Skip to content

Commit 85b3060

Browse files
rafaelrsantostirafaelrsantosti
authored
feat: improve CI/CD pipelines and add community standards (#6)
* ci(tests): improve test workflow with best practices - Add reusable workflow support (workflow_call) for release pipelines - Add Python linting with ruff (check and format) - Add TypeScript type checking (tsc --noEmit) - Add Trivy security scanning for vulnerabilities - Add Codecov integration for coverage reports - Implement path-based filtering to only test changed components - Update Python version to 3.13 - Add proper output handling for workflow_call inputs - Create aggregator job to ensure all tests pass before merge * ci(release): add independent release workflows for API and Portal - Create release-api.yml for independent API releases (api/v* tags) - Create release-portal.yml for independent Portal releases (portal/v* tags) - Run tests before building (quality gate) - Add Trivy security scanning on container images - Generate SBOM and provenance attestation - Auto-generate changelog from commits - Support semantic versioning with prerelease detection - Add major.minor tags (e.g., 1.2) for stable releases * ci(release): update combined release workflow with quality gates - Add test job as prerequisite (blocks release if tests fail) - Add Trivy security scanning on both container images - Generate SBOM and provenance attestation - Add major.minor tags for stable releases - Include image digest in release notes - Improve changelog generation * ci(build): optimize build workflow with path-based filtering - Add path-based change detection (only build changed components) - Split into separate jobs for API and Portal - Add scoped caching for better cache hits - Remove release-related triggers (handled by release workflows) - Trigger on push to main/develop and PRs * docs(community): add Code of Conduct Add Contributor Covenant Code of Conduct v2.1 to establish community guidelines and enforcement procedures. * docs(security): add security policy - Define supported versions - Document vulnerability reporting process - Add response timeline expectations - Include security best practices for contributors - List security features of the project * chore(community): add PR template and CODEOWNERS - Add pull request template with checklist and guidelines - Add CODEOWNERS to define code ownership by area: - Backend team reviews api/ changes - Frontend team reviews portal/ changes - Platform team reviews CI/CD and infrastructure - Maintainers review security-sensitive files * ci(deps): add Dependabot configuration Configure automatic dependency updates for: - Python packages (api/) - npm packages (portal/) - GitHub Actions - Docker base images Features: - Weekly schedule (Monday 9am BRT) - Grouped updates for related packages - Auto-assign reviewers by team - Conventional commit prefixes * ci(automation): add stale bot for inactive issues and PRs - Mark issues as stale after 60 days of inactivity - Mark PRs as stale after 30 days of inactivity - Auto-close after additional 14 days without activity - Exempt issues with labels: pinned, security, epic, roadmap - Exempt PRs with labels: pinned, security, work-in-progress - Remove stale label when activity resumes * ci(automation): add automatic PR labeling Add workflow to automatically label PRs based on changed files: - api: changes in api/ - portal: changes in portal/ - documentation: changes in *.md files - ci: changes in .github/ - infrastructure: changes in docker/, scripts/ - tests: changes in test files - database: changes in migrations/models - security: changes in auth/security files - dependencies: changes in requirements/package.json - kubernetes: changes in templates/*.j2 * ci(automation): add welcome bot for new contributors Automatically send a welcome message to first-time contributors when they open their first issue or pull request. * docs(ci): update workflows documentation - Add pipeline overview diagram - Document best practices implemented - Add detailed workflow descriptions - Include versioning strategy guide - Add usage examples for releases - Document branch protection setup - Add troubleshooting section * fix(release): prevent prereleases from updating latest and minor tags Use docker/metadata-action to conditionally skip 'latest' and 'minor' tags for prerelease versions (e.g., v1.0.0-beta.1). This ensures production environments pulling 'latest' won't unexpectedly receive beta or release candidate code. * fix(ci): rename test job to match required status check --------- Co-authored-by: rafaelrsantosti <11065120+rafaelrsantosti@users.noreply.github.com>
1 parent 2842472 commit 85b3060

15 files changed

Lines changed: 1609 additions & 97 deletions

‎.github/CODEOWNERS‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# CODEOWNERS - Define code ownership for automatic review requests
2+
# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
3+
4+
# Default owners for everything in the repo
5+
* @grid-labs-tech/maintainers
6+
7+
# API (Backend)
8+
/api/ @grid-labs-tech/backend
9+
10+
# Portal (Frontend)
11+
/portal/ @grid-labs-tech/frontend
12+
13+
# Infrastructure and CI/CD
14+
/.github/ @grid-labs-tech/platform
15+
/docker/ @grid-labs-tech/platform
16+
/scripts/ @grid-labs-tech/platform
17+
Makefile @grid-labs-tech/platform
18+
19+
# Documentation
20+
*.md @grid-labs-tech/maintainers
21+
/adrs/ @grid-labs-tech/maintainers
22+
23+
# Security-sensitive files
24+
/.github/workflows/ @grid-labs-tech/maintainers
25+
/api/app/shared/core/security.py @grid-labs-tech/maintainers

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
## Description
2+
3+
<!-- Provide a brief description of the changes in this PR -->
4+
5+
## Related Issue
6+
7+
<!-- Link to the issue this PR addresses (e.g., Closes #123) -->
8+
9+
Closes #
10+
11+
## Type of Change
12+
13+
<!-- Mark the relevant option with an "x" -->
14+
15+
- [ ] 🐛 Bug fix (non-breaking change that fixes an issue)
16+
- [ ] ✨ New feature (non-breaking change that adds functionality)
17+
- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to change)
18+
- [ ] 📚 Documentation update
19+
- [ ] 🔧 Refactoring (no functional changes)
20+
- [ ] 🧪 Tests (adding or updating tests)
21+
- [ ] 🏗️ Infrastructure/CI changes
22+
23+
## Component Affected
24+
25+
<!-- Mark the relevant option(s) with an "x" -->
26+
27+
- [ ] API (backend)
28+
- [ ] Portal (frontend)
29+
- [ ] Documentation
30+
- [ ] CI/CD
31+
- [ ] Other: <!-- specify -->
32+
33+
## Checklist
34+
35+
<!-- Mark completed items with an "x" -->
36+
37+
### General
38+
- [ ] I have read the [CONTRIBUTING.md](../CONTRIBUTING.md) guidelines
39+
- [ ] My code follows the project's code style
40+
- [ ] I have performed a self-review of my code
41+
- [ ] I have commented my code in hard-to-understand areas
42+
- [ ] My changes generate no new warnings or errors
43+
44+
### Testing
45+
- [ ] I have added tests that prove my fix/feature works
46+
- [ ] New and existing unit tests pass locally with my changes
47+
- [ ] I have tested my changes manually
48+
49+
### Documentation
50+
- [ ] I have updated the documentation accordingly
51+
- [ ] I have updated the README if needed
52+
53+
## Screenshots (if applicable)
54+
55+
<!-- Add screenshots to help explain your changes -->
56+
57+
## Test Plan
58+
59+
<!-- Describe how you tested your changes -->
60+
61+
1.
62+
2.
63+
3.
64+
65+
## Additional Notes
66+
67+
<!-- Add any additional context or notes for reviewers -->
68+

‎.github/dependabot.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
# Dependabot configuration
2+
# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
3+
4+
version: 2
5+
updates:
6+
# Python dependencies (API)
7+
- package-ecosystem: "pip"
8+
directory: "/api"
9+
schedule:
10+
interval: "weekly"
11+
day: "monday"
12+
time: "09:00"
13+
timezone: "America/Sao_Paulo"
14+
open-pull-requests-limit: 5
15+
labels:
16+
- "dependencies"
17+
- "python"
18+
- "api"
19+
commit-message:
20+
prefix: "chore(deps)"
21+
reviewers:
22+
- "grid-labs-tech/backend"
23+
groups:
24+
# Group minor and patch updates together
25+
python-minor:
26+
patterns:
27+
- "*"
28+
update-types:
29+
- "minor"
30+
- "patch"
31+
32+
# npm dependencies (Portal)
33+
- package-ecosystem: "npm"
34+
directory: "/portal"
35+
schedule:
36+
interval: "weekly"
37+
day: "monday"
38+
time: "09:00"
39+
timezone: "America/Sao_Paulo"
40+
open-pull-requests-limit: 5
41+
labels:
42+
- "dependencies"
43+
- "javascript"
44+
- "portal"
45+
commit-message:
46+
prefix: "chore(deps)"
47+
reviewers:
48+
- "grid-labs-tech/frontend"
49+
groups:
50+
# Group React ecosystem updates
51+
react:
52+
patterns:
53+
- "react"
54+
- "react-dom"
55+
- "react-router*"
56+
- "@types/react*"
57+
# Group testing libraries
58+
testing:
59+
patterns:
60+
- "vitest"
61+
- "@vitest/*"
62+
- "@testing-library/*"
63+
- "jsdom"
64+
# Group build tools
65+
build:
66+
patterns:
67+
- "vite"
68+
- "@vitejs/*"
69+
- "typescript"
70+
- "eslint*"
71+
- "@typescript-eslint/*"
72+
# Group minor/patch for everything else
73+
npm-minor:
74+
patterns:
75+
- "*"
76+
update-types:
77+
- "minor"
78+
- "patch"
79+
exclude-patterns:
80+
- "react*"
81+
- "@types/react*"
82+
- "vitest"
83+
- "@vitest/*"
84+
- "@testing-library/*"
85+
- "vite"
86+
- "@vitejs/*"
87+
- "typescript"
88+
- "eslint*"
89+
- "@typescript-eslint/*"
90+
91+
# GitHub Actions
92+
- package-ecosystem: "github-actions"
93+
directory: "/"
94+
schedule:
95+
interval: "weekly"
96+
day: "monday"
97+
time: "09:00"
98+
timezone: "America/Sao_Paulo"
99+
open-pull-requests-limit: 5
100+
labels:
101+
- "dependencies"
102+
- "github-actions"
103+
- "ci"
104+
commit-message:
105+
prefix: "chore(ci)"
106+
reviewers:
107+
- "grid-labs-tech/platform"
108+
109+
# Docker base images
110+
- package-ecosystem: "docker"
111+
directory: "/api"
112+
schedule:
113+
interval: "weekly"
114+
day: "monday"
115+
time: "09:00"
116+
timezone: "America/Sao_Paulo"
117+
labels:
118+
- "dependencies"
119+
- "docker"
120+
- "api"
121+
commit-message:
122+
prefix: "chore(docker)"
123+
124+
- package-ecosystem: "docker"
125+
directory: "/portal"
126+
schedule:
127+
interval: "weekly"
128+
day: "monday"
129+
time: "09:00"
130+
timezone: "America/Sao_Paulo"
131+
labels:
132+
- "dependencies"
133+
- "docker"
134+
- "portal"
135+
commit-message:
136+
prefix: "chore(docker)"

‎.github/labeler.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# Configuration for PR Labeler
2+
# https://github.com/actions/labeler
3+
4+
# API (Backend)
5+
api:
6+
- changed-files:
7+
- any-glob-to-any-file: 'api/**'
8+
9+
# Portal (Frontend)
10+
portal:
11+
- changed-files:
12+
- any-glob-to-any-file: 'portal/**'
13+
14+
# Documentation
15+
documentation:
16+
- changed-files:
17+
- any-glob-to-any-file:
18+
- '**/*.md'
19+
- 'adrs/**'
20+
- 'docs/**'
21+
22+
# CI/CD
23+
ci:
24+
- changed-files:
25+
- any-glob-to-any-file:
26+
- '.github/**'
27+
- 'Makefile'
28+
29+
# Infrastructure
30+
infrastructure:
31+
- changed-files:
32+
- any-glob-to-any-file:
33+
- 'docker/**'
34+
- 'scripts/**'
35+
- '**/Dockerfile*'
36+
- 'docker-compose*.yml'
37+
38+
# Tests
39+
tests:
40+
- changed-files:
41+
- any-glob-to-any-file:
42+
- '**/*test*.py'
43+
- '**/*test*.ts'
44+
- '**/*test*.tsx'
45+
- '**/tests/**'
46+
- '**/__tests__/**'
47+
48+
# Database
49+
database:
50+
- changed-files:
51+
- any-glob-to-any-file:
52+
- 'api/alembic/**'
53+
- 'api/app/models/**'
54+
55+
# Security
56+
security:
57+
- changed-files:
58+
- any-glob-to-any-file:
59+
- '**/security*'
60+
- '**/auth*'
61+
- 'SECURITY.md'
62+
63+
# Dependencies
64+
dependencies:
65+
- changed-files:
66+
- any-glob-to-any-file:
67+
- '**/requirements*.txt'
68+
- '**/package*.json'
69+
- '**/Pipfile*'
70+
- '**/poetry.lock'
71+
- '**/pyproject.toml'
72+
73+
# Kubernetes related
74+
kubernetes:
75+
- changed-files:
76+
- any-glob-to-any-file:
77+
- 'api/app/templates/**'
78+
- '**/*.j2'
79+
- '**/manifests/**'

0 commit comments

Comments
 (0)