fix: resolve CI issues and add security audit #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| env: | |
| MIX_ENV: test | |
| jobs: | |
| # Matrix testing for compatibility (inspired by Anthropix) | |
| test: | |
| name: Test (Elixir ${{matrix.elixir}} / OTP ${{matrix.otp}}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Primary development version (uses mise) | |
| - elixir: "mise" | |
| otp: "mise" | |
| use_mise: true | |
| lint: true | |
| coverage: true | |
| # Compatibility testing (uses erlef/setup-beam) | |
| - elixir: "1.17" | |
| otp: "26" | |
| use_mise: false | |
| - elixir: "1.18" | |
| otp: "27" | |
| use_mise: false | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| # Setup using mise (for primary development version) | |
| - name: Install mise and tools | |
| if: matrix.use_mise | |
| uses: jdx/mise-action@v3 | |
| with: | |
| install: true | |
| cache: true | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # Setup using erlef/setup-beam (for compatibility testing) | |
| - name: Setup Elixir | |
| if: "!matrix.use_mise" | |
| uses: erlef/setup-beam@v1 | |
| with: | |
| elixir-version: ${{ matrix.elixir }} | |
| otp-version: ${{ matrix.otp }} | |
| version-type: strict | |
| # Enhanced caching strategy | |
| - name: Cache dependencies (mise) | |
| if: matrix.use_mise | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps/ | |
| _build/ | |
| key: ${{ runner.os }}-mise-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}-${{ hashFiles('mise.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-mise-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}- | |
| ${{ runner.os }}-mise-mix- | |
| - name: Cache dependencies (standard) | |
| if: "!matrix.use_mise" | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps/ | |
| _build/ | |
| key: ${{ runner.os }}-${{ matrix.elixir }}-otp${{ matrix.otp }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ matrix.elixir }}-otp${{ matrix.otp }}-mix- | |
| ${{ runner.os }}-mix- | |
| - name: Install dependencies | |
| run: mix deps.get | |
| # Conditional linting (inspired by OpenAI_ex) | |
| - name: Check code formatting | |
| if: matrix.lint | |
| run: mix format --check-formatted | |
| - name: Check for unused dependencies | |
| if: matrix.lint | |
| run: mix deps.unlock --check-unused | |
| - name: Run Credo | |
| if: matrix.lint | |
| run: mix credo --strict | |
| - name: Compile application (warnings as errors for lint job) | |
| if: matrix.lint | |
| run: mix compile --warnings-as-errors | |
| - name: Compile application (standard) | |
| if: "!matrix.lint" | |
| run: mix compile | |
| - name: Run tests (with warnings as errors for lint job) | |
| if: matrix.lint | |
| run: mix test --warnings-as-errors | |
| - name: Run tests (standard) | |
| if: "!matrix.lint" | |
| run: mix test | |
| # Coverage only on primary version | |
| - name: Generate coverage report | |
| if: matrix.coverage | |
| run: mix coveralls.github | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload coverage artifacts | |
| if: matrix.coverage | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage-report | |
| path: cover/ | |
| # Pre-commit validation (parallel with test) | |
| pre-commit: | |
| name: Pre-commit Checks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install mise and tools | |
| uses: jdx/mise-action@v3 | |
| with: | |
| install: true | |
| cache: true | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Cache dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps/ | |
| _build/ | |
| key: ${{ runner.os }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}-${{ hashFiles('lib/**/*.ex') }}-${{ hashFiles('test/**/*.exs') }}-${{ hashFiles('mise.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}-${{ hashFiles('lib/**/*.ex') }}-${{ hashFiles('test/**/*.exs') }}- | |
| ${{ runner.os }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}- | |
| ${{ runner.os }}-mix- | |
| - name: Install dependencies | |
| run: | | |
| mix local.hex --force | |
| mix deps.get | |
| - name: Run pre-commit | |
| uses: pre-commit/action@v3.0.1 | |
| # Documentation generation (depends on successful test) | |
| docs: | |
| name: Documentation | |
| runs-on: ubuntu-latest | |
| needs: test | |
| env: | |
| MIX_ENV: dev | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install mise and tools | |
| uses: jdx/mise-action@v3 | |
| with: | |
| install: true | |
| cache: true | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Cache dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps/ | |
| _build/ | |
| key: ${{ runner.os }}-mix-dev-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}-${{ hashFiles('mise.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-mix-dev-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}- | |
| ${{ runner.os }}-mix-dev- | |
| - name: Install dependencies | |
| run: mix deps.get | |
| - name: Generate documentation | |
| run: mix docs | |
| - name: Upload documentation | |
| if: github.ref == 'refs/heads/main' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: documentation | |
| path: doc/ | |
| # Security audit (parallel with test) | |
| security: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install mise and tools | |
| uses: jdx/mise-action@v3 | |
| with: | |
| install: true | |
| cache: true | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Cache dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps/ | |
| _build/ | |
| key: ${{ runner.os }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}-${{ hashFiles('mise.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}- | |
| ${{ runner.os }}-mix- | |
| - name: Install dependencies | |
| run: mix deps.get | |
| - name: Check for security vulnerabilities | |
| run: mix deps.audit | |
| # Dependency analysis (parallel with test) | |
| dependency_check: | |
| name: Dependency Analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install mise and tools | |
| uses: jdx/mise-action@v3 | |
| with: | |
| install: true | |
| cache: true | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Cache dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| deps/ | |
| _build/ | |
| key: ${{ runner.os }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}-${{ hashFiles('mise.toml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-mix-${{ hashFiles(format('{0}{1}', github.workspace, '/mix.lock')) }}- | |
| ${{ runner.os }}-mix- | |
| - name: Install dependencies | |
| run: mix deps.get | |
| - name: Check dependency status | |
| run: mix hex.outdated | |
| # CI Results summary (inspired by WebSocket Bridge) | |
| results: | |
| name: CI Results | |
| runs-on: ubuntu-latest | |
| needs: [test, pre-commit, docs, security, dependency_check] | |
| if: always() | |
| steps: | |
| - name: Check job results | |
| run: | | |
| echo "Test job result: ${{ needs.test.result }}" | |
| echo "Pre-commit job result: ${{ needs.pre-commit.result }}" | |
| echo "Docs job result: ${{ needs.docs.result }}" | |
| echo "Security job result: ${{ needs.security.result }}" | |
| echo "Dependency check result: ${{ needs.dependency_check.result }}" | |
| if [[ "${{ needs.test.result }}" == "failure" || "${{ needs.pre-commit.result }}" == "failure" || "${{ needs.docs.result }}" == "failure" || "${{ needs.security.result }}" == "failure" || "${{ needs.dependency_check.result }}" == "failure" ]]; then | |
| echo "❌ CI Pipeline Failed" | |
| exit 1 | |
| else | |
| echo "✅ CI Pipeline Passed" | |
| fi |