Publish ITWorx Pulse source

2026-09-03 02:09:19 +02:00
commit bd774932d5
614 changed files with 77116 additions and 0 deletions
@@ -0,0 +1,52 @@
+name: Public source validation
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: public-validation-${{ gitea.repository }}-${{ gitea.event_name }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version-file: go.mod
+          cache: true
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '24'
+          cache: pnpm
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: '10.33.0'
+      - run: go test ./... && go vet ./...
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm test && pnpm typecheck && pnpm lint && pnpm build
+      - name: Python contract and repository checks
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m venv "$RUNNER_TEMP/pulse-validation"
+          validation_python="$RUNNER_TEMP/pulse-validation/bin/python"
+          "$validation_python" -m pip install --disable-pip-version-check -r requirements-dev.txt
+          "$validation_python" tools/check_api_contract.py
+          "$validation_python" tools/validate_contracts.py
+          "$validation_python" tools/check_wiring.py
+          "$validation_python" tools/check_secrets.py
+      - run: bash deploy/verify-image-digests.sh
+      - name: Export reviewed public source
+        run: node scripts/export-public-source.mjs --output "$RUNNER_TEMP/pulse-public"
+      - name: Validate exported source manifest
+        run: cd "$RUNNER_TEMP/pulse-public" && node scripts/validate-public-source.mjs
+      - name: Dependency scan
+        run: sh scripts/run-trivy-fs-scan.sh "$RUNNER_TEMP/pulse-public"