116 lines
4.8 KiB
YAML
116 lines
4.8 KiB
YAML
name: Managed validation
|
|
|
|
on:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
profile:
|
|
description: Allowlisted validation profile
|
|
required: true
|
|
default: full
|
|
type: choice
|
|
options: [test, lint, typecheck, build, security, full]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
full:
|
|
name: full
|
|
# Public fork code must never execute automatically on the private runner.
|
|
if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 40
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Select validation profile
|
|
shell: bash
|
|
env:
|
|
REQUESTED_PROFILE: ${{ inputs.profile }}
|
|
run: |
|
|
set -euo pipefail
|
|
profile="${REQUESTED_PROFILE:-full}"
|
|
case "$profile" in
|
|
test|lint|typecheck|build|security|full) ;;
|
|
*) echo "Profile is not allowlisted" >&2; exit 2 ;;
|
|
esac
|
|
echo "PROFILE=$profile" >> "$GITHUB_ENV"
|
|
- name: Repository boundaries
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
git diff --check
|
|
if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
|
|
echo "Unresolved merge markers detected" >&2
|
|
exit 1
|
|
fi
|
|
# Checkout recreates only `origin`; restore the documented upstream
|
|
# identity required by the fork-boundary guard. The pinned baseline
|
|
# tag is already part of this repository, so no upstream fetch occurs.
|
|
git remote add upstream https://gitlab.com/CalcProgrammer1/OpenRGB.git
|
|
bash scripts/openrgb-upstream-guard.sh
|
|
- name: Backend environment
|
|
if: "env.PROFILE != 'security'"
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
python3 -m venv "$RUNNER_TEMP/lumaops-python"
|
|
"$RUNNER_TEMP/lumaops-python/bin/python" -m pip install --disable-pip-version-check -e 'lumaops/backend[dev]'
|
|
- name: Backend tests
|
|
if: "env.PROFILE == 'test' || env.PROFILE == 'full'"
|
|
run: |
|
|
"$RUNNER_TEMP/lumaops-python/bin/python" -m pytest lumaops/backend/tests
|
|
- name: Backend lint
|
|
if: "env.PROFILE == 'lint' || env.PROFILE == 'full'"
|
|
run: |
|
|
"$RUNNER_TEMP/lumaops-python/bin/python" -m ruff check lumaops/backend
|
|
- name: Backend typecheck
|
|
if: "env.PROFILE == 'typecheck' || env.PROFILE == 'full'"
|
|
working-directory: lumaops/backend
|
|
run: |
|
|
"$RUNNER_TEMP/lumaops-python/bin/python" -m mypy src
|
|
- name: Frontend dependencies
|
|
if: "env.PROFILE != 'security'"
|
|
working-directory: lumaops/frontend
|
|
run: npm ci --ignore-scripts
|
|
- name: Frontend tests
|
|
if: "env.PROFILE == 'test' || env.PROFILE == 'full'"
|
|
working-directory: lumaops/frontend
|
|
run: npm test
|
|
- name: Frontend lint
|
|
if: "env.PROFILE == 'lint' || env.PROFILE == 'full'"
|
|
working-directory: lumaops/frontend
|
|
run: npm run lint
|
|
- name: Frontend build
|
|
if: "env.PROFILE == 'build' || env.PROFILE == 'typecheck' || env.PROFILE == 'full'"
|
|
working-directory: lumaops/frontend
|
|
run: npm run build
|
|
- name: Dependency audit
|
|
if: "env.PROFILE == 'security' || env.PROFILE == 'full'"
|
|
working-directory: lumaops/frontend
|
|
run: npm audit --omit=dev --audit-level=moderate
|
|
- name: Secret scan
|
|
if: "env.PROFILE == 'security' || env.PROFILE == 'full'"
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "$(uname -m)" == "x86_64" ]] || { echo "Unsupported Gitleaks runner architecture" >&2; exit 1; }
|
|
gitleaks_version="8.30.0"
|
|
gitleaks_archive="gitleaks_${gitleaks_version}_linux_x64.tar.gz"
|
|
gitleaks_sha256="79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e"
|
|
gitleaks_dir="${RUNNER_TEMP}/gitleaks-${gitleaks_version}"
|
|
mkdir -p "${gitleaks_dir}"
|
|
curl --proto '=https' --tlsv1.2 --fail --location --silent --show-error \
|
|
--retry 3 --output "${RUNNER_TEMP}/${gitleaks_archive}" \
|
|
"https://github.com/gitleaks/gitleaks/releases/download/v${gitleaks_version}/${gitleaks_archive}"
|
|
echo "${gitleaks_sha256} ${RUNNER_TEMP}/${gitleaks_archive}" | sha256sum --check --strict
|
|
tar -xzf "${RUNNER_TEMP}/${gitleaks_archive}" -C "${gitleaks_dir}" gitleaks
|
|
"${gitleaks_dir}/gitleaks" version
|
|
"${gitleaks_dir}/gitleaks" git . --config .gitleaks.toml --redact --no-banner
|