JensandClaude Fable 5
a830e8a2d0
The first real platform runs (2026-08-17, new instance runner) failed at 'Unable to resolve 0.30.0: reference not found' - the tag exists only as v0.30.0. Where present, the trufflehog GitHub Action (which fails under the act runner) is replaced by the pinned trufflehog binary in filesystem mode next to gitleaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
103 lines
3.5 KiB
YAML
103 lines
3.5 KiB
YAML
name: MobilityOps acceptance
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
|
|
jobs:
|
|
backend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Secret scan
|
|
uses: trufflesecurity/trufflehog@v3.79.0
|
|
with:
|
|
path: ./
|
|
extra_args: --only-verified
|
|
- name: Backend tests in isolated PostgreSQL stack
|
|
run: sh scripts/run-isolated-tests.sh
|
|
- name: Backend static checks
|
|
run: |
|
|
docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --build --rm api ruff check app tests scripts
|
|
docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm api mypy app
|
|
- name: Backend dependency vulnerability scan (HIGH/CRITICAL)
|
|
uses: aquasecurity/trivy-action@v0.30.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: backend
|
|
format: table
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "1"
|
|
ignore-unfixed: true
|
|
- name: Remove CI stack
|
|
if: always()
|
|
run: docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans
|
|
|
|
frontend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- name: Install locked dependencies
|
|
working-directory: frontend
|
|
run: npm ci --no-audit --no-fund
|
|
- name: Lint (tsc + ESLint with react-hooks and jsx-a11y)
|
|
working-directory: frontend
|
|
run: npm run lint
|
|
- name: Typecheck and production build
|
|
working-directory: frontend
|
|
run: npm run build
|
|
- name: Dependency audit
|
|
working-directory: frontend
|
|
run: npm audit --audit-level=high
|
|
|
|
e2e:
|
|
# The five-minute Playwright demo is part of the definition of done
|
|
# (docs/14-testing-and-acceptance.md); run it against the real Compose stack.
|
|
runs-on: ubuntu-latest
|
|
needs: [backend, frontend]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- name: Start the demo stack
|
|
run: |
|
|
cp .env.example .env
|
|
docker compose -p mobilityops-e2e up --build -d db api web
|
|
for attempt in $(seq 1 60); do
|
|
if curl -fsS http://localhost:1228/health/ready >/dev/null 2>&1; then break; fi
|
|
sleep 2
|
|
done
|
|
curl -fsS http://localhost:1228/health/ready
|
|
docker compose -p mobilityops-e2e exec -T api python -m app.cli seed --reset
|
|
- name: Install Playwright
|
|
working-directory: frontend
|
|
run: |
|
|
npm ci --no-audit --no-fund
|
|
npx playwright install --with-deps chromium
|
|
- name: Run browser acceptance suite
|
|
working-directory: frontend
|
|
env:
|
|
MOBILITYOPS_PUBLIC_URL: http://localhost:1228
|
|
run: npx playwright test
|
|
- name: Upload Playwright report
|
|
if: failure()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: playwright-report
|
|
path: frontend/playwright-report
|
|
- name: Stack logs on failure
|
|
if: failure()
|
|
run: docker compose -p mobilityops-e2e logs --tail=200 api web
|
|
- name: Remove e2e stack
|
|
if: always()
|
|
run: docker compose -p mobilityops-e2e down -v --remove-orphans
|