Publish LumaOps source

2026-09-03 01:18:36 +02:00
commit 7f1c0e5f71
2363 changed files with 501543 additions and 0 deletions
@@ -0,0 +1,115 @@
+name: Managed validation
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: Allowlisted validation profile
+        required: true
+        default: full
+        type: choice
+        options: [test, lint, typecheck, build, security, full]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  full:
+    name: full
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Select validation profile
+        shell: bash
+        env:
+          REQUESTED_PROFILE: ${{ inputs.profile }}
+        run: |
+          set -euo pipefail
+          profile="${REQUESTED_PROFILE:-full}"
+          case "$profile" in
+            test|lint|typecheck|build|security|full) ;;
+            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
+          esac
+          echo "PROFILE=$profile" >> "$GITHUB_ENV"
+      - name: Repository boundaries
+        shell: bash
+        run: |
+          set -euo pipefail
+          git diff --check
+          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
+            echo "Unresolved merge markers detected" >&2
+            exit 1
+          fi
+          # Checkout recreates only `origin`; restore the documented upstream
+          # identity required by the fork-boundary guard. The pinned baseline
+          # tag is already part of this repository, so no upstream fetch occurs.
+          git remote add upstream https://gitlab.com/CalcProgrammer1/OpenRGB.git
+          bash scripts/openrgb-upstream-guard.sh
+      - name: Backend environment
+        if: "env.PROFILE != 'security'"
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m venv "$RUNNER_TEMP/lumaops-python"
+          "$RUNNER_TEMP/lumaops-python/bin/python" -m pip install --disable-pip-version-check -e 'lumaops/backend[dev]'
+      - name: Backend tests
+        if: "env.PROFILE == 'test' || env.PROFILE == 'full'"
+        run: |
+          "$RUNNER_TEMP/lumaops-python/bin/python" -m pytest lumaops/backend/tests
+      - name: Backend lint
+        if: "env.PROFILE == 'lint' || env.PROFILE == 'full'"
+        run: |
+          "$RUNNER_TEMP/lumaops-python/bin/python" -m ruff check lumaops/backend
+      - name: Backend typecheck
+        if: "env.PROFILE == 'typecheck' || env.PROFILE == 'full'"
+        working-directory: lumaops/backend
+        run: |
+          "$RUNNER_TEMP/lumaops-python/bin/python" -m mypy src
+      - name: Frontend dependencies
+        if: "env.PROFILE != 'security'"
+        working-directory: lumaops/frontend
+        run: npm ci --ignore-scripts
+      - name: Frontend tests
+        if: "env.PROFILE == 'test' || env.PROFILE == 'full'"
+        working-directory: lumaops/frontend
+        run: npm test
+      - name: Frontend lint
+        if: "env.PROFILE == 'lint' || env.PROFILE == 'full'"
+        working-directory: lumaops/frontend
+        run: npm run lint
+      - name: Frontend build
+        if: "env.PROFILE == 'build' || env.PROFILE == 'typecheck' || env.PROFILE == 'full'"
+        working-directory: lumaops/frontend
+        run: npm run build
+      - name: Dependency audit
+        if: "env.PROFILE == 'security' || env.PROFILE == 'full'"
+        working-directory: lumaops/frontend
+        run: npm audit --omit=dev --audit-level=moderate
+      - name: Secret scan
+        if: "env.PROFILE == 'security' || env.PROFILE == 'full'"
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$(uname -m)" == "x86_64" ]] || { echo "Unsupported Gitleaks runner architecture" >&2; exit 1; }
+          gitleaks_version="8.30.0"
+          gitleaks_archive="gitleaks_${gitleaks_version}_linux_x64.tar.gz"
+          gitleaks_sha256="79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e"
+          gitleaks_dir="${RUNNER_TEMP}/gitleaks-${gitleaks_version}"
+          mkdir -p "${gitleaks_dir}"
+          curl --proto '=https' --tlsv1.2 --fail --location --silent --show-error \
+            --retry 3 --output "${RUNNER_TEMP}/${gitleaks_archive}" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${gitleaks_version}/${gitleaks_archive}"
+          echo "${gitleaks_sha256}  ${RUNNER_TEMP}/${gitleaks_archive}" | sha256sum --check --strict
+          tar -xzf "${RUNNER_TEMP}/${gitleaks_archive}" -C "${gitleaks_dir}" gitleaks
+          "${gitleaks_dir}/gitleaks" version
+          "${gitleaks_dir}/gitleaks" git . --config .gitleaks.toml --redact --no-banner