Validate issuer/URL by scheme and host instead of string prefix (#62) #106
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| workflow_dispatch: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0 | |
| with: | |
| python-version: '3.14.2' | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 | |
| - name: Install dependencies (fails if uv.lock is out of sync) | |
| run: uv sync --locked --all-extras | |
| - name: Run linter | |
| run: make lint | |
| - name: Run tests | |
| run: make test-verbose | |
| docker-build: | |
| runs-on: ubuntu-latest | |
| services: | |
| # The image runs "alembic upgrade head" on startup (see start.sh), so the | |
| # smoke test needs a reachable database. | |
| postgres: | |
| image: postgres:18-alpine | |
| env: | |
| POSTGRES_USER: pia | |
| POSTGRES_PASSWORD: pia | |
| POSTGRES_DB: pia | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U pia -d pia" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 | |
| - name: Build and load image for testing | |
| uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 | |
| with: | |
| context: . | |
| platforms: linux/amd64 | |
| load: true | |
| tags: ${{ env.IMAGE_NAME }}:test | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Run Docker container | |
| run: | | |
| # --network host so the container reaches the postgres service via | |
| # localhost:5432 (the service port is published on the runner host). | |
| # With host networking the app is reachable at localhost:8000 directly. | |
| docker run -d \ | |
| --name pia-test \ | |
| --network host \ | |
| -e PIA_DEPENDENCY_TRACK_API_KEY=test-key \ | |
| -e PIA_DATABASE_URL=postgresql://pia:pia@localhost:5432/pia \ | |
| eclipse-csi/pia:test | |
| - name: Test API response | |
| run: | | |
| if ! timeout 30 bash -c 'until curl -fs http://localhost:8000/livez >/dev/null; do sleep 1; done'; then | |
| echo "API did not become healthy within 30s" | |
| docker logs pia-test | |
| exit 1 | |
| fi | |
| echo "API test passed: /livez responded" | |
| - name: Clean up | |
| run: | | |
| docker stop pia-test || true | |
| docker rm pia-test || true |