Merge pull request #5 from andreibesleaga/dependabot/npm_and_yarn/con… #54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: full-verify | |
| # The single, unconditional "is the whole repo green" check — unlike the other | |
| # workflows (draft.yml, publisher.yml, consumer.yml, validate-examples.yml, | |
| # example-scripts.yml), which are path-filtered to their own area, this one | |
| # always runs on every push/PR to main and re-verifies every area in one place. | |
| # Intended as the required status check for branch protection. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: {} | |
| jobs: | |
| draft: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ruby/setup-ruby@v1 | |
| with: { ruby-version: "3.2" } | |
| - uses: actions/setup-python@v5 | |
| with: { python-version: "3.12" } | |
| - run: gem install kramdown-rfc2629 | |
| - run: python3 -m pip install xml2rfc | |
| - name: Build and strict-check the latest draft | |
| run: | | |
| set -e | |
| cd internet-drafts | |
| md=$(ls draft-besleaga-sustainability-wellknown-*.md | sort | tail -1) | |
| base="${md%.md}" | |
| kramdown-rfc "$md" > "$base.xml" | |
| xml2rfc --strict --text "$base.xml" -o "$base.txt" | |
| - name: idnits (0 errors required) | |
| run: | | |
| cd internet-drafts | |
| md=$(ls draft-besleaga-sustainability-wellknown-*.md | sort | tail -1) | |
| base="${md%.md}" | |
| npx --yes @ietf-tools/idnits "$base.xml" | tee /tmp/idnits.out | |
| ! grep -qE '^ *ERROR' /tmp/idnits.out | |
| schemas: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: { python-version: "3.12" } | |
| - uses: ruby/setup-ruby@v1 | |
| with: { ruby-version: "3.2" } | |
| - run: python3 -m pip install jtd | |
| - run: gem install cddl | |
| - name: Validate every example response (both validators) | |
| working-directory: schemas-validators | |
| run: bash validate-all.sh | |
| # Three-way schema equality (schemas-validators/response-schema.json == | |
| # publisher/src/schema.ts == consumer/src/schema.ts) is enforced by each | |
| # package's own test suite: publisher/test/conformance.test.ts and | |
| # consumer/test/schema.test.ts both assert their embedded TS schema is | |
| # byte-identical to the repo JSON. Those run in the `publisher`/`consumer` | |
| # jobs below (via `npm test`), so no separate equality step is needed here. | |
| publisher: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: publisher | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: { node-version: "22", cache: npm, cache-dependency-path: publisher/package-lock.json } | |
| - run: npm ci || npm install | |
| - run: npm run typecheck | |
| - run: npm run build | |
| - run: npm test | |
| - run: npm publish --dry-run | |
| consumer: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: { node-version: "22" } | |
| - name: Build publisher (consumer's interop test needs its dist/) | |
| working-directory: publisher | |
| run: npm ci || npm install; npm run build | |
| - name: Build and test consumer | |
| working-directory: consumer | |
| run: | | |
| npm ci || npm install | |
| npm run typecheck | |
| npm run build | |
| npm test | |
| - name: Dry-run publish | |
| working-directory: consumer | |
| run: npm publish --dry-run | |
| example-scripts-and-server-configs: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: { python-version: "3.12" } | |
| - uses: actions/setup-node@v4 | |
| with: { node-version: "22" } | |
| - uses: shivammathur/setup-php@v2 | |
| with: { php-version: "8.3" } | |
| - uses: ruby/setup-ruby@v1 | |
| with: { ruby-version: "3.2" } | |
| - run: python3 -m pip install jtd | |
| - run: gem install cddl | |
| - name: example-scripts test suites | |
| working-directory: example-scripts | |
| run: | | |
| python3 test_security.py | |
| node test_security.js | |
| php test_security.php | |
| python3 test_request_handler.py | |
| - name: Install nginx and apache2 | |
| run: sudo apt-get update -qq && sudo apt-get install -y nginx apache2 | |
| - name: Live server-configuration check (see server-configurations/README.md) | |
| run: | | |
| set -e | |
| mkdir -p /tmp/nginx-fv/logs /tmp/nginx-fv/run /tmp/nginx-fv/tmp | |
| echo '{"version":"2.0","test":true}' > /tmp/nginx-fv/sustainability.json | |
| { echo 'worker_processes 1; pid /tmp/nginx-fv/run/nginx.pid; error_log /tmp/nginx-fv/logs/error.log;'; \ | |
| echo 'events{worker_connections 16;} http{ access_log /tmp/nginx-fv/logs/access.log;'; \ | |
| echo 'client_body_temp_path /tmp/nginx-fv/tmp/body; proxy_temp_path /tmp/nginx-fv/tmp/proxy;'; \ | |
| echo 'fastcgi_temp_path /tmp/nginx-fv/tmp/fastcgi; uwsgi_temp_path /tmp/nginx-fv/tmp/uwsgi; scgi_temp_path /tmp/nginx-fv/tmp/scgi;'; \ | |
| echo 'server{ listen 127.0.0.1:8099;'; \ | |
| sed 's#/var/www/metadata/sustainability.json#/tmp/nginx-fv/sustainability.json#' server-configurations/nginx.conf | grep -v '^#'; \ | |
| echo '} }'; } > /tmp/nginx-fv/nginx.conf | |
| nginx -t -c /tmp/nginx-fv/nginx.conf | |
| nginx -c /tmp/nginx-fv/nginx.conf | |
| sleep 1 | |
| [ "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8099/.well-known/sustainability-data)" = "200" ] | |
| curl -s -D - -o /dev/null http://127.0.0.1:8099/.well-known/sustainability-data | grep -qi '^Access-Control-Allow-Origin: \*' | |
| curl -s -D - -o /dev/null -X POST http://127.0.0.1:8099/.well-known/sustainability-data | grep -qi '^Allow: GET, HEAD' | |
| nginx -s stop -c /tmp/nginx-fv/nginx.conf | |
| - name: Apache config check | |
| run: | | |
| set -e | |
| mkdir -p /tmp/apache-fv/logs /tmp/apache-fv/run /tmp/apache-fv/htdocs | |
| echo '{"version":"2.0","test":true}' > /tmp/apache-fv/htdocs/sustainability.json | |
| echo '{"error":"method not allowed"}' > /tmp/apache-fv/htdocs/sustainability-405.json | |
| cat > /tmp/apache-fv/httpd.conf <<EOF | |
| ServerRoot "/tmp/apache-fv" | |
| Listen 127.0.0.1:8098 | |
| PidFile "/tmp/apache-fv/run/httpd.pid" | |
| ErrorLog "/tmp/apache-fv/logs/error.log" | |
| LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so | |
| LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so | |
| LoadModule alias_module /usr/lib/apache2/modules/mod_alias.so | |
| LoadModule headers_module /usr/lib/apache2/modules/mod_headers.so | |
| LoadModule rewrite_module /usr/lib/apache2/modules/mod_rewrite.so | |
| LoadModule mime_module /usr/lib/apache2/modules/mod_mime.so | |
| User $(whoami) | |
| Group $(id -gn) | |
| ServerName localhost | |
| TypesConfig /etc/mime.types | |
| EOF | |
| sed "s#/var/www/metadata/sustainability-405.json#/tmp/apache-fv/htdocs/sustainability-405.json#; s#/var/www/metadata/sustainability.json#/tmp/apache-fv/htdocs/sustainability.json#" \ | |
| server-configurations/apache.conf | grep -v '^#' >> /tmp/apache-fv/httpd.conf | |
| apache2 -f /tmp/apache-fv/httpd.conf -t | |
| apache2 -f /tmp/apache-fv/httpd.conf -k start | |
| sleep 1 | |
| [ "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8098/.well-known/sustainability-data)" = "200" ] | |
| curl -s -D - -o /dev/null http://127.0.0.1:8098/.well-known/sustainability-data | grep -qi '^Access-Control-Allow-Origin: \*' | |
| post=$(curl -s -D - -o /dev/null -X POST http://127.0.0.1:8098/.well-known/sustainability-data) | |
| echo "$post" | grep -qi "^Allow: GET, HEAD" | |
| apache2 -f /tmp/apache-fv/httpd.conf -k stop | |
| summary: | |
| needs: [draft, schemas, publisher, consumer, example-scripts-and-server-configs] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: | | |
| echo "All areas verified green: draft, schemas, publisher, consumer, example-scripts, server-configurations." |