Harden demo security headers and live-mode gates #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| test: | |
| name: unit · typecheck · e2e | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| services: | |
| postgres: | |
| image: postgres:15 | |
| env: | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: app_db | |
| ports: ["5432:5432"] | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| env: | |
| NEXT_TELEMETRY_DISABLED: 1 | |
| DATABASE_URL: postgresql://postgres:postgres@localhost:5432/app_db | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Unit tests | |
| run: npm test | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Apply schema | |
| run: npx drizzle-kit push | |
| - name: Install Playwright Chromium | |
| run: npx playwright install --with-deps chromium | |
| - name: End-to-end tests | |
| run: npm run test:e2e | |
| env: | |
| CI: true | |
| - name: Upload Playwright report | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: playwright-report | |
| path: playwright-report/ | |
| retention-days: 7 | |
| eval-gate: | |
| name: Eval gate (agentic quality) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| services: | |
| postgres: | |
| image: postgres:15 | |
| env: | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: app_db | |
| ports: ["5432:5432"] | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| env: | |
| DATABASE_URL: postgresql://postgres:postgres@localhost:5432/app_db | |
| NEXT_TELEMETRY_DISABLED: 1 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Apply schema | |
| run: npx drizzle-kit push | |
| - name: Build | |
| run: npm run build | |
| - name: Start server | |
| run: | | |
| npm run start & | |
| for i in $(seq 1 60); do | |
| curl -sf http://localhost:3000/api/health && echo " -> server up" && exit 0 | |
| sleep 2 | |
| done | |
| echo "server did not start" && exit 1 | |
| - name: Run eval harness (golden set) | |
| run: | | |
| node -e " | |
| fetch('http://localhost:3000/api/eval?limit=2') | |
| .then(r => r.json()) | |
| .then(j => { | |
| console.log('eval:', JSON.stringify(j)); | |
| if (!j.gate) { console.error('EVAL GATE FAILED'); process.exit(1); } | |
| console.log('EVAL GATE PASSED'); | |
| }) | |
| .catch(e => { console.error(e); process.exit(1); }); | |
| " |