DataShield/.github/workflows/ci.yml at main · WhiteMuush/DataShield · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Least privilege by default for every job in this workflow.
permissions:
  contents: read

# A newer push on the same ref cancels the in-flight run.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    name: Quality (lint, types, schema)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      # Dummy value so loading prisma.config.ts never fails on a missing var.
      DATABASE_URL: postgresql://ci:ci@localhost:5432/ci
    steps:
      - uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Lint (zero warnings allowed)
        run: npm run lint -- --max-warnings 0

      - name: Type check
        run: npx tsc --noEmit

      - name: Validate Prisma schema
        run: npx prisma validate

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      # Dummy value so loading prisma.config.ts never fails on a missing var.
      DATABASE_URL: postgresql://ci:ci@localhost:5432/ci
    steps:
      - uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Unit tests
        run: npm test

  build:
    name: Build
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      # Placeholders: the build must never depend on real secrets.
      DATABASE_URL: postgresql://ci:ci@localhost:5432/ci
      DIRECTORY_ENCRYPTION_KEY: ci-placeholder-encryption-key-32-chars-minimum
      AUTH_SECRET: ci-placeholder-auth-secret
    steps:
      - uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Build
        run: npm run build

  e2e:
    name: E2E smoke
    runs-on: ubuntu-latest
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: ci
          POSTGRES_PASSWORD: ci
          POSTGRES_DB: datashield
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U ci -d datashield"
          --health-interval 3s
          --health-timeout 3s
          --health-retries 20
    env:
      DATABASE_URL: postgresql://ci:ci@localhost:5432/datashield
      AUTH_SECRET: ci-placeholder-auth-secret
      AUTH_URL: http://localhost:3000
      DIRECTORY_ENCRYPTION_KEY: ci-placeholder-encryption-key-32-chars-minimum
    steps:
      - uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Apply migrations
        run: npx prisma migrate deploy

      - name: Seed admin account
        run: npx tsx prisma/seed.ts

      - name: Seed e2e fixtures
        run: npx tsx e2e/seed.ts

      - name: Build
        run: npm run build

      - name: Install chromium
        run: npx playwright install --with-deps chromium

      - name: Smoke test
        run: npx playwright test

  # Aggregate gate required by the main branch protection rule.
  # Reports the "ci" status check, green only when all gates pass.
  ci:
    name: ci
    runs-on: ubuntu-latest
    needs: [quality, test, build, e2e]
    steps:
      - run: echo "Quality, test, build and e2e gates passed."