security, full]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
full:
|
|
name: full
|
|
if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
env:
|
|
CI: 'true'
|
|
DATABASE_URL: postgresql://devrunbook:ci-only-password@postgres:5432/devrunbook
|
|
PUBLIC_BASE_URL: http://127.0.0.1:3000
|
|
SESSION_SECRET: ci-only-session-secret-01234567890123456789
|
|
INTEGRATION_ENCRYPTION_KEY: Y2ktb25seS1lbmNyeXB0aW9uLWtleS0wMDAwMDAwMDA=
|
|
INTEGRATION_ENCRYPTION_KEY_VERSION: ci-v1
|
|
CONTENT_ROOT: ${{ gitea.workspace }}/content
|
|
ARTIFACT_ROOT: /tmp/devrunbook-artifacts
|
|
BOOTSTRAP_TOKEN: ci-only-bootstrap-token
|
|
services:
|
|
postgres:
|
|
image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
|
|
env:
|
|
POSTGRES_DB: devrunbook
|
|
POSTGRES_USER: devrunbook
|
|
POSTGRES_PASSWORD: ci-only-password
|
|
options: >-
|
|
--health-cmd "pg_isready -U devrunbook -d devrunbook"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: 24.18.0
|
|
- name: Validate exact DevRunbook contracts
|
|
shell: bash
|
|
env:
|
|
REQUESTED_PROFILE: ${{ inputs.profile }}
|
|
run: |
|
|
set -euo pipefail
|
|
profile="${REQUESTED_PROFILE:-full}"
|
|
case "${profile}" in
|
|
test|lint|typecheck|build|security|full) ;;
|
|
*) echo "Profile is not allowlisted" >&2; exit 2 ;;
|
|
esac
|
|
|
|
git diff --check
|
|
if git grep -nE '^(<<<<<<< |>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
|
|
echo "Unresolved merge markers detected" >&2
|
|
exit 1
|
|
fi
|
|
|
|
corepack enable
|
|
corepack prepare pnpm@10.33.0 --activate
|
|
pnpm config set store-dir /tmp/devrunbook-pnpm-store
|
|
pnpm install --frozen-lockfile
|
|
python3 -m venv /tmp/devrunbook-validation-venv
|
|
. /tmp/devrunbook-validation-venv/bin/activate
|
|
python -m pip install --disable-pip-version-check --requirement scripts/requirements-validate.txt
|
|
mkdir -p "${ARTIFACT_ROOT}"
|
|
|
|
if [[ "${profile}" == lint ]]; then
|
|
pnpm format:check
|
|
pnpm lint
|
|
elif [[ "${profile}" == typecheck ]]; then
|
|
pnpm typecheck
|
|
elif [[ "${profile}" == test ]]; then
|
|
pnpm test
|
|
python3 scripts/validate_pack.py
|
|
python3 scripts/reference_compose.py --check
|
|
pnpm db:migrate
|
|
pnpm test:integration
|
|
elif [[ "${profile}" == build ]]; then
|
|
pnpm build
|
|
elif [[ "${profile}" == security ]]; then
|
|
pnpm db:migrate
|
|
pnpm test:security
|
|
pnpm audit --prod --audit-level high
|
|
else
|
|
pnpm verify
|
|
pnpm db:migrate
|
|
pnpm test:integration
|
|
pnpm test:security
|
|
pnpm audit --prod --audit-level high
|
|
fi
|