0pt/.gitea/workflows/ci.yml

name: CI (SIAX Cloud)

# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2).
# Quality gate for the Next.js 16 web console + the 0pt capability layer.
#
#   * typecheck (BLOCKING) -> `tsc -p tsconfig.check.json` over src/ + tests/.
#   * test      (BLOCKING) -> `vitest run`.
#   * lint      (ADVISORY) -> `eslint src tests` (legacy v0-generated noise
#                 is inherited debt; continue-on-error so it never blocks).
#   * build     (BLOCKING) -> `next build`.
#
#   * security  (BLOCKING) -> `trivy fs` over the repo; fails the build on
#                 HIGH/CRITICAL vulns or detected secrets. This is a REQUIRED
#                 protected-branch context -- see the job's own comment.
#
# Nightly re-runs live in nightly.yml; security.yml is the dedicated
# push/PR/weekly scanner (this file is push/PR-only).
on:
  push:
    branches: ["main"]
  pull_request:
  workflow_dispatch:

# One run per ref; a branch push that also updates a PR used to start two full
# quality runs (and, on main, two deploy chains). Cancel the superseded one.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "pnpm"
          cache-dependency-path: pnpm-lock.yaml
      - name: Enable corepack + pin pnpm@9 (pnpm-lock.yaml is lockfileVersion 9.0)
        run: |
          corepack enable
          corepack prepare pnpm@9 --activate
      - name: Install (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Typecheck (tsc over src/ + tests/ -- blocking)
        run: pnpm run typecheck
      # UI-09: 0pt carried 82 axe color-contrast violations (impact=serious), the
      # estate's largest single a11y defect, and every one came from a Tailwind
      # alpha modifier on a text colour. The unmodified token measures 4.73:1
      # light / 7.63:1 dark and passes AA; every faded variant fails. Blocking,
      # because a contrast regression is invisible in review.
      - name: Text contrast shape (WCAG 2.2 AA 1.4.3 -- blocking)
        run: pnpm run check:contrast
      - name: Test (vitest -- blocking)
        run: pnpm run test
      - name: Lint (eslint -- advisory; legacy tree has pre-existing noise)
        continue-on-error: true
        run: pnpm run lint
      - name: Build (next build -- blocking quality gate)
        run: pnpm run build

  # REAL-DEPENDENCY integration tests (Master-DoD §48: "integration tests ...
  # Mocks alone count as insufficient"; §10 Search/Analytics). Runs
  # tests/integration/* against a LIVE OpenSearch + LIVE ClickHouse started as
  # service containers.
  #
  # SERVICE-CONTAINER DISCIPLINE is copied from sax3l/st0re's ci.yml, which
  # documents three measured defects on these runners (alias collision across
  # repos, sibling-run collision behind one alias, and DNS round-robin):
  #   * repo-unique aliases (opt-ci-opensearch / opt-ci-clickhouse),
  #   * SELF-IDENTIFYING containers — OpenSearch carries a run-unique
  #     cluster.name; ClickHouse carries run-unique credentials — so the
  #     select step can positively identify THIS run's container,
  #   * enumerate every IP behind the alias (getent ahostsv4), keep the one
  #     that proves the run identity, freeze it into the URL env var,
  #   * no match = hard failure, never a silent fallback or skip.
  integration:
    # Gitea currently ignores workflow concurrency. A branch push followed by
    # its PR synchronize event otherwise starts TWO 512 MiB OpenSearch JVMs
    # and ClickHouse suites on the same runner fleet at once; both timed out
    # creating their first index (runs 28904/28906). Keep the blocking LIVE
    # integration proof on every PR, on main push, and on manual dispatch;
    # ordinary branch pushes still run blocking quality/security.
    if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 45
    services:
      opt-ci-opensearch:
        image: opensearchproject/opensearch:2.11.1
        env:
          discovery.type: single-node
          DISABLE_SECURITY_PLUGIN: "true"
          OPENSEARCH_JAVA_OPTS: "-Xms512m -Xmx512m"
          # Identity badge: only THIS run's container answers with this
          # cluster_name (the OpenSearch image maps dotted env keys to
          # settings).
          cluster.name: opt_ci_${{ github.run_id }}_${{ github.run_attempt }}
          # Throwaway CI cluster: never let the runner's disk fill turn indices
          # read-only (the 403 index_create_block_exception seen in run 388536).
          cluster.routing.allocation.disk.threshold_enabled: "false"
        # `--workdir` is REQUIRED (measured 2026-08-31, PR #25 CI run 7745,
        # job "integration"): this runner's act_runner (v0.6.1) merges the
        # JOB's WorkingDir (`/workspace/sax3l/0pt`) into every SERVICE
        # container's config, clobbering the image's own `WORKDIR
        # /usr/share/opensearch`. OpenSearch's ENTRYPOINT is the
        # WORKDIR-relative `./opensearch-docker-entrypoint.sh`, so with the
        # wrong cwd the container failed with "exec:
        # \"./opensearch-docker-entrypoint.sh\": stat ...: no such file or
        # directory" before it ever bound a port. ClickHouse's entrypoint is
        # an absolute path, so it was unaffected by the same defect — do not
        # assume a green ClickHouse service means service-container options
        # are fine in general.
        options: >-
          --workdir /usr/share/opensearch
          --health-cmd "curl -fsS http://localhost:9200/_cluster/health || exit 1"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 60
      opt-ci-clickhouse:
        image: clickhouse/clickhouse-server:24.12
        env:
          CLICKHOUSE_USER: opt_ci
          # Identity badge: run-unique password — an authenticated SELECT only
          # succeeds against THIS run's container. CI-scoped throwaway value,
          # not a secret (exists only for the lifetime of the job).
          CLICKHOUSE_PASSWORD: ci_${{ github.run_id }}_${{ github.run_attempt }}
          CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
        options: >-
          --health-cmd "wget -qO- http://localhost:8123/ping || exit 1"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 60
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: "22"
          cache: "pnpm"
          cache-dependency-path: pnpm-lock.yaml
      - name: Enable corepack + pin pnpm@9
        run: |
          corepack enable
          corepack prepare pnpm@9 --activate
      - name: Install (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: Select THIS run's OpenSearch by identity (st0re ci.yml pattern)
        run: |
          set -eu
          WANT="opt_ci_${{ github.run_id }}_${{ github.run_attempt }}"
          FOUND=""
          for ip in $(getent ahostsv4 opt-ci-opensearch | awk '{print $1}' | sort -u); do
            NAME=$(curl -fsS --max-time 5 "http://$ip:9200/" | sed -n 's/.*"cluster_name" *: *"\([^"]*\)".*/\1/p' || true)
            echo "candidate $ip cluster_name=${NAME:-<none>}"
            if [ "$NAME" = "$WANT" ]; then FOUND="$ip"; fi
          done
          [ -n "$FOUND" ] || { echo "FATAL: no OpenSearch behind the alias identifies as $WANT"; exit 1; }

          # The single-node test cluster inherits the runner's disk watermark.
          # On a busy runner the flood-stage watermark makes every new index
          # read-only and the suite fails with HTTP 403
          # index_create_block_exception (measured on run 388536). The container
          # is throwaway CI state, so disable the disk threshold and PROVE that
          # index creation works before the blocking tests run.
          for attempt in 1 2 3 4 5; do
            # Disabling the watermark alone does NOT clear a cluster that is
            # already read-only: the flood stage sets
            # cluster.blocks.read_only_allow_delete and every write keeps
            # returning 403. Clear that block explicitly every attempt.
            curl -sS --max-time 10 -X PUT "http://$FOUND:9200/_cluster/settings" \
              -H 'Content-Type: application/json' \
              -d '{"persistent":{"cluster.routing.allocation.disk.threshold_enabled":false,"cluster.blocks.read_only_allow_delete":null}}' >/tmp/os-settings.json || true
            cat /tmp/os-settings.json 2>/dev/null || true
            probe_status=$(curl -sS --max-time 10 -o /tmp/os-probe.json -w '%{http_code}' -X PUT "http://$FOUND:9200/opt-ci-probe-${{ github.run_id }}")
            if [ "$probe_status" = "200" ]; then
              curl -fsS --max-time 10 -X DELETE "http://$FOUND:9200/opt-ci-probe-${{ github.run_id }}" >/dev/null || true
              echo "OpenSearch accepts index creation"
              break
            fi
            echo "index creation not ready (attempt $attempt/5, HTTP $probe_status) — waiting"
            cat /tmp/os-probe.json 2>/dev/null || true
            [ "$attempt" = "5" ] && { echo "FATAL: OpenSearch still refuses index creation"; exit 1; }
            sleep 10
          done
          echo "OPENSEARCH_URL=http://$FOUND:9200" >> "$GITHUB_ENV"
      - name: Select THIS run's ClickHouse by identity
        run: |
          set -eu
          PASS="ci_${{ github.run_id }}_${{ github.run_attempt }}"
          FOUND=""
          for ip in $(getent ahostsv4 opt-ci-clickhouse | awk '{print $1}' | sort -u); do
            OK=$(curl -fsS --max-time 5 -u "opt_ci:$PASS" "http://$ip:8123/?query=SELECT%201" || true)
            echo "candidate $ip auth_select=${OK:-<denied>}"
            if [ "$OK" = "1" ]; then FOUND="$ip"; fi
          done
          [ -n "$FOUND" ] || { echo "FATAL: no ClickHouse behind the alias accepts this run's credentials"; exit 1; }
          echo "CLICKHOUSE_URL=http://$FOUND:8123" >> "$GITHUB_ENV"
          echo "CLICKHOUSE_AUTH=opt_ci:$PASS" >> "$GITHUB_ENV"
      # The anti-skip guard here used to grep vitest's HUMAN output:
      #
      #   grep -qE "skipped" && ! grep -qE "Tests  [0-9]+ passed"
      #
      # vitest colours that summary, so the real line on this runner is
      # ESC[2m      Tests ESC[22m ESC[1mESC[32m97 passedESC[39m ... — ANSI escapes
      # sit between "Tests " and the digits, so the two-spaces-then-digit
      # pattern can never match. The first grep still matched "skipped", so
      # the guard fired on ANY run containing a single skipped test while
      # printing "integration suites skipped instead of running" — a false
      # statement. Measured 2026-09-08, run 13911 job 31183: 13 files / 97
      # tests PASSED, 1 file / 2 tests skipped → FATAL anyway.
      #
      # It survived review because it is correct locally: redirecting to a
      # file disables vitest's colour, so the pattern matches on a developer
      # machine and only misfires under CI.
      #
      # Replaced with the JSON reporter — structured and colourless. A/B
      # measured on real reports, BOTH directions:
      #   all-skipped (0 passed / 99 pending) → RED   (protection preserved)
      #   945 passed + 184 skipped            → GREEN (false red removed)
      - name: Integration tests against LIVE OpenSearch + ClickHouse (blocking)
        run: |
          set -eu
          # Env MUST be present here — the suites self-skip without it, and a
          # skipped suite must never masquerade as a green integration gate
          # (Master-DoD §56 status honesty).
          [ -n "${OPENSEARCH_URL:-}" ] && [ -n "${CLICKHOUSE_URL:-}" ]
          pnpm vitest run tests/integration \
            --reporter=default \
            --reporter=json --outputFile.json=/tmp/itest.json
          node -e '
            const fs = require("fs");
            const p = "/tmp/itest.json";
            if (!fs.existsSync(p)) {
              console.error("FATAL: vitest produced no JSON report"); process.exit(1);
            }
            const r = JSON.parse(fs.readFileSync(p, "utf8"));
            console.log(`integration: ${r.numPassedTests} passed, ${r.numPendingTests} skipped, ${r.numFailedTests} failed, ${r.numTotalTests} total`);
            if (r.numFailedTests > 0) {
              console.error("FATAL: integration tests failed"); process.exit(1);
            }
            if (r.numPassedTests === 0) {
              console.error("FATAL: no integration test actually executed — every suite skipped");
              process.exit(1);
            }
          '

  # BLOCKING. This job publishes the protected-branch status check context
  # "CI (SIAX Cloud) / security (push)", which branch protection on `main`
  # lists as required alongside "CI (SIAX Cloud) / quality (push)".
  #
  # It previously ran Trivy with `--exit-code 0`, which made the REQUIRED
  # context incapable of ever reporting failure. Measured 2026-09-08 on
  # main @4514d97: a planted CRITICAL secret (AWS secret access key) was
  # DETECTED by the scanner and the job still exited 0 -- i.e. the gate
  # reported success while holding a critical finding in hand. The same
  # command with `--exit-code 1` exits 1 on that planted secret and exits 0
  # on the clean tree, so this flag is the whole difference between a real
  # gate and a decorative one.
  #
  # KNOWN COVERAGE GAP (not fixed here, needs an owner decision):
  # services/scrapers/requirements.txt pins nothing (`>=` ranges only), so
  # Trivy's pip scanner cannot resolve versions and silently omits the file
  # from the scan entirely -- it is not a target in the report at all.
  # Pinning those same floors with `==` surfaces 3 HIGH findings today
  # (aiohttp CVE-2025-69223, aiohttp CVE-2026-69244, lxml CVE-2026-41066).
  # Do NOT paper over this with `--skip-dirs`; that would convert a
  # measurable blind spot into declared policy.
  security:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install Trivy
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
      # `siax/sbom/` är CycloneDX-evidenens för REDAN BYGGDA images (release-kedjan),
      # inte källberoenden. Att scanna dem här återrapporterar gamla image-versioner
      # (next 16.3.x, sharp 0.35.4) och blockerar källfixar som redan är patchade.
      # Image-SBOM:erna verifieras i release/image-pipelinen.
      - name: Trivy scan (vuln + secrets -- BLOCKING, fails on HIGH/CRITICAL)
        run: |
          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 1 --skip-dirs 'siax/sbom' .

  sonar:
    # SonarQube Community Build har inget separat PR-analysläge (en enda "main"-gren
    # per projekt) — en analys från en PR-branch eller en tagg-push som inte pekar på
    # main skulle skriva över kvalitetshistoriken. Kör därför bara
    # vid push till main.
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: SonarQube analysis (self-hosted sonar.siax.io)
        env:
          SONAR_HOST_URL: https://sonar.siax.io
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        run: |
          set -euo pipefail
          test -n "$SONAR_TOKEN" || { echo "::error::SONAR_TOKEN repo secret missing"; exit 1; }
          # Jobbet kör i en container på act_runner; "docker run -v \"\$PWD:...\""
          # skulle montera VÄRDENS (tomma) sökväg. Kopiera in källträdet istället.
          cid=$(docker create -e SONAR_HOST_URL -e SONAR_TOKEN -w /usr/src \
            sonarsource/sonar-scanner-cli:latest \
            sonar-scanner -Dsonar.projectKey=0pt -Dsonar.host.url="$SONAR_HOST_URL")
          trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
          docker cp . "$cid":/usr/src
          docker start -a "$cid"