96 lines
5.0 KiB
YAML
96 lines
5.0 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
tests-and-images:
|
|
runs-on: akyldash-ci
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Run backend tests
|
|
run: PYTHONPATH=backend python3 -m unittest discover -s backend -p 'test_*.py' -v
|
|
- name: Run Telegram bot tests
|
|
run: python3 -m unittest discover -s tools/telegram-bot -p 'test_*.py' -v
|
|
- name: Run infrastructure backup tests
|
|
run: python3 -m unittest discover -s infra/backup -p 'test_*.py' -v
|
|
- name: Check root guard UID decisions
|
|
run: bash infra/bootstrap/test-root-guard.sh
|
|
- name: Check recovery host guard
|
|
run: bash infra/bootstrap/test-host-guard.sh
|
|
- name: Check verifier helper argument guard
|
|
run: bash infra/bootstrap/test-verify-helper.sh
|
|
- name: Check host audit root guard
|
|
run: bash infra/bootstrap/test-audit-host.sh
|
|
- name: Check Compose helper allowlist
|
|
run: bash infra/deploy/test-compose-helper.sh
|
|
- name: Check production config root guard
|
|
run: bash infra/deploy/test-production-config-guard.sh
|
|
- name: Check runner config and isolation guards
|
|
run: |
|
|
bash infra/runner/test-runner-config.sh
|
|
bash infra/runner/test-install-runner-idempotency.sh
|
|
bash infra/runner/test-install-runner-guard.sh
|
|
- name: Check CI container operation isolation
|
|
run: bash infra/runner/test-ci-container-builds.sh
|
|
- name: Check infrastructure shell syntax
|
|
run: |
|
|
bash -n infra/bootstrap/bootstrap-ubuntu-24.04.sh infra/bootstrap/host-guard.sh \
|
|
infra/bootstrap/verify.sh infra/bootstrap/verify-helper.sh infra/bootstrap/audit-host.sh \
|
|
infra/deploy/install-helper.sh infra/deploy/compose-helper.sh infra/deploy/test-compose-helper.sh \
|
|
infra/deploy/prepare-production-config.sh infra/deploy/test-production-config-guard.sh \
|
|
.gitea/actions/kaniko-push/release-build.sh \
|
|
infra/bootstrap/test-audit-host.sh infra/bootstrap/test-root-guard.sh \
|
|
infra/bootstrap/test-verify-helper.sh infra/test/run-as-unprivileged.sh \
|
|
infra/runner/install-runner.sh infra/runner/install-runner-lib.sh \
|
|
infra/runner/act-runner-healthcheck.sh infra/runner/test-runner-config.sh \
|
|
infra/runner/test-install-runner-idempotency.sh infra/runner/test-install-runner-guard.sh \
|
|
infra/runner/test-ci-container-builds.sh
|
|
python3 -c "import ast,pathlib; ast.parse(pathlib.Path('infra/runner/secure-runner-image.py').read_text())"
|
|
python3 -c "import ast,pathlib; ast.parse(pathlib.Path('infra/deploy/validate_release.py').read_text())"
|
|
python3 -c "import ast,pathlib; ast.parse(pathlib.Path('infra/deploy/deploy_release.py').read_text())"
|
|
python3 -c "import ast,pathlib; ast.parse(pathlib.Path('infra/deploy/create_release_manifest.py').read_text())"
|
|
python3 -c "import ast,pathlib; ast.parse(pathlib.Path('infra/deploy/release_handoff.py').read_text())"
|
|
python3 -c "import ast,pathlib; ast.parse(pathlib.Path('infra/deploy/release_refs.py').read_text())"
|
|
python3 -c "import ast,pathlib; ast.parse(pathlib.Path('infra/deploy/release_state.py').read_text())"
|
|
python3 -c "import ast,pathlib; ast.parse(pathlib.Path('infra/deploy/deployment_lock.py').read_text())"
|
|
- name: Run deployment contract and rollback tests
|
|
run: python3 -m unittest discover -s infra/deploy -p 'test_*.py' -v
|
|
- name: Validate production Compose and Caddyfile
|
|
run: |
|
|
secret_file=$(mktemp)
|
|
trap 'rm -f "$secret_file"' EXIT
|
|
REVIEW_SECRET_FILE="$secret_file" docker compose --env-file deploy/production/.env.example -f deploy/production/compose.yaml config --quiet
|
|
- name: Validate Caddyfile in isolated container action
|
|
uses: ./.gitea/actions/caddy-validate
|
|
with:
|
|
workspace: ${{ github.workspace }}
|
|
- name: Build production images
|
|
uses: ./.gitea/actions/kaniko-build
|
|
with:
|
|
workspace: ${{ github.workspace }}
|
|
dockerfile: deploy/production/Dockerfile.backend
|
|
destination: akyldash-backend:ci
|
|
- name: Build OpenSearch production image
|
|
uses: ./.gitea/actions/kaniko-build
|
|
with:
|
|
workspace: ${{ github.workspace }}
|
|
dockerfile: deploy/production/Dockerfile.opensearch
|
|
destination: akyldash-opensearch:ci
|
|
- name: Prepare a synthetic artifact compatibility marker
|
|
run: |
|
|
mkdir -p artifact-smoke
|
|
printf 'Gitea artifact upload smoke test; no release data.\n' > artifact-smoke/marker.txt
|
|
- name: Verify Gitea runtime artifact upload
|
|
uses: https://gitea.com/actions/gitea-upload-artifact@055b8b3f04a4a7ed853f2c6ab04256f83e4874dc
|
|
with:
|
|
name: artifact-smoke-${{ github.run_id }}
|
|
path: artifact-smoke/marker.txt
|
|
if-no-files-found: error
|
|
retention-days: 1
|