test(matching): cover lifecycle and safety rules #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| backend: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: backend/go.mod | |
| cache-dependency-path: backend/go.sum | |
| - name: Verify formatting | |
| run: test -z "$(gofmt -l .)" | |
| - name: Run tests with race detector | |
| run: go test -race -coverprofile=coverage.out ./... | |
| - name: Run vet | |
| run: go vet ./... | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@d583c34f0599d37dbac4a198b9c83201be380893 # v9.3.0 | |
| with: | |
| version: v2.12.2 | |
| working-directory: backend | |
| - name: Verify sqlc output | |
| run: | | |
| curl --fail --location --silent --show-error \ | |
| https://github.com/sqlc-dev/sqlc/releases/download/v1.31.1/sqlc_1.31.1_linux_amd64.tar.gz \ | |
| | tar --extract --gzip --directory /tmp | |
| /tmp/sqlc generate | |
| git diff --exit-code | |
| frontend: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.14.0 | |
| - name: Install pnpm | |
| run: npm install --global pnpm@11.9.0 | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Verify peer dependencies | |
| run: pnpm peers check | |
| - name: Lint | |
| run: pnpm lint | |
| - name: Test | |
| run: pnpm test | |
| - name: Build | |
| run: pnpm build | |
| security: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24.14.0 | |
| - name: Detect leaked secrets | |
| run: docker run --rm --volume "$PWD:/repo" zricethezav/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f detect --source=/repo --no-banner --redact | |
| - name: Audit production npm dependencies | |
| working-directory: frontend | |
| run: | | |
| npm install --global pnpm@11.9.0 | |
| pnpm audit --prod --audit-level=high | |
| containers: | |
| needs: [backend, frontend, security] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: backend/go.mod | |
| cache-dependency-path: backend/go.sum | |
| - name: Generate ephemeral development secrets | |
| run: ./scripts/setup-dev.sh | |
| - name: Validate Compose | |
| run: docker compose config --quiet | |
| - name: Build application images | |
| run: docker compose build backend frontend reverse-proxy |