Roof border shows the un-aged reference color #355
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| push: | |
| branches: [main] | |
| # Mirror of the NPM_VERSION pin in .env / Dockerfile ARG. Keep in sync — | |
| # the .env file is the canonical source for compose + justfile, this env | |
| # block is the canonical source for CI shell steps. See Dockerfile header. | |
| env: | |
| NPM_VERSION: '11.6.2' | |
| jobs: | |
| build-and-test: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 # full history for hatch-vcs | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Build image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| load: true | |
| tags: | | |
| codecity:ci | |
| codecity:test | |
| codecity:dev | |
| build-args: | | |
| GIT_SHA=${{ github.sha }} | |
| VERSION=0.0.0+g${{ github.sha }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Run pytest with coverage | |
| # pyproject.toml's pytest addopts already include | |
| # `--cov=api --cov-report=term --cov-fail-under=80`. The extra | |
| # `--cov-report=xml:/srv/api/coverage.xml` lands the XML report | |
| # inside the mounted `./api` dir so it's visible on the host for | |
| # artifact upload (the compose service only mounts ./api, uv.lock, | |
| # and pyproject.toml — not the repo root). | |
| run: | | |
| docker compose -f docker-compose.test.yml run --rm pytest \ | |
| --cov-report=xml:/srv/api/coverage.xml | |
| - name: Python format check (ruff) | |
| run: docker compose -f docker-compose.test.yml run --rm ruff | |
| - name: Run vitest with coverage | |
| # Override the default compose command (which runs `npm test`) to | |
| # run `npm run coverage` instead. Same apt-get / npm bootstrap as | |
| # the compose service. Output lands in app/coverage/ on the host | |
| # via the ./app:/app bind mount. | |
| run: | | |
| docker compose -f docker-compose.test.yml run --rm vitest \ | |
| sh -c "apt-get update && apt-get install -y --no-install-recommends libexpat1 fontconfig fonts-dejavu-core && npm install -g npm@$NPM_VERSION && npm ci && npm run coverage" | |
| - name: Upload pytest coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: pytest-coverage | |
| path: api/coverage.xml | |
| if-no-files-found: warn | |
| - name: Upload vitest coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: vitest-coverage | |
| path: app/coverage/ | |
| if-no-files-found: warn | |
| - name: Lint + typecheck + format check | |
| run: | | |
| docker compose -f docker-compose.test.yml run --rm vitest \ | |
| sh -c "apt-get update && apt-get install -y --no-install-recommends libexpat1 fontconfig fonts-dejavu-core && npm install -g npm@$NPM_VERSION && npm ci && npm run lint && npm run typecheck && npm run format:check" | |
| - name: Trivy scan | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: codecity:ci | |
| format: table | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: 1 |