admin
8d2ff738c3
BACKLOG P0-13: next.config.mjs now sets HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and a same-origin CSP on every route. Previously the only security header came from Vercel's platform default (HSTS) -- nothing was set by the app itself, so it would have silently disappeared on cutover to Coolify/Traefik. Verified at runtime (curl -I against a production build), not just that the build compiles. BACKLOG P0-16: Trivy in security.yml/nightly.yml now actually fails the build on HIGH/CRITICAL findings (`--exit-code 1`) instead of the previous `--exit-code 0` (purely advisory, never blocked a merge). Verified locally against this repo's real dependency tree -- 19 HIGH findings currently exist in pnpm-lock.yaml (next.js, postcss, sharp, nanoid), several in next.js itself relating to middleware/auth bypass. See PR description: this is expected to turn the security.yml `trivy` job red until those are bumped in a follow-up -- that's the fix working as intended, not a regression, but it needs a human decision on timing given the sibling auth-gate PR (#11). `services/scrapers/` stays explicitly excluded from the scan (--skip-dirs) -- that tree is a dated, deliberate keep-decision under active review in a separate thread (BACKLOG P3-3) and is out of scope here. BACKLOG P0-19: dedicated gitleaks job added to security.yml, full git history (--log-opts=--all), pinned + checksum-verified binary. Verified locally against this repo's actual history first (81 commits, no leaks) so this blocking gate doesn't open red on day one. BACKLOG P1-14: SBOM (CycloneDX) + license inventory (`pnpm licenses list`) generated as informational, non-blocking build artifacts. actions/checkout, actions/setup-node, actions/cache, actions/upload-artifact all pinned to commit SHA (was floating @v4 tags) across every workflow file, Trivy/gitleaks pinned to specific released versions instead of floating install scripts. cosign image-signing explicitly NOT added -- there is no container-registry publish step in this repo's CI to attach a signature to yet (Coolify builds directly from git); flagging as a real follow-up once that pipeline exists. BACKLOG P1-15: explicit `permissions: contents: read` + `concurrency` added to every workflow that lacked them (only .github/workflows/ci.yml already had concurrency). Pinned pnpm-store cache added to ci.yml's quality job. Root CODEOWNERS added (`* @sax3l`) so Gitea has someone to assign once required-approvals is turned on (separate repo-settings change, not a file change). The "doctor step" part of P1-15 is added in the follow-up repo- hygiene PR, alongside the `siax:doctor` script it invokes.
82 lines
3.4 KiB
YAML
82 lines
3.4 KiB
YAML
name: CI (SIAX Cloud)
|
|
|
|
# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2).
|
|
# Quality gate for the Next.js 16 web console + the 0pt capability layer.
|
|
#
|
|
# * typecheck (BLOCKING) -> `tsc -p tsconfig.check.json` over src/ + tests/.
|
|
# * test (BLOCKING) -> `vitest run`.
|
|
# * lint (ADVISORY) -> `eslint src tests` (legacy v0-generated noise
|
|
# is inherited debt; continue-on-error so it never blocks).
|
|
# * build (BLOCKING) -> `next build`.
|
|
#
|
|
# Nightly re-runs + Trivy/gitleaks security scanning live in nightly.yml and
|
|
# security.yml (this file is push/PR-only). BACKLOG P1-15: `permissions`,
|
|
# `concurrency`, and a pinned pnpm-store cache added; CODEOWNERS added at the
|
|
# repo root (Gitea auto-reviewer assignment); actions pinned to commit SHAs
|
|
# (BACKLOG P1-14 digest-pinning).
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: "22"
|
|
- name: Enable corepack + pin pnpm@9 (pnpm-lock.yaml is lockfileVersion 9.0)
|
|
run: |
|
|
corepack enable
|
|
corepack prepare pnpm@9 --activate
|
|
- name: Get pnpm store directory
|
|
id: pnpm-cache
|
|
run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
|
|
- name: Cache pnpm store
|
|
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
|
|
with:
|
|
path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
|
|
key: ${{ runner.os }}-pnpm-store-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-pnpm-store-
|
|
- name: Install (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Typecheck (tsc over src/ + tests/ -- blocking)
|
|
run: pnpm run typecheck
|
|
- name: Test (vitest -- blocking)
|
|
run: pnpm run test
|
|
- name: Lint (eslint -- advisory; legacy tree has pre-existing noise)
|
|
continue-on-error: true
|
|
run: pnpm run lint
|
|
- name: Build (next build -- blocking quality gate)
|
|
run: pnpm run build
|
|
|
|
# Kept in ci.yml (advisory) so the protected-branch status check contexts
|
|
# "CI (SIAX Cloud) / quality (push)" + "CI (SIAX Cloud) / security (push)"
|
|
# are always reported on push. security.yml is the dedicated scanner on
|
|
# push/PR/weekly and is now BLOCKING (BACKLOG P0-16) -- this copy is kept
|
|
# advisory on purpose: it exists only to guarantee the status-check context
|
|
# is always present (see the comment this repeats from before), not as a
|
|
# second enforcement point. Do not treat a green run of *this* job as a
|
|
# security clearance -- see security.yml's `trivy` + `gitleaks` jobs.
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
- name: Install Trivy (pinned)
|
|
run: |
|
|
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.73.0
|
|
- name: Trivy scan (vuln + secrets, advisory -- see security.yml for the blocking scan)
|
|
run: |
|
|
trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --skip-dirs services/scrapers --exit-code 0 .
|