name: GeoIntel release gates on: push: branches: [main, develop, "codex/**", "build/**", "chatgpt/**"] pull_request: branches: [main, develop] workflow_dispatch: permissions: contents: read concurrency: group: geointel-release-${{ gitea.ref }} cancel-in-progress: true jobs: quality: name: Compile, test, contracts and builds runs-on: ubuntu-latest timeout-minutes: 45 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with: persist-credentials: false - name: Verified secret scan run: bash scripts/scan_secrets.sh - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 with: python-version: "3.11" cache: pip cache-dependency-path: backend/requirements-ci.lock - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 with: node-version: "20" cache: npm cache-dependency-path: frontend/package-lock.json - name: Install locked backend dependencies run: | python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock python -m pip install --disable-pip-version-check --no-deps -e backend - name: Install locked frontend dependencies working-directory: frontend run: npm ci - name: Verify dependency lock policy run: python scripts/verify_python_lock.py - name: Run complete release readiness gate env: PYTHON_BIN: python run: bash scripts/run_readiness_check.sh - name: Render migration and Compose evidence run: | mkdir -p artifacts cd backend python -m alembic upgrade head --sql > ../artifacts/alembic-upgrade.sql cd .. docker compose config > artifacts/docker-compose.resolved.yml - name: Publish quality evidence if: always() uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de with: name: quality-evidence path: | artifacts/alembic-upgrade.sql artifacts/docker-compose.resolved.yml if-no-files-found: warn retention-days: 30 dependency-audit: name: Python and npm vulnerability policy runs-on: ubuntu-latest timeout-minutes: 20 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with: persist-credentials: false - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 with: python-version: "3.11" cache: pip cache-dependency-path: backend/requirements-ci.lock - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 with: node-version: "20" cache: npm cache-dependency-path: frontend/package-lock.json - name: Audit locked Python dependencies run: | mkdir -p artifacts python -m pip install --disable-pip-version-check pip-audit==2.10.1 bash scripts/audit_python_dependencies.sh - name: Audit locked frontend dependencies working-directory: frontend run: | set +e npm ci install_status="$?" if [ "$install_status" -ne 0 ]; then exit "$install_status"; fi npm audit --audit-level=high --json | tee ../artifacts/npm-audit.json audit_status="${PIPESTATUS[0]}" set -e exit "$audit_status" - name: Publish dependency evidence if: always() uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de with: name: dependency-audits path: | artifacts/pip-audit-full.json artifacts/pip-audit-policy.json artifacts/npm-audit.json if-no-files-found: warn retention-days: 30 container-gis: name: GIS image, SBOM and container scan runs-on: ubuntu-latest timeout-minutes: 60 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with: persist-credentials: false - name: Build GIS release image env: RELEASE_SHA: ${{ gitea.sha }} run: | mkdir -p artifacts BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" docker build \ -f deploy/unraid/Dockerfile.all-in-one \ --build-arg GEOINTEL_INSTALL_AI=false \ --build-arg GEOINTEL_BUILD_SHA="$RELEASE_SHA" \ --build-arg GEOINTEL_BUILD_TIME="$BUILD_TIME" \ -t "geointel-ci:$RELEASE_SHA-gis" \ . docker image inspect "geointel-ci:$RELEASE_SHA-gis" > artifacts/image-inspect-gis.json - name: Generate GIS SPDX SBOM env: RELEASE_SHA: ${{ gitea.sha }} run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-gis" - name: Enforce GIS container vulnerability policy env: RELEASE_SHA: ${{ gitea.sha }} run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-gis" - name: Publish GIS container evidence if: always() uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de with: name: container-gis-evidence path: | artifacts/image-inspect-gis.json artifacts/geointel-sbom.spdx.json artifacts/geointel-container-vulnerabilities.json if-no-files-found: warn retention-days: 30 container-ai: name: AI image, SBOM and container scan if: ${{ gitea.event_name == 'pull_request' || gitea.ref == 'refs/heads/main' || gitea.event_name == 'workflow_dispatch' }} runs-on: ubuntu-latest timeout-minutes: 90 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 with: persist-credentials: false - name: Build AI release image env: RELEASE_SHA: ${{ gitea.sha }} run: | mkdir -p artifacts BUILD_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)" docker build \ -f deploy/unraid/Dockerfile.all-in-one \ --build-arg GEOINTEL_INSTALL_AI=true \ --build-arg GEOINTEL_BUILD_SHA="$RELEASE_SHA" \ --build-arg GEOINTEL_BUILD_TIME="$BUILD_TIME" \ -t "geointel-ci:$RELEASE_SHA-ai" \ . docker image inspect "geointel-ci:$RELEASE_SHA-ai" > artifacts/image-inspect-ai.json - name: Generate AI SPDX SBOM env: RELEASE_SHA: ${{ gitea.sha }} run: bash scripts/generate_container_sbom.sh "geointel-ci:$RELEASE_SHA-ai" - name: Enforce AI container vulnerability policy env: RELEASE_SHA: ${{ gitea.sha }} run: bash scripts/scan_container_image.sh "geointel-ci:$RELEASE_SHA-ai" - name: Publish AI container evidence if: always() uses: actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de with: name: container-ai-evidence path: | artifacts/image-inspect-ai.json artifacts/geointel-sbom.spdx.json artifacts/geointel-container-vulnerabilities.json if-no-files-found: warn retention-days: 30