refactor: harden production readiness and split ERP services #122
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main, develop] | |
| push: | |
| branches: [develop] | |
| jobs: | |
| # ---- Commit Message Lint ---- | |
| commitlint: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Validate PR title | |
| env: | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| run: printf "%s\n" "$PR_TITLE" | npx commitlint --config commitlint.config.cjs | |
| # ---- Validate: prisma validate -> prisma generate -> typecheck -> lint -> test -> build ---- | |
| validate: | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:15-alpine | |
| env: | |
| POSTGRES_USER: eip_user | |
| POSTGRES_PASSWORD: eip_password | |
| POSTGRES_DB: eip_db_test | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd="pg_isready -U eip_user" | |
| --health-interval=10s | |
| --health-timeout=5s | |
| --health-retries=5 | |
| env: | |
| DATABASE_URL: postgresql://eip_user:eip_password@localhost:5432/eip_db_test | |
| JWT_SECRET: test_secret_for_ci | |
| REDIS_HOST: localhost | |
| REDIS_PORT: 6379 | |
| MINIO_ENDPOINT: localhost | |
| MINIO_PORT: 9000 | |
| MINIO_USE_SSL: false | |
| MINIO_ACCESS_KEY: minio_admin | |
| MINIO_SECRET_KEY: minio_password | |
| PORT: 8000 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install root dependencies | |
| run: npm ci | |
| - name: Install API dependencies | |
| run: npm ci | |
| working-directory: apps/api | |
| - name: Install Web dependencies | |
| run: npm ci | |
| working-directory: apps/web | |
| - name: Run dependency security audit | |
| run: npm run audit:security | |
| - name: Run Prisma migrations | |
| run: npx prisma migrate deploy --schema=./prisma/schema.prisma | |
| working-directory: apps/api | |
| - name: Run release risk preflight | |
| run: npm run risk:preflight:db | |
| - name: Validate Docker Compose files | |
| run: npm run compose:config | |
| # Policy: ``npm run validate`` runs format -> lint -> typecheck -> test -> build. | |
| # The lint step must NOT use --fix in CI; developers use ``npm run lint:fix`` locally. | |
| - name: Validate | |
| run: npm run validate |