fix(auth): add Account.issuer so Google callback can query #1347
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["**"] | |
| pull_request: | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| env: | |
| # Prisma client generation needs no live DB; build must not run migrations in CI. | |
| DATABASE_URL: "postgresql://user:pass@localhost:5432/db" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| - run: npm ci | |
| - name: Prisma generate | |
| run: npx prisma generate | |
| - name: Typecheck | |
| run: npx tsc --noEmit | |
| - name: Lint | |
| run: npm run lint | |
| - name: Doc links (exact case, as GitHub resolves them) | |
| run: node scripts/check-doc-links.mjs . | |
| - name: Unit tests + coverage | |
| run: npm run test:coverage | |
| - name: MCP bundle freshness (shipped artifact matches source) | |
| # Sprint Fearless P3: the npm-published bundle is committed, so it can | |
| # silently drift from mcp-server.ts (0.3.0 shipped months of missing | |
| # source this way — caught in #106). Rebuild and require a clean diff. | |
| run: | | |
| npm run build:mcp | |
| git add -N packages/ | |
| git diff --exit-code packages/ | |
| - name: Dependency audit (high+) | |
| run: npm audit --audit-level=high | |
| continue-on-error: true | |
| db-tests: | |
| # DB-backed regression net (budget-leak concurrency + end-to-end data-plane | |
| # flow, and RLS isolation when that lands). Runs against an ephemeral Postgres | |
| # service on EVERY push/PR — no external secret required, so these guarantees | |
| # always gate. | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: sanction | |
| ports: ["5432:5432"] | |
| options: >- | |
| --health-cmd "pg_isready -U postgres" | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| env: | |
| DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/sanction" | |
| # Deterministic non-production secrets; the DB tests need these to encrypt | |
| # seed credentials and sign execution JWTs. | |
| SANCTION_CREDENTIAL_ENCRYPTION_KEY: "Y2ktdGVzdC1lbmNyeXB0aW9uLWtleS1ub3QtcHJvZA==" | |
| SANCTION_SIGNING_SECRET: "Y2ktdGVzdC1zaWduaW5nLXNlY3JldC1ub3QtcHJvZA==" | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| - run: npm ci | |
| - name: Prisma generate | |
| run: npx prisma generate | |
| - name: Apply migrations | |
| run: npx prisma migrate deploy | |
| - name: DB tests (concurrency + e2e data plane) | |
| run: npm run test:db |