NuklearRabbit
6859249570
Backend CI had ruff/mypy static checks and a real pip-audit-equivalent was missing; frontend already had npm audit, so backend was the only side of this repo without any dependency-vulnerability gate (partial coverage). Adds trivy-action fs scoped to backend/, HIGH/CRITICAL only, consistent with this security programme's gate convention elsewhere. Verified clean (0 HIGH/CRITICAL) against backend/pyproject.toml before wiring in, so the gate does not immediately fail CI.
50 lines
1.5 KiB
YAML
50 lines
1.5 KiB
YAML
name: MobilityOps acceptance
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
|
|
jobs:
|
|
backend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Backend tests in isolated PostgreSQL stack
|
|
run: sh scripts/run-isolated-tests.sh
|
|
- name: Backend static checks
|
|
run: |
|
|
docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --build --rm api ruff check app tests scripts
|
|
docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm api mypy app
|
|
- name: Backend dependency vulnerability scan (HIGH/CRITICAL)
|
|
uses: aquasecurity/trivy-action@0.30.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: backend
|
|
format: table
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "1"
|
|
ignore-unfixed: true
|
|
- name: Remove CI stack
|
|
if: always()
|
|
run: docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans
|
|
|
|
frontend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- name: Install locked dependencies
|
|
working-directory: frontend
|
|
run: npm ci --no-audit --no-fund
|
|
- name: Typecheck and production build
|
|
working-directory: frontend
|
|
run: npm run build
|
|
- name: Dependency audit
|
|
working-directory: frontend
|
|
run: npm audit
|