JensandClaude Fable 5
36f41ba43a
The first real platform runs (2026-08-17, new instance runner) failed at 'Unable to resolve 0.30.0: reference not found' - the tag exists only as v0.30.0. Where present, the trufflehog GitHub Action (which fails under the act runner) is replaced by the pinned trufflehog binary in filesystem mode next to gitleaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
90 lines
2.6 KiB
YAML
90 lines
2.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.13"
|
|
- name: Install uv
|
|
run: python -m pip install --disable-pip-version-check uv==0.10.0
|
|
- name: Sync locked dependencies
|
|
run: uv sync --frozen --all-groups
|
|
- name: Install Chromium for mandatory browser tests
|
|
run: uv run playwright install --with-deps chromium
|
|
- name: Secret scan
|
|
uses: trufflesecurity/trufflehog@v3.79.0
|
|
with:
|
|
path: ./
|
|
extra_args: --only-verified
|
|
- name: Scan project dependencies and lockfiles (high/critical)
|
|
uses: aquasecurity/trivy-action@v0.30.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
format: table
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "1"
|
|
ignore-unfixed: true
|
|
- name: Verify repository
|
|
env:
|
|
DJANGO_SECRET_KEY: ci-only-not-production-secret
|
|
DJANGO_DEBUG: "1"
|
|
DATABASE_URL: ""
|
|
CELERY_TASK_ALWAYS_EAGER: "1"
|
|
IMAP_ENABLED: "0"
|
|
OLLAMA_ENABLED: "0"
|
|
run: ./scripts/codex_verify.sh
|
|
- name: Upload browser failure artifacts
|
|
if: failure()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: browser-failure-artifacts
|
|
path: artifacts/browser-tests/
|
|
if-no-files-found: ignore
|
|
|
|
container:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
needs: quality
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Build production image
|
|
run: docker build --pull --tag vacatureradar:ci .
|
|
- name: Scan container image for high/critical vulnerabilities
|
|
uses: aquasecurity/trivy-action@v0.30.0
|
|
with:
|
|
image-ref: vacatureradar:ci
|
|
format: table
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "1"
|
|
ignore-unfixed: true
|
|
- name: Generate CycloneDX software bill of materials
|
|
uses: aquasecurity/trivy-action@v0.30.0
|
|
with:
|
|
image-ref: vacatureradar:ci
|
|
format: cyclonedx
|
|
output: vacatureradar-sbom.cdx.json
|
|
scan-type: image
|
|
- name: Upload software bill of materials
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: vacatureradar-sbom
|
|
path: vacatureradar-sbom.cdx.json
|
|
- name: Inspect image configuration
|
|
run: docker image inspect vacatureradar:ci > /tmp/image-inspect.json
|