feat(presentation): add standalone HTML presentation file #359
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # --------------------------------------------------------------------------- | |
| # CI Pipeline — build, test, and security scan on every PR | |
| # --------------------------------------------------------------------------- | |
| # Phase 6.7: Runs on PRs to main. Does NOT deploy — that's Phase 7. | |
| # | |
| # Jobs: | |
| # 1. backend — dotnet build + unit tests + vulnerability check | |
| # 2. frontend — npm ci + tsc + vitest + build + audit | |
| # 3. security — gitleaks secret scanning | |
| # --------------------------------------------------------------------------- | |
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main, refactor/main] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| backend: | |
| name: Backend (build + vuln check) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: src/02-server | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-dotnet@v6 | |
| with: | |
| dotnet-version: "8.0.x" | |
| - name: Restore | |
| run: dotnet restore | |
| - name: Build | |
| run: dotnet build --no-restore -c Release | |
| - name: Test | |
| working-directory: src/04-tests/GroundShareAPI.Tests | |
| run: dotnet test -c Release --nologo | |
| - name: Check for vulnerable packages | |
| run: | | |
| dotnet list package --vulnerable --include-transitive 2>&1 | tee vuln-report.txt | |
| if grep -q "has the following vulnerable packages" vuln-report.txt; then | |
| echo "::error::Vulnerable packages detected — review vuln-report.txt" | |
| exit 1 | |
| fi | |
| frontend: | |
| name: Frontend (build + type check + audit) | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: src/03-client | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| cache-dependency-path: src/03-client/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| - name: Test | |
| run: npm test | |
| env: | |
| # The api client validates this at import time; tests never hit the | |
| # network, so a placeholder is fine (same as the Build step below). | |
| VITE_API_BASE_URL: https://placeholder.azurewebsites.net/api | |
| - name: Build | |
| run: npm run build | |
| env: | |
| VITE_API_BASE_URL: https://placeholder.azurewebsites.net/api | |
| - name: Audit (high + critical only) | |
| run: npm audit --audit-level=high | |
| security: | |
| name: Secret scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |