0pt/.gitea/workflows/ci.yml

name: CI (SIAX Cloud)

# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2).
# Quality gate for the Next.js 16 web console + the 0pt capability layer.
#
#   * typecheck (BLOCKING) -> `tsc -p tsconfig.check.json` over src/ + tests/.
#   * test      (BLOCKING) -> `vitest run`.
#   * lint      (ADVISORY) -> `eslint src tests` (legacy v0-generated noise
#                 is inherited debt; continue-on-error so it never blocks).
#   * build     (BLOCKING) -> `next build`.
#
#   * security  (BLOCKING) -> `trivy fs` over the repo; fails the build on
#                 HIGH/CRITICAL vulns or detected secrets. This is a REQUIRED
#                 protected-branch context -- see the job's own comment.
#
# Nightly re-runs live in nightly.yml; security.yml is the dedicated
# push/PR/weekly scanner (this file is push/PR-only).
on:
  push:
    branches: ["**"]
  pull_request:
  workflow_dispatch:

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Enable corepack + pin pnpm@9 (pnpm-lock.yaml is lockfileVersion 9.0)
        run: |
          corepack enable
          corepack prepare pnpm@9 --activate
      - name: Install (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Typecheck (tsc over src/ + tests/ -- blocking)
        run: pnpm run typecheck
      - name: Test (vitest -- blocking)
        run: pnpm run test
      - name: Lint (eslint -- advisory; legacy tree has pre-existing noise)
        continue-on-error: true
        run: pnpm run lint
      - name: Build (next build -- blocking quality gate)
        run: pnpm run build

  # REAL-DEPENDENCY integration tests (Master-DoD §48: "integration tests ...
  # Mocks alone count as insufficient"; §10 Search/Analytics). Runs
  # tests/integration/* against a LIVE OpenSearch + LIVE ClickHouse started as
  # service containers.
  #
  # SERVICE-CONTAINER DISCIPLINE is copied from sax3l/st0re's ci.yml, which
  # documents three measured defects on these runners (alias collision across
  # repos, sibling-run collision behind one alias, and DNS round-robin):
  #   * repo-unique aliases (opt-ci-opensearch / opt-ci-clickhouse),
  #   * SELF-IDENTIFYING containers — OpenSearch carries a run-unique
  #     cluster.name; ClickHouse carries run-unique credentials — so the
  #     select step can positively identify THIS run's container,
  #   * enumerate every IP behind the alias (getent ahostsv4), keep the one
  #     that proves the run identity, freeze it into the URL env var,
  #   * no match = hard failure, never a silent fallback or skip.
  integration:
    runs-on: ubuntu-latest
    services:
      opt-ci-opensearch:
        image: opensearchproject/opensearch:2.11.1
        env:
          discovery.type: single-node
          DISABLE_SECURITY_PLUGIN: "true"
          OPENSEARCH_JAVA_OPTS: "-Xms512m -Xmx512m"
          # Identity badge: only THIS run's container answers with this
          # cluster_name (the OpenSearch image maps dotted env keys to
          # settings).
          cluster.name: opt_ci_${{ github.run_id }}_${{ github.run_attempt }}
        # `--workdir` is REQUIRED (measured 2026-08-31, PR #25 CI run 7745,
        # job "integration"): this runner's act_runner (v0.6.1) merges the
        # JOB's WorkingDir (`/workspace/sax3l/0pt`) into every SERVICE
        # container's config, clobbering the image's own `WORKDIR
        # /usr/share/opensearch`. OpenSearch's ENTRYPOINT is the
        # WORKDIR-relative `./opensearch-docker-entrypoint.sh`, so with the
        # wrong cwd the container failed with "exec:
        # \"./opensearch-docker-entrypoint.sh\": stat ...: no such file or
        # directory" before it ever bound a port. ClickHouse's entrypoint is
        # an absolute path, so it was unaffected by the same defect — do not
        # assume a green ClickHouse service means service-container options
        # are fine in general.
        options: >-
          --workdir /usr/share/opensearch
          --health-cmd "curl -fsS http://localhost:9200/_cluster/health || exit 1"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 60
      opt-ci-clickhouse:
        image: clickhouse/clickhouse-server:24.8
        env:
          CLICKHOUSE_USER: opt_ci
          # Identity badge: run-unique password — an authenticated SELECT only
          # succeeds against THIS run's container. CI-scoped throwaway value,
          # not a secret (exists only for the lifetime of the job).
          CLICKHOUSE_PASSWORD: ci_${{ github.run_id }}_${{ github.run_attempt }}
          CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
        options: >-
          --health-cmd "wget -qO- http://localhost:8123/ping || exit 1"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 60
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Enable corepack + pin pnpm@9
        run: |
          corepack enable
          corepack prepare pnpm@9 --activate
      - name: Install (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Select THIS run's OpenSearch by identity (st0re ci.yml pattern)
        run: |
          set -eu
          WANT="opt_ci_${{ github.run_id }}_${{ github.run_attempt }}"
          FOUND=""
          for ip in $(getent ahostsv4 opt-ci-opensearch | awk '{print $1}' | sort -u); do
            NAME=$(curl -fsS --max-time 5 "http://$ip:9200/" | sed -n 's/.*"cluster_name" *: *"\([^"]*\)".*/\1/p' || true)
            echo "candidate $ip cluster_name=${NAME:-<none>}"
            if [ "$NAME" = "$WANT" ]; then FOUND="$ip"; fi
          done
          [ -n "$FOUND" ] || { echo "FATAL: no OpenSearch behind the alias identifies as $WANT"; exit 1; }
          echo "OPENSEARCH_URL=http://$FOUND:9200" >> "$GITHUB_ENV"
      - name: Select THIS run's ClickHouse by identity
        run: |
          set -eu
          PASS="ci_${{ github.run_id }}_${{ github.run_attempt }}"
          FOUND=""
          for ip in $(getent ahostsv4 opt-ci-clickhouse | awk '{print $1}' | sort -u); do
            OK=$(curl -fsS --max-time 5 -u "opt_ci:$PASS" "http://$ip:8123/?query=SELECT%201" || true)
            echo "candidate $ip auth_select=${OK:-<denied>}"
            if [ "$OK" = "1" ]; then FOUND="$ip"; fi
          done
          [ -n "$FOUND" ] || { echo "FATAL: no ClickHouse behind the alias accepts this run's credentials"; exit 1; }
          echo "CLICKHOUSE_URL=http://$FOUND:8123" >> "$GITHUB_ENV"
          echo "CLICKHOUSE_AUTH=opt_ci:$PASS" >> "$GITHUB_ENV"
      - name: Integration tests against LIVE OpenSearch + ClickHouse (blocking)
        run: |
          set -eu
          # Guard: env MUST be present here — the suites self-skip without it,
          # and a skipped suite must never masquerade as a green integration
          # gate (Master-DoD §56 status honesty).
          [ -n "${OPENSEARCH_URL:-}" ] && [ -n "${CLICKHOUSE_URL:-}" ]
          pnpm vitest run tests/integration 2>&1 | tee /tmp/itest.log
          if grep -qE "skipped" /tmp/itest.log && ! grep -qE "Tests  [0-9]+ passed" /tmp/itest.log; then
            echo "FATAL: integration suites skipped instead of running"; exit 1
          fi

  # BLOCKING. This job publishes the protected-branch status check context
  # "CI (SIAX Cloud) / security (push)", which branch protection on `main`
  # lists as required alongside "CI (SIAX Cloud) / quality (push)".
  #
  # It previously ran Trivy with `--exit-code 0`, which made the REQUIRED
  # context incapable of ever reporting failure. Measured 2026-09-08 on
  # main @4514d97: a planted CRITICAL secret (AWS secret access key) was
  # DETECTED by the scanner and the job still exited 0 -- i.e. the gate
  # reported success while holding a critical finding in hand. The same
  # command with `--exit-code 1` exits 1 on that planted secret and exits 0
  # on the clean tree, so this flag is the whole difference between a real
  # gate and a decorative one.
  #
  # KNOWN COVERAGE GAP (not fixed here, needs an owner decision):
  # services/scrapers/requirements.txt pins nothing (`>=` ranges only), so
  # Trivy's pip scanner cannot resolve versions and silently omits the file
  # from the scan entirely -- it is not a target in the report at all.
  # Pinning those same floors with `==` surfaces 3 HIGH findings today
  # (aiohttp CVE-2025-69223, aiohttp CVE-2026-69244, lxml CVE-2026-41066).
  # Do NOT paper over this with `--skip-dirs`; that would convert a
  # measurable blind spot into declared policy.
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install Trivy
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
      - name: Trivy scan (vuln + secrets -- BLOCKING, fails on HIGH/CRITICAL)
        run: |
          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 .