55 lines
1.6 KiB
YAML
55 lines
1.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Install frontend deps
|
|
run: pnpm install --frozen-lockfile=false
|
|
- name: Install backend deps
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y --no-install-recommends fonts-dejavu-core
|
|
pip install -r apps/api/requirements-dev.txt
|
|
- name: Sync WESP UI parity
|
|
run: bash scripts/materialize-wesp-static.sh
|
|
- name: Lint
|
|
run: pnpm lint
|
|
- name: Types
|
|
run: pnpm typecheck
|
|
- name: Mypy
|
|
working-directory: apps/api
|
|
run: python -m mypy app
|
|
- name: Frontend tests with coverage
|
|
run: pnpm --filter web test:ci
|
|
- name: Backend tests with coverage
|
|
working-directory: apps/api
|
|
run: python -m pytest --cov=app --cov-fail-under=90
|
|
- name: Security scan (python deps)
|
|
run: pip-audit
|
|
- name: Bandit scan
|
|
run: bandit -q -r apps/api/app
|
|
- name: Security scan (node deps)
|
|
run: pnpm audit --audit-level high
|
|
- name: Gitleaks scan
|
|
run: docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:latest detect --source=/repo --no-git -v
|
|
- name: Install Playwright browsers
|
|
run: pnpm --filter web exec playwright install chromium
|
|
- name: E2E smoke
|
|
run: pnpm --filter web e2e
|