106 lines
4.5 KiB
YAML
106 lines
4.5 KiB
YAML
name: Verify
|
|
on: [push, pull_request]
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
postgres:
|
|
image: postgres:17
|
|
env:
|
|
POSTGRES_PASSWORD: ci-only-password
|
|
POSTGRES_DB: traceiq
|
|
options: >-
|
|
--label traceiq-ci-postgres=${{ github.repository }}:${{ github.run_id }}:${{ github.run_attempt }}
|
|
--health-cmd pg_isready --health-interval 5s
|
|
--health-timeout 5s --health-retries 10
|
|
env:
|
|
E2E_PASSWORD: CI-Test-Only-SecurePassword882!
|
|
PYTHONPATH: .
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: astral-sh/setup-uv@v6
|
|
with:
|
|
version: '0.10.12'
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '22'
|
|
cache: npm
|
|
- run: uv sync --frozen --python 3.12
|
|
# runner 使用共享 Docker 网络；按本次运行的标签找服务 IP，避免共用 postgres 别名。
|
|
# act_runner v0.6.1 尚未提供 job.services.postgres.id，现有 Docker socket 仅用于读取。
|
|
- name: Resolve isolated PostgreSQL service
|
|
env:
|
|
POSTGRES_SERVICE_LABEL: traceiq-ci-postgres=${{ github.repository }}:${{ github.run_id }}:${{ github.run_attempt }}
|
|
run: |
|
|
postgres_containers=$(curl --fail --silent --show-error \
|
|
--unix-socket /var/run/docker.sock \
|
|
--get --data-urlencode "filters={\"label\":[\"$POSTGRES_SERVICE_LABEL\"]}" \
|
|
http://localhost/containers/json)
|
|
POSTGRES_CONTAINERS="$postgres_containers" uv run python - <<'PY'
|
|
import ipaddress
|
|
import json
|
|
import os
|
|
|
|
containers = json.loads(os.environ["POSTGRES_CONTAINERS"])
|
|
if len(containers) != 1:
|
|
raise SystemExit("Expected exactly one PostgreSQL service for this run")
|
|
networks = list(containers[0]["NetworkSettings"]["Networks"].values())
|
|
if len(networks) != 1:
|
|
raise SystemExit("Expected PostgreSQL to use the runner's single Docker network")
|
|
address = ipaddress.IPv4Address(networks[0]["IPAddress"])
|
|
with open(os.environ["GITHUB_ENV"], "a") as env_file:
|
|
env_file.write(f"DATABASE_URL=postgresql://postgres:ci-only-password@{address}:5432/traceiq\n")
|
|
PY
|
|
- run: npm ci --registry=https://registry.npmjs.org
|
|
- run: uv run ruff check server finance tests scripts
|
|
- run: uv run ruff format --check server finance tests scripts
|
|
- run: uv run python manage.py makemigrations --check --dry-run
|
|
- run: uv run pytest --cov=finance --cov-report=term-missing --cov-fail-under=85
|
|
- run: npm run build
|
|
# 审计端点在 runner 网络下偶发 TLS 断开（npm error audit endpoint returned
|
|
# an error），重试区分网络抖动与真实漏洞：漏洞是确定性的，重试后照样红。
|
|
- name: npm audit (production deps)
|
|
run: |
|
|
for attempt in 1 2 3; do
|
|
npm audit --omit=dev --registry=https://registry.npmjs.org && exit 0
|
|
echo "::warning::npm audit 第 ${attempt} 次失败，15 秒后重试"
|
|
sleep 15
|
|
done
|
|
exit 1
|
|
- name: pip-audit
|
|
run: |
|
|
for attempt in 1 2 3; do
|
|
uv run pip-audit && exit 0
|
|
echo "::warning::pip-audit 第 ${attempt} 次失败，15 秒后重试"
|
|
sleep 15
|
|
done
|
|
exit 1
|
|
- run: uv run python manage.py migrate --noinput
|
|
- run: uv run python manage.py collectstatic --noinput
|
|
- run: uv run python manage.py bootstrap --username admin --organization CI
|
|
env:
|
|
BOOTSTRAP_PASSWORD: ${{ env.E2E_PASSWORD }}
|
|
- run: npx playwright install --with-deps chromium
|
|
- name: Browser regression
|
|
shell: bash
|
|
run: |
|
|
uv run python manage.py runserver 127.0.0.1:8000 --noreload > /tmp/web.log 2>&1 &
|
|
web=$!
|
|
uv run python manage.py import_worker > /tmp/worker.log 2>&1 &
|
|
worker=$!
|
|
trap 'kill "$web" "$worker"' EXIT
|
|
for i in {1..30}; do curl -fsS http://127.0.0.1:8000/api/health && break; sleep 1; done
|
|
npm run test:e2e
|
|
# Gitea 不支持 upload-artifact@v4 的 artifact 协议（GHESNotSupportedError），
|
|
# 上传失败不该把已经全绿的测试标红；迁到 GitHub 托管时此步骤自动生效。
|
|
- uses: actions/upload-artifact@v4
|
|
if: always()
|
|
continue-on-error: true
|
|
with:
|
|
name: browser-results
|
|
path: |
|
|
playwright-report
|
|
test-results
|