Skip to content
CI/CD Pipeline

fix(api): stop test-runs/count from preloading and discarding every run (#138) #693

Sign in to view logs

fix(api): stop test-runs/count from preloading and discarding every run (#138)

fix(api): stop test-runs/count from preloading and discarding every run (#138) #693

Workflow file for this run

.github/workflows/ci.yml at 84e6afa
name: CI/CD Pipeline
on:
push:
branches: [ main ]
tags: [ 'v*' ]
paths-ignore:
- '.github/CODEOWNERS'
- '.github/SECURITY.md'
- '.slsa-goreleaser/**'
- '.gitignore'
- 'docs/**'
- '**.md'
pull_request:
branches: [ main ]
paths-ignore:
- '.github/CODEOWNERS'
- '.github/SECURITY.md'
- '.slsa-goreleaser/**'
- '.gitignore'
- 'docs/**'
- '**.md'
# NOTE: If your enterprise restricts GITHUB_TOKEN permissions,
# create a Personal Access Token (PAT) with 'repo' and 'write:packages' scopes
# and add it as a secret named 'GH_PAT'
env:
GO_VERSION: '1.26'
DAGGER_VERSION: '0.18.14'
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
lint:
name: Lint Code
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- name: Set up Go
uses: actions/setup-go@v6
with:
go-version: ${{ env.GO_VERSION }}
- name: Download dependencies
run: go mod download
- name: Install mockgen
run: go install github.com/golang/mock/mockgen@v1.6.0
- name: Generate mocks
run: go generate ./...
- uses: dagger/dagger-for-github@8.0.0
with:
version: ${{ env.DAGGER_VERSION }}
verb: call
module: ./ci
args: lint --source .
test:
name: Run Tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- name: Set up Go
uses: actions/setup-go@v6
with:
go-version: ${{ env.GO_VERSION }}
- name: Install mockgen
run: go install github.com/golang/mock/mockgen@v1.6.0
- name: Add Go bin to PATH
run: echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
- name: Download dependencies
run: go mod download
- uses: dagger/dagger-for-github@8.0.0
with:
version: ${{ env.DAGGER_VERSION }}
verb: call
module: ./ci
args: test --source .
- name: Run JS client tests
run: node web/js/graphql-client-test.js
- name: Run tests with coverage
run: |
go test -race -coverprofile=coverage.txt -covermode=atomic ./...
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v5
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./coverage.txt
flags: unittests
name: codecov-umbrella
fail_ci_if_error: false
web-v2:
# v2 SPA (Vite + React + TypeScript) lives at web-v2/. Its built
# output is embedded into the Go binary via //go:embed all:dist,
# so the Go test/build jobs above don't catch a broken TypeScript
# source — the pre-checked-in dist/ keeps embedding cleanly. This
# job is the source-side safety net: typecheck, lint, unit tests,
# production build, and a schema-drift check between the GraphQL
# SDL the Go backend exposes and the copy web-v2 codegen consumes.
#
# No untrusted user input flows into run: blocks. The only ${{ }}
# expression is github.workspace, which is GitHub-controlled.
name: Web v2 (typecheck · lint · test · build · schema check)
runs-on: ubuntu-latest
timeout-minutes: 15
# Read-only token: this job only checks out and builds. Keeps the
# blast radius minimal if a dependency in the build is compromised.
permissions:
contents: read
steps:
# Actions pinned to full commit SHAs (not moving tags) so an action
# owner cannot silently repoint a tag at malicious code in our runner.
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
with:
persist-credentials: false
- name: GraphQL schema drift check
# Backend SDL is the source of truth; web-v2 keeps a synced
# copy so its codegen produces typed clients. Fail loudly if
# they ever diverge.
run: |
diff -q internal/reporter/graphql/schema.graphql \
web-v2/src/gql/schema.graphql \
|| { echo "::error::GraphQL schema drift between backend and web-v2 copy. Sync the two files."; exit 1; }
- uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
with:
version: 9
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '20'
cache: 'pnpm'
cache-dependency-path: web-v2/pnpm-lock.yaml
- name: Install dependencies
working-directory: web-v2
run: pnpm install --frozen-lockfile
- name: Typecheck
working-directory: web-v2
run: pnpm typecheck
- name: Lint
working-directory: web-v2
run: pnpm lint
- name: Unit tests
working-directory: web-v2
run: pnpm test:run
- name: Build production bundle
working-directory: web-v2
run: pnpm build
security-scan:
name: Security Scan (Trivy)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: dagger/dagger-for-github@8.0.0
with:
version: ${{ env.DAGGER_VERSION }}
verb: call
module: ./ci
args: security-scan --source .
vulnerability-check:
name: Go Vulnerability Check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- name: Set up Go
uses: actions/setup-go@v6
with:
go-version: ${{ env.GO_VERSION }}
- name: Install govulncheck
run: go install golang.org/x/vuln/cmd/govulncheck@v1.3.0
- name: Run govulncheck
run: |
# Advisory-only: || true prevents blocking merges on vulnerabilities in indirect
# dependencies that have no available fix. Remove once all transitive CVEs are cleared.
govulncheck ./cmd/... ./internal/... ./pkg/... || true
dependency-review:
name: Dependency Review
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
steps:
- uses: actions/checkout@v5
- uses: actions/dependency-review-action@v4.7.1
with:
fail-on-severity: moderate
# Allow-list of advisories confined to the web-v2 dev/build/test
# toolchain (babel, esbuild, vite, ws, lodash, form-data, immutable,
# js-yaml — pulled via graphql-codegen / jsdom / vite). None reach the
# shipped production bundle (verified: no runtime dependency path), and
# several have no in-place patch on the pinned major (e.g. vite's
# server.fs.deny fix lands only in 6.x). fail-on-scopes can't filter
# these because GitHub's dependency graph carries no dev/runtime scope
# for the pnpm lockfile. Runtime deps stay fully enforced at moderate+.
# Revisit when the web-v2 toolchain is upgraded.
allow-ghsas: GHSA-4x5r-pxfx-6jf8,GHSA-67mh-4wv8-2f99,GHSA-hmw2-7cc7-3qxx,GHSA-wf6x-7x77-mvgw,GHSA-h67p-54hq-rp68,GHSA-r5fr-rjxr-66jc,GHSA-f23m-r3pf-42rh,GHSA-4w7w-66w2-5vf9,GHSA-v6wh-96g9-6wx3,GHSA-fx2h-pf6j-xcff,GHSA-96hv-2xvq-fx4p,GHSA-v56q-mh7h-f735,GHSA-xvcm-6775-5m9r
build:
name: Build Images
runs-on: ubuntu-latest
# For PRs, only run a single build test. For main/tags, build all platforms
strategy:
matrix:
platform: ${{ github.event_name == 'pull_request' && fromJson('["linux/amd64"]') || fromJson('["linux/amd64", "linux/arm64"]') }}
steps:
- uses: actions/checkout@v5
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Cache Docker layers
uses: actions/cache@v4
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-buildx-${{ github.sha }}
restore-keys: |
${{ runner.os }}-buildx-
- uses: dagger/dagger-for-github@8.0.0
with:
version: ${{ env.DAGGER_VERSION }}
verb: call
module: ./ci
args: build --source . --platforms ${{ matrix.platform }}
all-checks:
name: All Checks (Main Branch)
runs-on: ubuntu-latest
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v5
- uses: dagger/dagger-for-github@8.0.0
with:
version: ${{ env.DAGGER_VERSION }}
verb: call
module: ./ci
args: all --source .
upload-main-coverage:
name: Upload Coverage (main)
runs-on: ubuntu-latest
permissions:
contents: read
if: github.event.repository.fork == false && github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v4
with:
persist-credentials: false
- uses: actions/setup-go@v5
with:
go-version: ${{ env.GO_VERSION }}
- run: go test -race -coverprofile=coverage.txt -covermode=atomic ./...
# codecov/codecov-action v5.1.2 (pinned for security)
- uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./coverage.txt
flags: unittests
name: main-coverage
fail_ci_if_error: false