96 lines
2.5 KiB
YAML
96 lines
2.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
env:
|
|
POSTGRES_DB: configcenter_test
|
|
POSTGRES_USER: configcenter
|
|
POSTGRES_PASSWORD: configcenter
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U configcenter -d configcenter_test"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 20
|
|
env:
|
|
TEST_DATABASE_URL: postgres://configcenter:configcenter@127.0.0.1:5432/configcenter_test?sslmode=disable
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v6
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: "24"
|
|
cache: npm
|
|
cache-dependency-path: web/package-lock.json
|
|
|
|
- name: Set up protoc
|
|
uses: arduino/setup-protoc@v3
|
|
with:
|
|
version: "25.1"
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Verify generated protobuf code
|
|
run: make proto-check
|
|
|
|
- name: golangci-lint
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: v2.12.2
|
|
|
|
- name: Go vulnerability check
|
|
run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
|
|
|
|
- name: Go tests
|
|
run: GOCACHE=/tmp/configcenter-go-cache go test ./...
|
|
|
|
- name: Go race tests
|
|
run: GOCACHE=/tmp/configcenter-go-cache go test -race ./...
|
|
|
|
- name: Python SDK compile check
|
|
run: PYTHONPATH="$PWD/.tools/python:$PWD/sdk/python" python -m compileall -q sdk/python/configcenter
|
|
|
|
- name: Web build
|
|
run: npm --prefix web ci && npm --prefix web run build
|
|
|
|
- name: Validate YAML, Compose and migrations
|
|
env:
|
|
MIGRATION_BASE_REF: ${{ github.event.pull_request.base.sha || github.event.before }}
|
|
run: make validate-manifests
|
|
|
|
- name: Dependency vulnerability scan
|
|
uses: aquasecurity/trivy-action@v0.36.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
scanners: vuln
|
|
severity: HIGH,CRITICAL
|
|
ignore-unfixed: false
|
|
exit-code: 1
|