Per Hoener
ff9474f916
Deploy / scheduled-rebuild-dev (push) Skipped
Deploy / scheduled-rebuild-master (push) Skipped
Deploy / rollback-dev (push) Skipped
Deploy / rollback-master (push) Skipped
Deploy / validate-dispatch (push) Successful in 2s
Deploy / changes (push) Successful in 5s
Deploy / app-quality (push) Successful in 1m39s
Deploy / secret-scan (push) Successful in 6s
Deploy / security-deps (push) Successful in 6s
Deploy / context (push) Successful in 2s
Deploy / app-image (push) Successful in 2m52s
Deploy / deploy-master (push) Skipped
Deploy / deploy-dev (push) Successful in 17s
126 lines
3.2 KiB
YAML
126 lines
3.2 KiB
YAML
name: CI
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: website-starter-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
push:
|
|
branches-ignore:
|
|
- dev
|
|
- master
|
|
pull_request:
|
|
branches:
|
|
- dev
|
|
- master
|
|
types:
|
|
- opened
|
|
- synchronize
|
|
- reopened
|
|
- ready_for_review
|
|
|
|
env:
|
|
NODE_VERSION_FILE: .node-version
|
|
TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
|
|
|
|
jobs:
|
|
changes:
|
|
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
|
|
timeout-minutes: 5
|
|
outputs:
|
|
app: ${{ steps.detect.outputs.app }}
|
|
security_deps: ${{ steps.detect.outputs.security_deps }}
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
lfs: true
|
|
fetch-depth: 0
|
|
|
|
- name: Detect changed areas
|
|
id: detect
|
|
env:
|
|
CHANGESET_BEFORE: ${{ github.event.before }}
|
|
CHANGESET_PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
run: sh scripts/detect-ci-changes.sh
|
|
|
|
app:
|
|
needs: [changes]
|
|
if: needs.changes.outputs.app == 'true'
|
|
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
|
|
timeout-minutes: 30
|
|
env:
|
|
APP_URL: https://example.com
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
lfs: true
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: ${{ env.NODE_VERSION_FILE }}
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Restore and update image cache
|
|
env:
|
|
IMAGE_CACHE_NAMESPACE: ${{ github.head_ref || github.ref_name }}
|
|
run: sh scripts/prepare-image-cache.sh
|
|
|
|
- name: Lint
|
|
run: npm run lint
|
|
|
|
- name: Test
|
|
run: npm run test
|
|
|
|
- name: Type check
|
|
run: npm run typecheck
|
|
|
|
- name: Build
|
|
env:
|
|
SKIP_IMAGE_OPTIMIZATION: true
|
|
run: npm run build
|
|
|
|
- name: E2E smoke test
|
|
env:
|
|
SKIP_IMAGE_OPTIMIZATION: true
|
|
run: npm run test:e2e
|
|
|
|
secret-scan:
|
|
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
lfs: true
|
|
|
|
- name: Scan repository for committed secrets
|
|
run: sh scripts/trivy-scan.sh secret-fs .
|
|
|
|
security-deps:
|
|
needs: [changes]
|
|
if: needs.changes.outputs.security_deps == 'true'
|
|
runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
|
|
timeout-minutes: 30
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
lfs: true
|
|
|
|
- name: Report app dependency vulnerabilities
|
|
run: sh scripts/trivy-scan.sh vuln-fs .
|
|
|
|
- name: Block high and critical app dependency vulnerabilities
|
|
env:
|
|
TRIVY_SEVERITY: HIGH,CRITICAL
|
|
TRIVY_EXIT_CODE: 1
|
|
run: sh scripts/trivy-scan.sh vuln-fs .
|