0pt/.gitea/workflows/ci.yml

name: CI (SIAX Cloud)

# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2),
# following the fleet-wide pattern (quality gate -> advisory security scan).
#
# WHAT THIS REPO SHIPS: a Next.js 16 web console PLUS the 0pt capability layer
# (src/, tests/). Wave 2/3 hardening added a real test runner (vitest), a
# scoped strict type-check (tsconfig.check.json), and a flat ESLint config, so
# the quality gate now runs them:
#   * typecheck (BLOCKING) -> `tsc -p tsconfig.check.json` over src/ + tests/.
#   * test      (BLOCKING) -> `vitest run` (the src/ capability + auth + validation suites).
#   * lint      (ADVISORY, continue-on-error) -> `eslint src tests`. The v0-generated
#                 legacy adapter/test tree carries pre-existing lint noise
#                 (explicit-any / require-style imports), so lint is advisory to
#                 avoid blocking merges on inherited debt; the Wave 2 auth/validation
#                 additions themselves are lint-clean. Flip to blocking once the
#                 legacy noise is cleared.
#   * build     (BLOCKING) -> `next build` compiles the whole app.
#
# The security job is intentionally advisory (separate job, `--exit-code 0`) so
# it never blocks merges, matching the fleet convention.
on:
  push:
    branches: ["**"]
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "0 4 * * *"   # daily safety re-run so CI runs even without a push

jobs:
  quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
      - name: Enable corepack + pin pnpm@9 (pnpm-lock.yaml is lockfileVersion 9.0)
        run: |
          corepack enable
          corepack prepare pnpm@9 --activate
      - name: Install (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Typecheck (tsc over src/ + tests/ -- blocking)
        run: pnpm run typecheck
      - name: Test (vitest -- blocking)
        run: pnpm run test
      - name: Lint (eslint -- advisory; legacy tree has pre-existing noise)
        continue-on-error: true
        run: pnpm run lint
      - name: Build (next build -- blocking quality gate)
        run: pnpm run build

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Install Trivy natively and scan the checked-out workspace directly.
      # (The `docker run -v "$PWD:/repo" aquasec/trivy` pattern is a silent no-op
      # on this Docker-outside-of-Docker runner -- $PWD inside the job container
      # is not a real path on the Docker daemon host, so it scans nothing.)
      - name: Install Trivy
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
      - name: Trivy scan (vuln + secrets, advisory)
        run: |
          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 .