86 lines
2.8 KiB
YAML
86 lines
2.8 KiB
YAML
name: Managed validation
|
|
|
|
on:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
profile:
|
|
description: Allowlisted validation profile
|
|
required: true
|
|
default: full
|
|
type: choice
|
|
options: [test, lint, typecheck, build, security, full]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
full:
|
|
name: ${{ inputs.profile || 'full' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
|
|
with:
|
|
python-version: "3.11"
|
|
cache: pip
|
|
cache-dependency-path: backend/requirements-ci.lock
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: "20"
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- name: Validate the requested profile against the real projects
|
|
shell: bash
|
|
env:
|
|
REQUESTED_PROFILE: ${{ inputs.profile }}
|
|
run: |
|
|
set -euo pipefail
|
|
profile="${REQUESTED_PROFILE:-full}"
|
|
case "${profile}" in
|
|
test|lint|typecheck|build|security|full) ;;
|
|
*) echo "Profile is not allowlisted" >&2; exit 2 ;;
|
|
esac
|
|
|
|
git diff --check
|
|
if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
|
|
echo "Unresolved merge markers detected" >&2
|
|
exit 1
|
|
fi
|
|
python scripts/verify_repository_layout.py
|
|
|
|
python -m pip install --disable-pip-version-check --require-hashes -r backend/requirements-ci.lock
|
|
python -m pip install --disable-pip-version-check --no-deps -e backend
|
|
(cd frontend && npm ci)
|
|
|
|
case "${profile}" in
|
|
test)
|
|
(cd backend && python -m pytest -W error::DeprecationWarning)
|
|
(cd frontend && npm run test:unit)
|
|
;;
|
|
lint)
|
|
python -m ruff check backend scripts tests
|
|
(cd frontend && npm run lint --if-present)
|
|
;;
|
|
typecheck)
|
|
(cd frontend && npm run typecheck)
|
|
;;
|
|
build)
|
|
python -m compileall backend/app
|
|
(cd frontend && npm run build)
|
|
;;
|
|
security)
|
|
python -m pip install --disable-pip-version-check pip-audit==2.10.1
|
|
bash scripts/audit_python_dependencies.sh
|
|
(cd frontend && npm audit --audit-level=high)
|
|
;;
|
|
full)
|
|
PYTHON_BIN=python bash scripts/run_readiness_check.sh
|
|
;;
|
|
esac
|