Datto-DBPool_PSWrapper/.github/workflows/ci.yml at main · cksapp/Datto-DBPool_PSWrapper · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: CI

# Continuous Integration - Reusable Workflow
#
# Triggered by:
# 1. Direct: On push/PR to src/ paths or workflow changes
# 2. Indirect: Called by release workflow via workflow_call
#
# Purpose: Validate code quality and functionality on every commit
on:
  workflow_call:
  push:
    branches: [main]
    paths:
      - src/**
      - Datto.DBPool.API/**
      - .github/workflows/ci.yml
  pull_request:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  test:
    name: Pester Tests
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]

    steps:
      - uses: actions/checkout@v6

      - name: Setup PowerShell
        uses: bjompen/UpdatePWSHAction@v1.0.3

      - name: Run Pester Tests
        shell: pwsh
        run: ./build.ps1 -Task Test -Bootstrap
        # This runs full test suite including:
        # - Manifest.tests.ps1: Validates CHANGELOG and manifest versions match
        # - Help.tests.ps1: Validates generated documentation
        # - Meta.tests.ps1: Code quality and module structure checks

  analyze:
    name: PSScriptAnalyzer
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read

    steps:
      - uses: actions/checkout@v6

      - name: Run PSScriptAnalyzer
        uses: microsoft/psscriptanalyzer-action@v1.1
        with:
          path: .\
          recurse: true
          includeRule: '"PSAvoidGlobalAliases", "PSAvoidUsingConvertToSecureStringWithPlainText"'
          output: results.sarif

      - name: Upload SARIF results
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: results.sarif
          wait-for-processing: true

  quality-gate:
    name: CI Quality Gate
    runs-on: ubuntu-latest
    needs: [test, analyze]
    if: always()

    steps:
      - name: Check Pester test results
        if: needs.test.result != 'success'
        run: |
          echo "[FAIL] Pester tests failed"
          exit 1

      - name: Check code analysis results
        if: needs.analyze.result != 'success'
        run: |
          echo "[FAIL] Code analysis failed"
          exit 1

      - name: All CI checks passed
        run: echo "[PASS] All CI checks passed - Ready for CD"