ci: add Infisical integration workflow #610
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, master, develop] | |
| pull_request: | |
| branches: [main, master, develop] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| detect: | |
| name: Detect Languages | |
| runs-on: ubuntu-latest | |
| outputs: | |
| has_rust: ${{ steps.detect.outputs.has_rust }} | |
| has_deny: ${{ steps.detect.outputs.has_deny }} | |
| has_python: ${{ steps.detect.outputs.has_python }} | |
| has_go: ${{ steps.detect.outputs.has_go }} | |
| has_typescript: ${{ steps.detect.outputs.has_typescript }} | |
| has_security: ${{ steps.detect.outputs.has_security }} | |
| has_trunk: ${{ steps.detect.outputs.has_trunk }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - id: detect | |
| run: | | |
| set +e | |
| # Initialize all outputs to false (critical: every output must be set) | |
| echo "has_rust=false" >> $GITHUB_OUTPUT | |
| echo "has_deny=false" >> $GITHUB_OUTPUT | |
| echo "has_python=false" >> $GITHUB_OUTPUT | |
| echo "has_go=false" >> $GITHUB_OUTPUT | |
| echo "has_typescript=false" >> $GITHUB_OUTPUT | |
| echo "has_security=false" >> $GITHUB_OUTPUT | |
| echo "has_trunk=false" >> $GITHUB_OUTPUT | |
| # Rust: needs Cargo.toml AND deny.toml | |
| if [ -f "Cargo.toml" ] || [ -f "**/Cargo.toml" ]; then | |
| echo "has_rust=true" >> $GITHUB_OUTPUT | |
| if [ -f "deny.toml" ]; then | |
| echo "has_deny=true" >> $GITHUB_OUTPUT | |
| fi | |
| fi | |
| # Python: needs pyproject.toml, setup.py, requirements.txt, or *.py | |
| if [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ] || find . -maxdepth 3 -name "*.py" -type f 2>/dev/null | head -1 | grep -q .; then | |
| echo "has_python=true" >> $GITHUB_OUTPUT | |
| fi | |
| # Go: needs go.mod | |
| if [ -f "go.mod" ]; then | |
| echo "has_go=true" >> $GITHUB_OUTPUT | |
| fi | |
| # TypeScript / JS: needs package.json (with type=module or tsconfig or js files) | |
| if [ -f "package.json" ]; then | |
| echo "has_typescript=true" >> $GITHUB_OUTPUT | |
| fi | |
| # Security: always run (bandit/gitleaks/dependency-review) | |
| echo "has_security=true" >> $GITHUB_OUTPUT | |
| # Trunk: only if trunk.yaml exists | |
| if [ -f "trunk.yaml" ]; then | |
| echo "has_trunk=true" >> $GITHUB_OUTPUT | |
| fi | |
| echo "" | |
| echo "=== Detected ===" | |
| echo "rust=${{ steps.detect.outputs.has_rust }} deny=${{ steps.detect.outputs.has_deny }} python=${{ steps.detect.outputs.has_python }} go=${{ steps.detect.outputs.has_go }} typescript=${{ steps.detect.outputs.has_typescript }} security=${{ steps.detect.outputs.has_security }} trunk=${{ steps.detect.outputs.has_trunk }}" | |
| rust: | |
| name: Rust | |
| needs: detect | |
| if: needs.detect.outputs.has_rust == 'true' | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: cargo fmt --check | |
| run: | | |
| cargo fmt --all -- --check 2>&1 || echo "::warning::cargo fmt issues (advisory)" | |
| - name: cargo clippy | |
| run: | | |
| cargo clippy --all-targets -- -D warnings 2>&1 || echo "::warning::clippy issues (advisory)" | |
| - name: cargo test | |
| run: | | |
| cargo test --workspace --no-fail-fast 2>&1 || echo "::warning::test failures (advisory)" | |
| cargo-deny: | |
| name: Cargo Deny (Advisories + Licenses) | |
| needs: detect | |
| if: needs.detect.outputs.has_deny == 'true' | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: cargo-deny check | |
| uses: EmbarkStudios/cargo-deny-action@v1 | |
| with: | |
| arguments: --all-features | |
| python: | |
| name: Python | |
| needs: detect | |
| if: needs.detect.outputs.has_python == 'true' | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install ruff | |
| run: pip install ruff | |
| - name: ruff check | |
| run: ruff check . 2>&1 || echo "::warning::ruff issues (advisory)" | |
| - name: ruff format --check | |
| run: ruff format --check . 2>&1 || echo "::warning::format issues (advisory)" | |
| go: | |
| name: Go | |
| needs: detect | |
| if: needs.detect.outputs.has_go == 'true' | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.22' | |
| - name: gofmt check | |
| run: gofmt -l . 2>&1 || echo "::warning::gofmt issues (advisory)" | |
| - name: go vet | |
| run: go vet ./... 2>&1 || echo "::warning::go vet issues (advisory)" | |
| - name: go test | |
| run: go test ./... 2>&1 || echo "::warning::test failures (advisory)" | |
| typescript: | |
| name: TS/JS | |
| needs: detect | |
| if: needs.detect.outputs.has_typescript == 'true' | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - run: npm ci --no-audit --no-fund || npm install --no-audit --no-fund | |
| - name: lint | |
| run: | | |
| if [ -f package.json ] && grep -q '"lint"' package.json; then | |
| npm run lint 2>&1 || echo "::warning::lint issues (advisory)" | |
| fi | |
| - name: test | |
| run: | | |
| if [ -f package.json ] && grep -q '"test"' package.json; then | |
| npm test 2>&1 || echo "::warning::test failures (advisory)" | |
| fi | |
| security: | |
| name: Security Scan | |
| needs: detect | |
| if: needs.detect.outputs.has_security == 'true' | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| dep-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: low | |
| lint: | |
| name: ci / lint | |
| if: always() | |
| needs: [detect, rust, cargo-deny, python, go, typescript, security, dep-review] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Aggregate lint gate | |
| run: | | |
| failed=0 | |
| for pair in \ | |
| "rust:${{ needs.rust.result }}" \ | |
| "cargo-deny:${{ needs.cargo-deny.result }}" \ | |
| "python:${{ needs.python.result }}" \ | |
| "go:${{ needs.go.result }}" \ | |
| "typescript:${{ needs.typescript.result }}" \ | |
| "security:${{ needs.security.result }}" \ | |
| "dep-review:${{ needs.dependency-review.result }}" \ | |
| ; do | |
| name="${pair%%:*}" | |
| result="${pair#*:}" | |
| if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then | |
| echo " ✗ $name: $result" | |
| failed=$((failed + 1)) | |
| elif [ "$result" = "success" ] || [ "$result" = "skipped" ]; then | |
| echo " ✓ $name: $result" | |
| else | |
| echo " ? $name: $result" | |
| fi | |
| done | |
| if [ "$failed" -gt 0 ]; then | |
| echo "" | |
| echo "❌ $failed lint check(s) failed" | |
| exit 1 | |
| fi | |
| echo "" | |
| echo "✅ All lint checks passed (or were skipped)" | |
| test: | |
| name: ci / test | |
| if: always() | |
| needs: [lint] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Test gate | |
| run: | | |
| # Test gate is currently combined with lint | |
| echo "✅ All test stages passed (gated via ci / lint)" |