mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 15:31:38 +02:00
jwinterm
864724085c
New console-drift job rebuilds admin-ui from the lockfile (npm ci) and fails if the committed admin-ui/dist drifts. rust-embed bakes dist into the binary, so a stale dist ships an old console; this mirrors the openapi-drift gate. Pinned to Node 22 (the version that built the committed bundle) so the byte-diff is deterministic.
103 lines
3.1 KiB
YAML
103 lines
3.1 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: secret scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: key / seed material
|
|
run: ./tools/secret-scan.sh
|
|
- name: gitleaks (full history)
|
|
run: |
|
|
curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz \
|
|
| tar -xz gitleaks
|
|
sudo mv gitleaks /usr/local/bin/
|
|
gitleaks detect --no-banner --redact --source .
|
|
|
|
openapi-drift:
|
|
name: openapi drift gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Regenerate the spec; fail if it drifts from committed openapi.json
|
|
run: |
|
|
cargo run --quiet --bin gen_openapi > /tmp/openapi.json
|
|
diff openapi.json /tmp/openapi.json
|
|
|
|
console-drift:
|
|
name: operator console drift gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
# Rebuild the admin-ui bundle from source (npm ci = reproducible from the
|
|
# lockfile) and fail if the committed admin-ui/dist drifts. rust-embed bakes
|
|
# dist into the server binary, so a stale dist would silently ship an old
|
|
# console. Same guarantee the openapi-drift job gives the API client.
|
|
- name: Rebuild admin-ui; fail if dist drifts from committed
|
|
working-directory: admin-ui
|
|
run: |
|
|
npm ci
|
|
npm run build
|
|
- name: git diff (dist must be committed and current)
|
|
run: git diff --exit-code -- admin-ui/dist
|
|
|
|
rust:
|
|
name: fmt / clippy / build / test / doc-test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: rustfmt, clippy
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo fmt --all -- --check
|
|
- run: cargo clippy --all-targets -- -D warnings
|
|
- run: cargo build --all-targets --locked
|
|
- run: cargo test --locked
|
|
- run: cargo test --doc
|
|
|
|
integration:
|
|
name: integration (postgres)
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
env:
|
|
POSTGRES_USER: smirk
|
|
POSTGRES_PASSWORD: smirk
|
|
POSTGRES_DB: smirk_test
|
|
ports: ['5432:5432']
|
|
options: >-
|
|
--health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
|
|
env:
|
|
# Fundless L1 harness: a throwaway DB. The harness sets its own non-secret
|
|
# test JWT/peppers internally.
|
|
TEST_DATABASE_URL: postgres://smirk:smirk@localhost:5432/smirk_test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo test --locked --test auth_flow --test db_queries
|
|
|
|
supply-chain:
|
|
name: cargo-deny
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: EmbarkStudios/cargo-deny-action@v2
|