local-stack/.github/workflows/ci.yml at dev · AniTrend/local-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: CI

on:
  pull_request:
    types: [opened, synchronize, reopened]
  push:
    branches: [ main, dev ]

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.x'
      - name: Install yamllint
        run: pip install yamllint
      - name: Find and run yamllint on compose files
        run: |
          set -euo pipefail
          files=$(git ls-files "**/docker-compose*.yml" "**/docker-compose*.yaml" || true)
          if [ -n "$files" ]; then
            echo "$files" | xargs yamllint
          else
            echo "No compose files found"
          fi

  trivy-scan:
    needs: [lint]
    name: Filesystem scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Trivy scan
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          format: 'table'
          scan-type: 'fs'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'
          ignore-unfixed: true

  validate-stack:
    needs: [lint]
    name: Validate stack
    runs-on: ubuntu-latest
    # NOTE: the Python toolchain is retained only for the
    # `./stackctl.sh up --dry-run --no-logs` compatibility check below.
    # Drift validation uses the `stackctl` CLI via `stackctl sync` (drift
    # check only; it never generates or deploys) and exits 1 on drift.
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Setup stackctl CLI
        uses: ./.github/actions/setup-stackctl
      - name: Generate Linux stack artifacts for parity inspection
        if: github.head_ref == 'chore/nightly-stack-sync-stackctl'
        run: stackctl generate --output-dir /tmp/stacks-check
      - name: Upload Linux stack artifacts for parity inspection
        if: github.head_ref == 'chore/nightly-stack-sync-stackctl'
        uses: actions/upload-artifact@v7
        with:
          name: linux-generated-stacks
          path: /tmp/stacks-check/*.yml
      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.14'
      - name: Install render dependencies
        run: pip install -r tools/requirements.txt
      - name: Check stacks are in sync with compose sources
        run: stackctl sync
      - name: Dry-run stack rendering
        run: ./stackctl.sh up --dry-run --no-logs