cli2api/.github/workflows/ci.yml at main · caigee-cmd/cli2api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  go:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Import constraints
        run: go test ./internal/app -run TestImportConstraints -count=1
      - run: go test ./...
      - run: go vet ./...
      - name: Go race tests
        run: go test -race ./...
      - name: Validate bilingual changelog
        run: |
          python3 scripts/release-notes.py self-test
          python3 scripts/release-notes.py validate
      - name: Build updater release matrix
        run: ./scripts/build-updater-assets.sh "$RUNNER_TEMP/updater-assets"

  windows-host:
    timeout-minutes: 30
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Build Windows host binaries
        shell: powershell
        run: |
          go build -o "$env:RUNNER_TEMP\qoder-api-proxy.exe" .\cmd\server
          go build -o "$env:RUNNER_TEMP\cli2api-updater.exe" .\cmd\updater
      - name: Test Windows updater core
        shell: powershell
        run: go test ./internal/updater ./internal/config
      - name: Parse PowerShell scripts
        shell: powershell
        run: |
          $Failed = $false
          foreach ($File in @("scripts\start.ps1", "deploy\install-updater.ps1")) {
            $Tokens = $null
            $Errors = $null
            [System.Management.Automation.Language.Parser]::ParseFile(
              (Resolve-Path $File),
              [ref]$Tokens,
              [ref]$Errors
            ) | Out-Null
            if ($Errors.Count -gt 0) {
              $Failed = $true
              $Errors | ForEach-Object { Write-Error "$File`: $($_.Message)" }
            }
          }
          if ($Failed) { exit 1 }

  worker:
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
      - run: npm test
        working-directory: worker

  frontend:
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
        working-directory: frontend
      - run: npm run lint
        working-directory: frontend
      - name: Build and sync embedded console assets
        run: npm run sync
        working-directory: frontend
      - name: Check internal/webui/static is up to date
        run: git diff --exit-code --stat internal/webui/static && test -z "$(git status --porcelain internal/webui/static)"

  container:
    timeout-minutes: 30
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate Compose configuration
        working-directory: deploy
        env:
          PROXY_API_KEY: ci-placeholder-key
        run: docker compose config --quiet
      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - name: Build multi-platform container image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: deploy/Dockerfile
          platforms: linux/amd64,linux/arm64
          push: false
          cache-from: type=gha
          cache-to: type=gha,mode=max

  secrets:
    timeout-minutes: 15
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install gitleaks
        run: |
          curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v8.24.3/gitleaks_8.24.3_linux_x64.tar.gz | tar -xz gitleaks
          sudo mv gitleaks /usr/local/bin/gitleaks
      - name: Scan git history for secrets
        run: gitleaks detect --source . --verbose --redact