128 lines
4.2 KiB
YAML
128 lines
4.2 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
env:
|
|
CI: 'true'
|
|
DATABASE_URL: postgresql://devrunbook:ci-only-password@localhost:5432/devrunbook
|
|
PUBLIC_BASE_URL: http://127.0.0.1:3000
|
|
SESSION_SECRET: ci-only-session-secret-01234567890123456789
|
|
INTEGRATION_ENCRYPTION_KEY: Y2ktb25seS1lbmNyeXB0aW9uLWtleS0wMDAwMDAwMDA=
|
|
INTEGRATION_ENCRYPTION_KEY_VERSION: ci-v1
|
|
CONTENT_ROOT: ${{ github.workspace }}/content
|
|
ARTIFACT_ROOT: ${{ runner.temp }}/devrunbook-artifacts
|
|
BOOTSTRAP_TOKEN: ci-only-bootstrap-token
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: 24.18.0
|
|
- name: Enable pinned pnpm
|
|
run: corepack enable && corepack prepare pnpm@10.33.0 --activate
|
|
- name: Verify runtime contract
|
|
run: pnpm check:runtime
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Install pinned validation dependencies
|
|
run: python3 -m pip install --disable-pip-version-check --requirement scripts/requirements-validate.txt
|
|
- name: Run canonical verification
|
|
run: pnpm verify
|
|
|
|
service-backed-gates:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 20
|
|
services:
|
|
postgres:
|
|
image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
|
|
env:
|
|
POSTGRES_DB: devrunbook
|
|
POSTGRES_USER: devrunbook
|
|
POSTGRES_PASSWORD: ci-only-password
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U devrunbook -d devrunbook"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: 24.18.0
|
|
- name: Enable pinned pnpm
|
|
run: corepack enable && corepack prepare pnpm@10.33.0 --activate
|
|
- name: Verify runtime contract
|
|
run: pnpm check:runtime
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Create artifact directory
|
|
run: mkdir -p "$ARTIFACT_ROOT"
|
|
- name: Apply migrations
|
|
run: pnpm db:migrate
|
|
- name: Run integration tests
|
|
run: pnpm test:integration
|
|
- name: Run security tests
|
|
run: pnpm test:security
|
|
|
|
browser-gate:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 25
|
|
services:
|
|
postgres:
|
|
image: postgres:17.9-bookworm@sha256:47f917f7409eacd22fc5dfb1dee634e1b55cf0c01d1a7eb701be2227a03e0641
|
|
env:
|
|
POSTGRES_DB: devrunbook
|
|
POSTGRES_USER: devrunbook
|
|
POSTGRES_PASSWORD: ci-only-password
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U devrunbook -d devrunbook"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 10
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: 24.18.0
|
|
- name: Enable pinned pnpm
|
|
run: corepack enable && corepack prepare pnpm@10.33.0 --activate
|
|
- name: Verify runtime contract
|
|
run: pnpm check:runtime
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Install Chromium runtime
|
|
run: pnpm exec playwright install --with-deps chromium
|
|
- name: Prepare application state
|
|
run: mkdir -p "$ARTIFACT_ROOT" && pnpm db:migrate
|
|
- name: Run browser tests
|
|
run: pnpm test:e2e
|
|
- name: Upload browser diagnostics
|
|
if: failure()
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: playwright-report
|
|
path: |
|
|
playwright-report/
|
|
test-results/
|
|
if-no-files-found: ignore
|
|
retention-days: 7
|