admin
6612ab1233
CI (SIAX Cloud) / security (push) Successful in 21s
Security Scan (SIAX Cloud) / security (push) Successful in 22s
CI (SIAX Cloud) / quality (push) Successful in 40s
CI (SIAX Cloud) / quality (pull_request) Successful in 39s
CI (SIAX Cloud) / security (pull_request) Successful in 18s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 16s
58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
name: CI (SIAX Cloud)
|
|
|
|
# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2).
|
|
# Quality gate for the Next.js 16 web console + the 0pt capability layer.
|
|
#
|
|
# * typecheck (BLOCKING) -> `tsc -p tsconfig.check.json` over src/ + tests/.
|
|
# * test (BLOCKING) -> `vitest run`.
|
|
# * lint (ADVISORY) -> `eslint src tests` (legacy v0-generated noise
|
|
# is inherited debt; continue-on-error so it never blocks).
|
|
# * build (BLOCKING) -> `next build`.
|
|
#
|
|
# Nightly re-runs + Trivy security scanning live in nightly.yml and
|
|
# security.yml (this file is push/PR-only).
|
|
on:
|
|
push:
|
|
branches: ["**"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
- name: Enable corepack + pin pnpm@9 (pnpm-lock.yaml is lockfileVersion 9.0)
|
|
run: |
|
|
corepack enable
|
|
corepack prepare pnpm@9 --activate
|
|
- name: Install (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Typecheck (tsc over src/ + tests/ -- blocking)
|
|
run: pnpm run typecheck
|
|
- name: Test (vitest -- blocking)
|
|
run: pnpm run test
|
|
- name: Lint (eslint -- advisory; legacy tree has pre-existing noise)
|
|
continue-on-error: true
|
|
run: pnpm run lint
|
|
- name: Build (next build -- blocking quality gate)
|
|
run: pnpm run build
|
|
|
|
# Kept in ci.yml (advisory) so the protected-branch status check contexts
|
|
# "CI (SIAX Cloud) / quality (push)" + "CI (SIAX Cloud) / security (push)"
|
|
# are always reported on push. security.yml is the dedicated scanner on
|
|
# push/PR/weekly; this job guarantees the required check exists.
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Trivy
|
|
run: |
|
|
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
- name: Trivy scan (vuln + secrets, advisory)
|
|
run: |
|
|
trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 .
|