kaiban-distributed/.github/workflows/ci.yml at a4525eb18e7d3686f17c0962064165f7feab807f · andreibesleaga/kaiban-distributed · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ── Gate 1-3: Lint, Typecheck, Unit Tests ─────────────────────────────
  quality:
    name: Quality Gates (lint / typecheck / coverage)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
      - run: npm ci
      - name: Gate 1 — Lint (zero errors)
        run: npm run lint
      - name: Gate 2 — Type Safety (zero errors)
        run: npm run typecheck
      - name: Gate 3 — Unit Tests + Coverage (≥99%)
        run: npm run test:coverage
      - name: Gate 6 — Architecture (no circular imports)
        run: npx madge --circular src/
      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage
          path: coverage/

  # ── Gate 4a: BullMQ E2E (Redis) ───────────────────────────────────────
  e2e-bullmq:
    name: E2E — BullMQ / Redis
    runs-on: ubuntu-latest
    services:
      redis:
        image: redis:7-alpine
        ports:
          - 6379:6379
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 3s
          --health-retries 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
      - run: npm ci
      - name: E2E Tests — BullMQ (Redis)
        run: npm run test:e2e
        env:
          REDIS_URL: redis://localhost:6379
          AGENT_IDS: test-agent

  # ── Gate 4b: Kafka E2E ────────────────────────────────────────────────
  e2e-kafka:
    name: E2E — Kafka
    runs-on: ubuntu-latest
    services:
      zookeeper:
        image: confluentinc/cp-zookeeper:7.6.0
        ports:
          - 2181:2181
        env:
          ZOOKEEPER_CLIENT_PORT: 2181
          ZOOKEEPER_TICK_TIME: 2000
        options: >-
          --health-cmd "nc -z localhost 2181"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 10
          --health-start-period 15s
      kafka:
        image: confluentinc/cp-kafka:7.6.0
        ports:
          - 9092:9092
        env:
          KAFKA_BROKER_ID: 1
          KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
          KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9092
          KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
          KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
        options: >-
          --health-cmd "kafka-topics --bootstrap-server localhost:9092 --list"
          --health-interval 15s
          --health-timeout 10s
          --health-retries 15
          --health-start-period 30s
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
      - run: npm ci
      - name: E2E Tests — Kafka
        run: npm run test:e2e:kafka
        env:
          KAFKA_BROKERS: localhost:9092
          AGENT_IDS: test-agent

  # ── Gate 5: Security Audit ────────────────────────────────────────────
  security:
    name: Security Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'
      - run: npm ci
      - name: Gate 5 — Dependency Audit
        run: npm audit --audit-level=moderate || echo "::warning::Audit issues found - see output above (known: kaibanjs transitive CVEs)"

  # ── Gate 4c: Docker Build ─────────────────────────────────────────────
  docker:
    name: Docker Build
    runs-on: ubuntu-latest
    needs: [quality]
    steps:
      - uses: actions/checkout@v4
      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          tags: kaiban-distributed:ci-${{ github.sha }}