47 lines
1.5 KiB
YAML
47 lines
1.5 KiB
YAML
name: Quality gates
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
test-build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm test
|
|
- run: npm run build
|
|
- name: Install browser for acceptance checks
|
|
run: npx playwright install --with-deps chromium
|
|
- run: npm run qa:browser
|
|
|
|
container:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Validate production compose definition
|
|
run: AUTH_SECRET=ci-placeholder docker compose -f docker-compose.production.yml config --quiet
|
|
- name: Build production image
|
|
run: docker build --tag ihaleist:ci .
|
|
- name: Validate nginx configuration
|
|
run: docker run --rm ihaleist:ci nginx -t
|
|
- name: Audit default runtime dependencies
|
|
run: docker run --rm ihaleist:ci npm audit --omit=dev --audit-level=high
|
|
- name: Validate container health
|
|
run: |
|
|
set -eu
|
|
cid=$(docker run -d -p 18080:80 -e NODE_ENV=production -e AUTH_SECRET=$(openssl rand -hex 32) ihaleist:ci)
|
|
cleanup() { docker rm -f "$cid" >/dev/null 2>&1 || true; }
|
|
trap cleanup EXIT
|
|
for attempt in $(seq 1 30); do
|
|
if curl --fail --silent http://127.0.0.1:18080/api/ready; then exit 0; fi
|
|
sleep 1
|
|
done
|
|
echo 'Container health endpoint did not become ready' >&2
|
|
exit 1
|