Add typed tenant homepage content #298
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verify ONEVibe | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: onevibe-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify: | |
| name: Lint, test, and build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Audit production dependency tree | |
| run: npm audit --omit=dev --audit-level=moderate | |
| - run: npm run check | |
| container: | |
| name: Hardened container smoke | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build image | |
| run: docker build --tag onevibe:${{ github.sha }} . | |
| - name: Start read-only container | |
| run: | | |
| docker run --detach --init --name onevibe-ci \ | |
| --publish 4311:4311 \ | |
| --read-only \ | |
| --tmpfs /tmp:size=64m,noexec,nosuid \ | |
| --tmpfs /var/lib/onevibe:size=64m,uid=10001,gid=10001,mode=700 \ | |
| --cap-drop ALL \ | |
| --security-opt no-new-privileges:true \ | |
| --env ONEVIBE_API_HOST=0.0.0.0 \ | |
| --env ONEVIBE_API_PORT=4311 \ | |
| --env ONEVIBE_DATA_DIR=/var/lib/onevibe \ | |
| onevibe:${{ github.sha }} | |
| - name: Verify health and non-root runtime | |
| run: | | |
| for attempt in $(seq 1 30); do | |
| if curl --fail --silent http://127.0.0.1:4311/api/health > /tmp/onevibe-health.json; then break; fi | |
| sleep 1 | |
| done | |
| grep -q '"status":"healthy"' /tmp/onevibe-health.json | |
| test "$(docker exec onevibe-ci id -u)" = "10001" | |
| test "$(docker inspect --format '{{.Config.User}}' onevibe-ci)" = "onevibe" | |
| - name: Collect container logs | |
| if: always() | |
| run: docker logs onevibe-ci 2>&1 || true | |
| - name: Remove container | |
| if: always() | |
| run: docker rm --force onevibe-ci || true | |
| postgres-schema: | |
| name: PostgreSQL migration smoke | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| services: | |
| postgres: | |
| image: postgres:18-alpine | |
| env: | |
| POSTGRES_USER: onevibe | |
| POSTGRES_PASSWORD: onevibe-ci-password | |
| POSTGRES_DB: onevibe | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd="pg_isready -U onevibe -d onevibe" | |
| --health-interval=5s | |
| --health-timeout=5s | |
| --health-retries=12 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Apply reviewed Drizzle migrations | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| run: npm run db:migrate | |
| - name: Validate Drizzle migration manifest | |
| run: npm run db:check | |
| - name: Prove owner-scoped Postgres chat vertical slice | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| run: npm run e2e:postgres-chat | |
| - name: Prove Better Auth OTP and sessions on Postgres | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| run: npm run e2e:auth-postgres | |
| - name: Prove Postgres metadata restart and owner isolation | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| run: npm run e2e:postgres-metadata | |
| - name: Prove Postgres operational repositories and audit retention | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| run: npm run e2e:postgres-operations | |
| - name: Prove composed Postgres state restart recovery | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| run: npm run e2e:postgres-state | |
| - name: Prove opt-in Postgres TaskStore core slice | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| run: npm run e2e:postgres-taskstore | |
| - name: Prove authenticated cross-process HTTP SSE | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| run: npm run e2e:postgres-http-sse | |
| - name: Locate PostgreSQL service container | |
| id: postgres-container | |
| shell: bash | |
| run: echo "name=$(docker ps --filter ancestor=postgres:18-alpine --format '{{.Names}}' | head -n 1)" >> "$GITHUB_OUTPUT" | |
| - name: Prove Postgres backup and restore | |
| env: | |
| DATABASE_URL: postgresql://onevibe:onevibe-ci-password@127.0.0.1:5432/onevibe | |
| ONEVIBE_BACKUP_E2E_ALLOW_MUTATION: "true" | |
| PG_DUMP_DOCKER_CONTAINER: ${{ steps.postgres-container.outputs.name }} | |
| run: npm run e2e:postgres-backup-restore |