Initial public release

2026-08-31 21:56:53 +02:00
commit faeb58ef6d
1386 changed files with 263203 additions and 0 deletions
@@ -0,0 +1,87 @@
+name: Managed validation
+
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: Allowlisted validation profile
+        required: true
+        default: full
+        type: choice
+        options: [test, lint, typecheck, build, security, full]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  full:
+    # Gitea Actions does not consistently evaluate the GitHub-style `||`
+    # expression for pull-request runs without workflow inputs.
+    name: Managed repository validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.11"
+          cache: pip
+          cache-dependency-path: backend/requirements-ci.lock
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "20"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - name: Validate the requested profile against the real projects
+        shell: bash
+        env:
+          REQUESTED_PROFILE: ${{ inputs.profile }}
+        run: |
+          set -euo pipefail
+          profile="${REQUESTED_PROFILE:-full}"
+          case "${profile}" in
+            test|lint|typecheck|build|security|full) ;;
+            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
+          esac
+
+          git diff --check
+          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
+            echo "Unresolved merge markers detected" >&2
+            exit 1
+          fi
+          python scripts/verify_repository_layout.py
+
+          python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
+          python -m pip install --disable-pip-version-check --no-deps -e backend
+          (cd frontend && npm ci)
+
+          case "${profile}" in
+            test)
+              (cd backend && python -m pytest -W error::DeprecationWarning)
+              (cd frontend && npm run test:unit)
+              ;;
+            lint)
+              python -m ruff check backend scripts tests
+              (cd frontend && npm run lint --if-present)
+              ;;
+            typecheck)
+              (cd frontend && npm run typecheck)
+              ;;
+            build)
+              python -m compileall backend/app
+              (cd frontend && npm run build)
+              ;;
+            security)
+              python -m pip install --disable-pip-version-check pip-audit==2.10.1
+              bash scripts/audit_python_dependencies.sh
+              (cd frontend && npm audit --audit-level=high)
+              ;;
+            full)
+              PYTHON_BIN=python bash scripts/run_readiness_check.sh
+              ;;
+          esac