USTSACMLand/.github/workflows/ci.yml at main · greenthree/USTSACMLand · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
name: CI

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Check formatting
        run: npm run format:check

      - name: Lint
        run: npm run lint

      - name: Check synchronization workflow invariants
        run: npm run check:sync-workflow

      - name: Check CI workflow invariants
        run: npm run check:ci-workflow

      - name: Check encrypted backup workflow invariants
        run: npm run check:backup-workflow

      - name: Check encrypted restore drill workflow invariants
        run: npm run check:restore-drill-workflow

      - name: Check WebChat relay workflow invariants
        run: npm run check:webchat-relay-workflow

      - name: Check WebChat cache probe workflow invariants
        run: npm run check:webchat-cache-probe-workflow

      - name: Test
        run: npm test

      - name: Install browser test engines
        run: npx playwright install --with-deps chromium firefox webkit

      - name: Test browser flows and accessibility
        run: npm run test:e2e

      - name: Test WebChat browser flows and accessibility
        run: npm run test:e2e:webchat

      - name: Build
        run: npm run build
        env:
          VITE_SUPABASE_URL: ${{ secrets.VITE_SUPABASE_URL }}
          VITE_SUPABASE_ANON_KEY: ${{ secrets.VITE_SUPABASE_ANON_KEY }}

      - name: Set up Deno
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
        with:
          deno-version: v2.x

      - name: Check Edge Functions
        run: >-
          deno check --config supabase/functions/deno.json
          supabase/functions/sync-member/index.ts
          supabase/functions/sync-stats/index.ts
          supabase/functions/sync-avatar/index.ts
          supabase/functions/member-avatar/index.ts
          supabase/functions/delete-account/index.ts
          supabase/functions/change-password/index.ts
          supabase/functions/webchat/index.ts
          supabase/functions/webchat-attachment/index.ts
          supabase/functions/webchat-image-cleanup/index.ts
          supabase/functions/webchat-config/index.ts
          supabase/functions/webchat-cache-probe/index.ts
          supabase/functions/firecrawl-config/index.ts

      - name: Lint Edge Functions
        run: deno lint --config supabase/functions/deno.json supabase/functions

      - name: Test Edge Functions
        run: >-
          deno test --allow-read --allow-env
          --config supabase/functions/deno.json supabase/functions

  database-security:
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Check out repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version-file: .nvmrc

      - name: Set up Deno for database integration checks
        uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2
        with:
          deno-version: v2.x

      - name: Start local Supabase
        run: >-
          npx --yes supabase@2.109.1 start
          --exclude analytics,edge-runtime,functions,imgproxy,inbucket,realtime,storage,studio,vector

      - name: Test database security
        run: npm run test:db

      - name: Test account-deletion transaction fencing
        run: npm run check:account-deletion-concurrency

      - name: Test referral transaction fencing and reward boundary
        run: npm run check:referral-concurrency

      - name: Test training-goal active quota concurrency
        run: npm run check:training-goal-concurrency

      - name: Test single-platform outage isolation
        run: npm run check:sync-platform-outage

      - name: Test WebChat image reservation concurrency
        run: node scripts/check-webchat-image-reservation-concurrency.mjs

      - name: Lint database schema
        run: >-
          npx --yes supabase@2.109.1 db lint --local
          --schema public --level warning --fail-on warning

      - name: Stop local Supabase
        if: always()
        run: npx --yes supabase@2.109.1 stop --no-backup