forge/.github/workflows/ci.yml at main · hackclub/forge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
name: CI

on:
  pull_request:
  push:
    branches: [ main ]

permissions:
  contents: read

jobs:
  scan_ruby:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true

      - name: Scan for common Rails security vulnerabilities using static analysis
        run: bin/brakeman --no-pager

  scan_js:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: lts/*
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Scan for security vulnerabilities in JavaScript dependencies
        run: npm audit --omit=dev

  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true

      - name: Lint code for consistent style
        run: bin/rubocop -f github

  lint_js:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Node
        uses: actions/setup-node@v6
        with:
          node-version: lts/*
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: Check formatting with Prettier
        run: npm run format:check

  annotate_check:
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
        ports:
          - 5432:5432
        options: --health-cmd "pg_isready" --health-interval 10s --health-timeout 5s --health-retries 5

    env:
      DATABASE_URL: postgres://postgres:postgres@localhost:5432/forge_ci

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true

      - name: Set up database
        run: bin/rails db:create db:schema:load

      - name: Check if annotations are up to date
        run: |
          bundle exec annotaterb models --frozen --show-migration
          bundle exec annotaterb routes --frozen

  # test:
  #   runs-on: ubuntu-latest

  #   # services:
  #   #  redis:
  #   #    image: redis
  #   #    ports:
  #   #      - 6379:6379
  #   #    options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
  #   steps:
  #     - name: Install packages
  #       run: sudo apt-get update && sudo apt-get install --no-install-recommends -y build-essential git libyaml-dev pkg-config google-chrome-stable

  #     - name: Checkout code
  #       uses: actions/checkout@v6

  #     - name: Set up Ruby
  #       uses: ruby/setup-ruby@v1
  #       with:
  #         ruby-version: .ruby-version
  #         bundler-cache: true

  #     - name: Run tests
  #       env:
  #         RAILS_ENV: test
  #         # REDIS_URL: redis://localhost:6379/0
  #       run: bin/rails db:test:prepare test test:system

  #     - name: Keep screenshots from failed system tests
  #       uses: actions/upload-artifact@v4
  #       if: failure()
  #       with:
  #         name: screenshots
  #         path: ${{ github.workspace }}/tmp/screenshots
  #         if-no-files-found: ignore