NuklearRabbit
a9f48d6880
Backend job had static checks (ruff/mypy) and a dependency-vulnerability gate but no secret scan; frontend had a dependency audit but no secret scan either. Adds trufflehog once, on the backend job's full checkout, covering the whole repository - the last gap for this repo to count as fully-authored.
55 lines
1.7 KiB
YAML
55 lines
1.7 KiB
YAML
name: MobilityOps acceptance
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
|
|
jobs:
|
|
backend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Secret scan
|
|
uses: trufflesecurity/trufflehog@v3.79.0
|
|
with:
|
|
path: ./
|
|
extra_args: --only-verified
|
|
- name: Backend tests in isolated PostgreSQL stack
|
|
run: sh scripts/run-isolated-tests.sh
|
|
- name: Backend static checks
|
|
run: |
|
|
docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --build --rm api ruff check app tests scripts
|
|
docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml run --rm api mypy app
|
|
- name: Backend dependency vulnerability scan (HIGH/CRITICAL)
|
|
uses: aquasecurity/trivy-action@0.30.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: backend
|
|
format: table
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "1"
|
|
ignore-unfixed: true
|
|
- name: Remove CI stack
|
|
if: always()
|
|
run: docker compose -p mobilityops-ci -f compose.yaml -f compose.test.yaml down -v --remove-orphans
|
|
|
|
frontend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- name: Install locked dependencies
|
|
working-directory: frontend
|
|
run: npm ci --no-audit --no-fund
|
|
- name: Typecheck and production build
|
|
working-directory: frontend
|
|
run: npm run build
|
|
- name: Dependency audit
|
|
working-directory: frontend
|
|
run: npm audit
|