156 lines
4.3 KiB
YAML
156 lines
4.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main, master]
|
|
pull_request:
|
|
branches: [main, master]
|
|
|
|
env:
|
|
GITEA_URL: https://git.example.com
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea-job-image
|
|
steps:
|
|
- name: Clone repo
|
|
run: |
|
|
rm -rf $GITHUB_WORKSPACE/*
|
|
git clone --recurse-submodules $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
|
|
git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
|
|
|
|
- name: Run ruff (Python lint)
|
|
if: always()
|
|
run: |
|
|
if [[ -f backend/requirements.txt ]]; then
|
|
pip3 install ruff
|
|
cd backend
|
|
ruff check app/ 2>/dev/null || true
|
|
else
|
|
echo "No Python project detected, skipping ruff"
|
|
fi
|
|
|
|
- name: Run npm lint (JS/TS)
|
|
if: always()
|
|
run: |
|
|
if [[ -f package.json ]]; then
|
|
npm ci
|
|
npm run lint --if-present || true
|
|
else
|
|
echo "No Node.js project detected, skipping npm lint"
|
|
fi
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea-job-image
|
|
defaults:
|
|
run:
|
|
working-directory: ${{ github.workspace }}
|
|
steps:
|
|
- name: Clone repo
|
|
run: |
|
|
rm -rf ${GITHUB_WORKSPACE:?}/*
|
|
git clone --recurse-submodules $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
|
|
git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
|
|
|
|
- name: Install Python deps
|
|
run: |
|
|
pip3 install --break-system-packages -r backend/requirements.txt
|
|
pip3 install --break-system-packages pytest pytest-cov httpx
|
|
|
|
- name: Run pytest (Python) with 90% coverage threshold
|
|
run: |
|
|
cd backend
|
|
python3 -m pytest tests/ -v --tb=short --cov=app --cov-report=term-missing --cov-fail-under=90 -W ignore::ResourceWarning
|
|
|
|
- name: Run npm test (JS/TS)
|
|
if: always()
|
|
run: |
|
|
if [[ -f package.json ]]; then
|
|
npm ci
|
|
npm run test --if-present || true
|
|
else
|
|
echo "No Node.js project detected, skipping npm test"
|
|
fi
|
|
|
|
- name: Run Go tests
|
|
if: always()
|
|
run: |
|
|
if [[ -f go.mod ]]; then
|
|
go test ./...
|
|
else
|
|
echo "No Go project detected, skipping go test"
|
|
fi
|
|
|
|
- name: Run Go tests
|
|
if: always()
|
|
run: |
|
|
if [[ -f go.mod ]]; then
|
|
go test ./...
|
|
else
|
|
echo "No Go project detected, skipping go test"
|
|
fi
|
|
|
|
docker-build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Clone repo
|
|
run: |
|
|
rm -rf $GITHUB_WORKSPACE/*
|
|
git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
|
|
git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
|
|
|
|
- name: Build Docker image
|
|
if: always()
|
|
run: |
|
|
if [[ -f backend/Dockerfile ]]; then
|
|
docker build -t $GITHUB_REPOSITORY:test ./backend
|
|
else
|
|
echo "No Dockerfile found, skipping docker build"
|
|
fi
|
|
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea-job-image
|
|
steps:
|
|
- name: Clone repo
|
|
run: |
|
|
rm -rf $GITHUB_WORKSPACE/*
|
|
git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
|
|
git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
|
|
|
|
- name: Run bandit (Python SAST)
|
|
if: always()
|
|
run: |
|
|
if [[ -f backend/requirements.txt ]]; then
|
|
pip3 install bandit
|
|
cd backend
|
|
bandit -r app/ --severity-level high --confidence-level high --exclude tests/,test_* 2>/dev/null || true
|
|
else
|
|
echo "No Python project detected, skipping bandit"
|
|
fi
|
|
|
|
- name: Run npm audit (JS/TS)
|
|
if: always()
|
|
run: |
|
|
if [[ -f package.json ]]; then
|
|
npm ci
|
|
npm audit --audit-level=high 2>/dev/null || echo "npm audit: vulnerabilities found (non-blocking)"
|
|
else
|
|
echo "No Node.js project detected, skipping npm audit"
|
|
fi
|
|
|
|
build-result:
|
|
needs: [lint, test, docker-build, security]
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gitea-job-image
|
|
if: always()
|
|
steps:
|
|
- name: Summary
|
|
run: echo "All CI checks completed"
|