mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 23:41:33 +02:00
jwinterm
611e02e4de
- shared build_router() (lib) so main + tests exercise identical wiring - tests/common: spins the real router + AppState against TEST_DATABASE_URL; self-skips when unset (cargo test stays green without a DB). Deterministic, non-secret test JWT/peppers; ephemeral generated identities only — no funded or sensitive wallet seeds (those stay in a separate gitignored L3 harness). - tests/db_queries: validates migrations + db layer against real Postgres (peppered identity lookups, UNIQUE->409, session create/lookup/revoke, key upsert/list/delete, restore-attempt counts). - tests/auth_flow: HTTP flows through the real router (health, auth gate, refresh rotation + old-token revocation, username set+lookup, key register+ fetch, NIP-05 directory). - CI: new integration job with an ephemeral postgres:16 service. - 82 tests total (69 unit + 13 integration), all green against live PG. Complements the monorepo's client-side suite (it tests the wire format the client sends; the client tests the wallet side); mirrors its secret-handling (env-driven, gitignored). Mirrors the L0-L5 tiering from docs/engineering.
83 lines
2.4 KiB
YAML
83 lines
2.4 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
|
|
jobs:
|
|
secret-scan:
|
|
name: secret scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: key / seed material
|
|
run: ./tools/secret-scan.sh
|
|
- name: gitleaks (full history)
|
|
run: |
|
|
curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.18.4/gitleaks_8.18.4_linux_x64.tar.gz \
|
|
| tar -xz gitleaks
|
|
sudo mv gitleaks /usr/local/bin/
|
|
gitleaks detect --no-banner --redact --source .
|
|
|
|
openapi-drift:
|
|
name: openapi drift gate
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- name: Regenerate the spec; fail if it drifts from committed openapi.json
|
|
run: |
|
|
cargo run --quiet --bin gen_openapi > /tmp/openapi.json
|
|
diff openapi.json /tmp/openapi.json
|
|
|
|
rust:
|
|
name: fmt / clippy / build / test / doc-test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
components: rustfmt, clippy
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo fmt --all -- --check
|
|
- run: cargo clippy --all-targets -- -D warnings
|
|
- run: cargo build --all-targets --locked
|
|
- run: cargo test --locked
|
|
- run: cargo test --doc
|
|
|
|
integration:
|
|
name: integration (postgres)
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: postgres:16
|
|
env:
|
|
POSTGRES_USER: smirk
|
|
POSTGRES_PASSWORD: smirk
|
|
POSTGRES_DB: smirk_test
|
|
ports: ['5432:5432']
|
|
options: >-
|
|
--health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
|
|
env:
|
|
# Fundless L1 harness: a throwaway DB. The harness sets its own non-secret
|
|
# test JWT/peppers internally.
|
|
TEST_DATABASE_URL: postgres://smirk:smirk@localhost:5432/smirk_test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
- uses: Swatinem/rust-cache@v2
|
|
- run: cargo test --locked --test auth_flow --test db_queries
|
|
|
|
supply-chain:
|
|
name: cargo-deny
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: EmbarkStudios/cargo-deny-action@v2
|