ci.ymlā¢3.92 kB
name: CI
on:
push:
branches: [ main, master, develop ]
paths:
- 'apps/**'
- 'packages/**'
- 'package.json'
- 'pnpm-lock.yaml'
- '.github/workflows/ci.yml'
- 'tsconfig.json'
- '**/*.ts'
- '**/*.tsx'
- '**/*.js'
- '**/*.jsx'
- '**/*.json'
pull_request:
branches: [ main, master, develop ]
paths:
- 'apps/**'
- 'packages/**'
- 'package.json'
- 'pnpm-lock.yaml'
- '.github/workflows/ci.yml'
- 'tsconfig.json'
- '**/*.ts'
- '**/*.tsx'
- '**/*.js'
- '**/*.jsx'
- '**/*.json'
jobs:
test:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [18.x, 20.x, 22.x]
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Node.js ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
- name: Setup pnpm
uses: pnpm/action-setup@v4
- name: Get pnpm store directory
shell: bash
run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
- name: Setup pnpm cache
uses: actions/cache@v4
with:
path: ${{ env.STORE_PATH }}
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
restore-keys: |
${{ runner.os }}-pnpm-store-
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Lint code
run: pnpm lint || echo "Linting skipped - no lint script found"
- name: Type check
run: pnpm build
- name: Run tests
run: pnpm test || echo "Tests skipped - no test script found"
build-check:
runs-on: ubuntu-latest
needs: test
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build Docker image (no push)
uses: docker/build-push-action@v5
with:
context: .
file: ./Dockerfile
platforms: linux/amd64
push: false
cache-from: type=gha
cache-to: type=gha,mode=max
build-args: |
BUILD_DATE=${{ github.event.head_commit.timestamp }}
VCS_REF=${{ github.sha }}
- name: Test Docker image
run: |
# Build image locally for testing
docker build -t egh-research-test .
# Run container in background
docker run -d --name test-container -p 3000:3000 egh-research-test
# Wait for container to start
sleep 10
# Test health endpoint
curl -f http://localhost:3000/health || exit 1
# Test API docs endpoint
curl -f http://localhost:3000/api/docs || exit 1
# Clean up
docker stop test-container
docker rm test-container
security-scan:
runs-on: ubuntu-latest
needs: test
if: github.event_name == 'push'
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: '.'
format: 'sarif'
output: 'trivy-results.sarif'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: 'trivy-results.sarif'
dependency-review:
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Dependency Review
uses: actions/dependency-review-action@v4
with:
fail-on-severity: high