ci(deploy): consolidate to cd.yml, align backend with Run-From-Package #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # --------------------------------------------------------------------------- | |
| # CI Pipeline — build, test, and security scan on every PR | |
| # --------------------------------------------------------------------------- | |
| # Phase 6.7: Runs on PRs to main. Does NOT deploy — that's Phase 7. | |
| # | |
| # Jobs: | |
| # 1. backend — dotnet build + vulnerability check | |
| # 2. frontend — npm ci + tsc + build + audit | |
| # 3. security — gitleaks secret scanning | |
| # --------------------------------------------------------------------------- | |
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main, refactor/main] | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| backend: | |
| name: Backend (build + vuln check) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: 02-Server | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: "8.0.x" | |
| - name: Restore | |
| run: dotnet restore | |
| - name: Build | |
| run: dotnet build --no-restore -c Release | |
| - name: Check for vulnerable packages | |
| run: | | |
| dotnet list package --vulnerable --include-transitive 2>&1 | tee vuln-report.txt | |
| if grep -q "has the following vulnerable packages" vuln-report.txt; then | |
| echo "::warning::Vulnerable packages detected — review vuln-report.txt" | |
| fi | |
| frontend: | |
| name: Frontend (build + type check + audit) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: 03-Client | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: 03-Client/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| - name: Build | |
| run: npm run build | |
| env: | |
| VITE_API_BASE_URL: https://placeholder.azurewebsites.net/api | |
| - name: Audit (high + critical only) | |
| run: npm audit --audit-level=high || true | |
| security: | |
| name: Secret scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |