Joysafeter v2 #550
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| env: | |
| PYTHON_VERSION: "3.12" | |
| jobs: | |
| k8s-runtime-architecture: | |
| name: K8s Runtime Architecture Guard | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7.0.1 | |
| - name: Run offline K8s runtime architecture guard | |
| run: deploy/k8s/offline-architecture-guard.sh | |
| orchestrator-rs: | |
| name: Rust Orchestrator CI | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:15-alpine | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: joysafeter | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| env: | |
| DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/joysafeter | |
| JOYSAFETER_TEST_DATABASE_URL: postgres://postgres:postgres@127.0.0.1:5432/joysafeter | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7.0.1 | |
| - name: Set up Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: 1.97.1 | |
| components: rustfmt, clippy | |
| - name: Install Rust build dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install --yes protobuf-compiler | |
| - name: Cache Rust build | |
| uses: Swatinem/rust-cache@v2.9.1 | |
| with: | |
| workspaces: backend/app/joysafeter_orchestrator_rs -> target | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v9.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@v7.0.0 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Install migration dependencies | |
| working-directory: backend | |
| run: uv sync --dev | |
| - name: Apply database migrations | |
| working-directory: backend | |
| env: | |
| POSTGRES_HOST: 127.0.0.1 | |
| POSTGRES_PORT: "5432" | |
| POSTGRES_PORT_HOST: "5432" | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: joysafeter | |
| run: uv run alembic upgrade head | |
| - name: Verify formatting | |
| working-directory: backend/app/joysafeter_orchestrator_rs | |
| run: cargo fmt --all -- --check | |
| - name: Check all targets | |
| working-directory: backend/app/joysafeter_orchestrator_rs | |
| run: cargo check --locked --all-targets | |
| - name: Run Clippy | |
| working-directory: backend/app/joysafeter_orchestrator_rs | |
| run: cargo clippy --locked --all-targets -- -D clippy::correctness -D clippy::suspicious -D clippy::perf | |
| - name: Run tests | |
| working-directory: backend/app/joysafeter_orchestrator_rs | |
| run: cargo test --locked --all-targets -- --test-threads=1 | |
| - name: Build release binaries | |
| working-directory: backend/app/joysafeter_orchestrator_rs | |
| run: cargo build --locked --release --bins | |
| # Pre-commit: 强制校验（与本地 hook 一致，失败则 CI 失败） | |
| pre-commit: | |
| name: Pre-commit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7.0.1 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v9.0.0 | |
| with: | |
| version: "latest" | |
| - name: Set up Python | |
| uses: actions/setup-python@v7.0.0 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Install backend dependencies | |
| working-directory: backend | |
| run: | | |
| uv venv | |
| uv sync --dev | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2.2.0 | |
| - name: Install frontend dependencies | |
| working-directory: frontend | |
| run: bun install --frozen-lockfile | |
| - name: Run pre-commit (all files) | |
| run: backend/.venv/bin/python -m pre_commit run --all-files | |
| # Backend Tests and Linting | |
| backend: | |
| name: Backend CI | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:15-alpine | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: test_db | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7.0.1 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v9.0.0 | |
| with: | |
| version: "latest" | |
| - name: Set up Python | |
| uses: actions/setup-python@v7.0.0 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| - name: Install dependencies | |
| working-directory: backend | |
| run: | | |
| uv venv | |
| uv sync --dev | |
| - name: Run Ruff linting | |
| working-directory: backend | |
| run: | | |
| uv run ruff check --output-format=github . | |
| - name: Run Ruff formatting check | |
| working-directory: backend | |
| run: | | |
| uv run ruff format --check . | |
| - name: Run type checking with mypy | |
| working-directory: backend | |
| run: | | |
| uv run mypy app --ignore-missing-imports | |
| - name: Error-code catalog guard | |
| working-directory: backend | |
| run: | | |
| uv run pytest tests/test_error_code_catalog_guard.py -q | |
| - name: Run tests | |
| working-directory: backend | |
| env: | |
| DATABASE_URL: postgresql+asyncpg://postgres:postgres@localhost:5432/test_db | |
| JOYSAFETER_TEST_DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test_db | |
| JOYSAFETER_VAULT_ENCRYPTION_KEY: "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f" | |
| SECRET_KEY: test-secret-key-for-ci | |
| ENVIRONMENT: test | |
| run: | | |
| uv run pytest tests/ -v --tb=short | |
| # Frontend Tests and Linting | |
| frontend: | |
| name: Frontend CI | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7.0.1 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2.2.0 | |
| - name: Setup Bun cache | |
| uses: actions/cache@v6.1.0 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-bun- | |
| - name: Install dependencies | |
| working-directory: frontend | |
| run: bun install --frozen-lockfile | |
| - name: Run ESLint | |
| working-directory: frontend | |
| run: bun run lint | |
| - name: Run TypeScript type check | |
| working-directory: frontend | |
| run: bun run type-check | |
| - name: Run tests | |
| working-directory: frontend | |
| run: bun run test | |
| - name: Build | |
| working-directory: frontend | |
| env: | |
| NEXT_PUBLIC_API_URL: http://localhost:8000 | |
| run: bun run build | |
| # Security scanning | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7.0.1 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| version: 'v0.73.0' | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| severity: 'CRITICAL,HIGH' | |
| ignore-unfixed: true | |
| exit-code: '1' |