feat(risk): runtime-tunable risk controls #204
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [test, main] | |
| push: | |
| branches: [test, main] | |
| jobs: | |
| engine: | |
| name: engine — lint, migrate, test | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:17-alpine | |
| env: | |
| POSTGRES_USER: capital | |
| POSTGRES_PASSWORD: capital | |
| POSTGRES_DB: capital | |
| ports: ["5432:5432"] | |
| options: >- | |
| --health-cmd "pg_isready -U capital -d capital" | |
| --health-interval 5s --health-timeout 5s --health-retries 12 | |
| defaults: | |
| run: | |
| working-directory: engine | |
| env: | |
| CAPITAL_DATABASE_URL: postgresql+psycopg://capital:capital@localhost:5432/capital | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| with: | |
| # Pin to the same uv minor the engine Dockerfile uses | |
| # (ghcr.io/astral-sh/uv:0.11) so CI and the runtime image | |
| # share the resolver/lock format. | |
| version: "0.11" | |
| # `uv sync` runs in engine/ (job-level working-directory) and reads | |
| # the patch pin from engine/.python-version directly — installing | |
| # the managed Python via uv. We don't ask setup-uv to pre-install | |
| # Python so there's a single source of truth. | |
| - run: uv sync --locked | |
| - name: Lint (ruff) | |
| run: uv run ruff check . | |
| - name: Apply migrations | |
| run: uv run alembic upgrade head | |
| - name: Test (pytest) | |
| run: uv run pytest | |
| - name: OpenAPI schema is in sync | |
| run: | | |
| uv run python export_openapi.py | |
| git diff --exit-code ../web/openapi.json \ | |
| || { echo "::error::web/openapi.json is stale — run 'uv run python export_openapi.py'"; exit 1; } | |
| web: | |
| name: web — lint, typecheck, build | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: web | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: web/package-lock.json | |
| - run: npm ci | |
| - name: Generated API types are in sync | |
| run: | | |
| npm run gen:api | |
| git diff --exit-code src/lib/api/schema.d.ts \ | |
| || { echo "::error::schema.d.ts is stale — run 'npm run gen:api'"; exit 1; } | |
| - name: Lint (eslint) | |
| run: npm run lint | |
| - name: Build (tsc + vite) | |
| run: npm run build | |
| docker: | |
| name: docker — images build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build images | |
| run: docker compose -f docker-compose.yml build |