Include UI dist in deploy uploads #26
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI Workflow — Build, Test, Lint | |
| # Non-negotiable: This must pass before any deploy. | |
| # Per AGENTS.md: GitHub Actions is the only deploy path. | |
| # Runtime: Deno only (per AGENTS.md policy) | |
| name: CI | |
| on: | |
| push: | |
| branches: [main, develop, "feature/**", "release/**"] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| DENO_VERSION: "2.x" | |
| jobs: | |
| # ============================================================================ | |
| # Deno Build & Test (primary runtime per AGENTS.md) | |
| # ============================================================================ | |
| deno: | |
| name: Deno Build & Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: ${{ env.DENO_VERSION }} | |
| - name: Cache Deno dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cache/deno | |
| ~/.deno | |
| key: deno-${{ runner.os }}-${{ hashFiles('deno.lock', 'deno.json') }} | |
| restore-keys: deno-${{ runner.os }}- | |
| - name: Install UI dependencies | |
| run: | | |
| if [ -f "src/ui/package.json" ]; then | |
| cd src/ui && deno install --node-modules-dir --allow-scripts | |
| fi | |
| - name: Type check | |
| run: | | |
| if grep -q '"typecheck"' deno.json 2>/dev/null; then | |
| deno task typecheck | |
| else | |
| echo "No typecheck task configured" | |
| fi | |
| - name: Lint | |
| run: deno lint | |
| - name: Format check | |
| run: deno fmt --check | |
| - name: Test | |
| run: | | |
| if grep -q '"test"' deno.json 2>/dev/null; then | |
| deno task test | |
| else | |
| deno test --allow-all | |
| fi | |
| - name: Build UI | |
| run: | | |
| if grep -q '"ui:build"' deno.json 2>/dev/null; then | |
| deno task ui:build | |
| else | |
| echo "No ui:build task configured" | |
| fi | |
| # ============================================================================ | |
| # FPF Doctor Checks | |
| # ============================================================================ | |
| fpf-doctor: | |
| name: FPF Foundry Doctor | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: ${{ env.DENO_VERSION }} | |
| - name: Run FPF Doctor | |
| run: | | |
| if [ -f "fpf.config.ts" ]; then | |
| deno run -A npm:@venikman/fpf doctor | |
| else | |
| echo "FPF not configured, skipping doctor checks" | |
| fi | |
| continue-on-error: true | |
| # ============================================================================ | |
| # Playwright UI Tests | |
| # ============================================================================ | |
| playwright: | |
| name: Playwright Tests | |
| runs-on: ubuntu-latest | |
| needs: [deno] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Deno | |
| uses: denoland/setup-deno@v2 | |
| with: | |
| deno-version: ${{ env.DENO_VERSION }} | |
| - name: Install UI dependencies | |
| run: | | |
| if [ -f "src/ui/package.json" ]; then | |
| cd src/ui && deno install --node-modules-dir --allow-scripts | |
| fi | |
| - name: Build UI | |
| run: deno task ui:build | |
| - name: Install Playwright browsers | |
| run: deno task test:e2e:install | |
| - name: Run Playwright tests | |
| run: deno task test:e2e | |
| continue-on-error: true | |
| - name: Upload Playwright report | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: test-results | |
| path: test-results/ | |
| retention-days: 7 | |
| # ============================================================================ | |
| # Security Scan | |
| # ============================================================================ | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| scan-type: "fs" | |
| ignore-unfixed: true | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| - name: Upload Trivy scan results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| # ============================================================================ | |
| # Gate Check — All must pass | |
| # ============================================================================ | |
| ci-gate: | |
| name: CI Gate | |
| runs-on: ubuntu-latest | |
| needs: [deno, fpf-doctor, playwright, security] | |
| if: always() | |
| steps: | |
| - name: Check all jobs passed | |
| run: | | |
| if [[ "${{ needs.deno.result }}" == "failure" ]] || \ | |
| [[ "${{ needs.security.result }}" == "failure" ]]; then | |
| echo "One or more required jobs failed" | |
| exit 1 | |
| fi | |
| echo "All CI checks passed" |