Etappe 47: Medien-Quarantäne — der Endpunkt antwortet 200 und tut man… #87
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # The verification chain from docs/PROZESS.md §4, enforced somewhere the agent | |
| # does not control. Deliberately limited to three checks — anything flaky gets | |
| # removed rather than retried, because a red badge nobody trusts is worse than | |
| # no badge. | |
| name: CI | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| go: | |
| name: Go — vet & test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| # //go:embed all:dist requires the directory to exist. It is committed, but | |
| # a guard here turns a confusing embed error into a clear one. | |
| - name: Check embedded frontend assets exist | |
| run: test -d cmd/matrixctrl/dist || { echo "cmd/matrixctrl/dist missing — run 'make copy-dist'"; exit 1; } | |
| # P0-1c: a plan document explaining why the cluster hostname must never be | |
| # published contained it, and was pushed. Every control in place pointed at | |
| # screenshots; none looked at prose. Skips when the secret is absent, so | |
| # outside PRs are not failed by a check they cannot satisfy. | |
| - name: No sensitive strings | |
| env: | |
| SENSITIVE_PATTERNS: ${{ secrets.SENSITIVE_PATTERNS }} | |
| run: ./scripts/check-sensitive.sh | |
| # Ten files had drifted out of gofmt before this gate existed. Formatting | |
| # is not worth an opinion, only a check. | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -l ./cmd ./internal) | |
| test -z "$unformatted" || { echo "gofmt needed:"; echo "$unformatted"; exit 1; } | |
| - run: go vet ./... | |
| # TestDiscoverLive self-skips unless RUN_LIVE=1, so no cluster is needed. | |
| - run: go test ./... -count=1 | |
| web: | |
| name: Frontend — typecheck, test & build | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: web | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: web/package-lock.json | |
| - run: npm ci | |
| # `-b` is load-bearing: web/tsconfig.json is `"files": []` plus project | |
| # references, so plain `tsc --noEmit` checks zero files and always passes. | |
| # The Build step below caught what this one missed, eleven minutes later | |
| # and a hundred lines of output further down (§4.40). | |
| - name: Typecheck | |
| run: npx tsc -b --noEmit | |
| - name: Unit tests | |
| run: npm run test -- --run | |
| - name: Build | |
| run: npm run build |