Publish curated ITWorx_MCP_Hub source from 9ec6419178e8ddc76a698e84bde72d5ff4472411
This commit is contained in:
Public Source Publisher committed
1 parent
5ff5c807d3
commit
f26354e16c
20 files changed
+1639
-84
No files matched your search
+210
@@ -0,0 +1,210 @@
|
||||
name: Managed validation
|
||||
run-name: "Managed validation / ${{ inputs.profile || 'full' }}"
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
profile:
|
||||
description: Allowlisted validation profile
|
||||
required: true
|
||||
default: full
|
||||
type: choice
|
||||
options: [test, lint, typecheck, build, security, full]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
full:
|
||||
name: full
|
||||
runs-on: linux-validation
|
||||
timeout-minutes: 30
|
||||
env:
|
||||
CI: "true"
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:16
|
||||
env:
|
||||
POSTGRES_DB: projectbrain_integration
|
||||
POSTGRES_USER: projectbrain
|
||||
POSTGRES_PASSWORD: projectbrain-test-password
|
||||
options: >-
|
||||
--health-cmd "pg_isready -U projectbrain -d projectbrain_integration"
|
||||
--health-interval 5s
|
||||
--health-timeout 5s
|
||||
--health-retries 10
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
- name: Validate repository with a bounded profile
|
||||
shell: bash
|
||||
env:
|
||||
REQUESTED_PROFILE: ${{ inputs.profile }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
profile="${REQUESTED_PROFILE:-full}"
|
||||
case "${profile}" in
|
||||
test|lint|typecheck|build|security|full) ;;
|
||||
*) echo "Profile is not allowlisted" >&2; exit 2 ;;
|
||||
esac
|
||||
if [[ "${profile}" == security && ( ! -f package.json || ! -f pnpm-lock.yaml ) ]]; then
|
||||
echo "Security profile requires the repository's pinned pnpm audit:security command" >&2
|
||||
exit 2
|
||||
fi
|
||||
|
||||
git diff --check
|
||||
if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
|
||||
echo "Unresolved merge markers detected" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# MANAGED_FAST_PATH: only documentation may skip product tests.
|
||||
# Include deletions and renames; workflow and runner changes must
|
||||
# always execute validation.
|
||||
if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
|
||||
git fetch --no-tags origin "+refs/heads/${GITHUB_BASE_REF}:refs/remotes/origin/${GITHUB_BASE_REF}"
|
||||
managed_base="origin/${GITHUB_BASE_REF}"
|
||||
git diff --check "${managed_base}..HEAD"
|
||||
mapfile -t managed_changed_files < <(
|
||||
git diff --name-only --no-renames "${managed_base}..HEAD"
|
||||
)
|
||||
managed_runtime_change=0
|
||||
for managed_path in "${managed_changed_files[@]}"; do
|
||||
case "${managed_path}" in
|
||||
*.md|*.mdx)
|
||||
;;
|
||||
*)
|
||||
managed_runtime_change=1
|
||||
break
|
||||
;;
|
||||
esac
|
||||
done
|
||||
if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
|
||||
printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
|
||||
"${#managed_changed_files[@]}"
|
||||
if [[ "${profile}" == full ]]; then
|
||||
node scripts/check-doc-links.mjs
|
||||
node scripts/check-unraid-template-readiness.mjs
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
if [[ -f pyproject.toml || -f requirements.txt ]]; then
|
||||
# Compile only tracked Python sources. Running compileall after a
|
||||
# Node install would otherwise traverse node_modules and turn a
|
||||
# lightweight baseline into a large runner workload.
|
||||
git ls-files -z '*.py' | xargs -0 -r python -m py_compile
|
||||
if [[ -f uv.lock ]]; then
|
||||
python -m venv "${RUNNER_TEMP}/managed-uv"
|
||||
uv_python="${RUNNER_TEMP}/managed-uv/bin/python"
|
||||
"${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0
|
||||
managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv"
|
||||
export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv"
|
||||
"${managed_uv}" sync --locked
|
||||
export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
|
||||
if [[ "${profile}" == test || "${profile}" == full ]]; then
|
||||
if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
|
||||
"${managed_uv}" run python -m pytest
|
||||
fi
|
||||
fi
|
||||
if [[ "${profile}" == lint || "${profile}" == full ]]; then
|
||||
if "${managed_uv}" run python -c 'import ruff' 2>/dev/null; then
|
||||
"${managed_uv}" run python -m ruff check .
|
||||
fi
|
||||
fi
|
||||
elif [[ -f requirements.txt ]]; then
|
||||
python -m venv "${RUNNER_TEMP}/managed-python"
|
||||
managed_python="${RUNNER_TEMP}/managed-python/bin/python"
|
||||
"${managed_python}" -m pip install --disable-pip-version-check -r requirements.txt
|
||||
export PATH="${RUNNER_TEMP}/managed-python/bin:${PATH}"
|
||||
if [[ "${profile}" == test || "${profile}" == full ]]; then
|
||||
if "${managed_python}" -c 'import pytest' 2>/dev/null; then
|
||||
"${managed_python}" -m pytest
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
# Keep ordinary unit/contract validation database-independent. The
|
||||
# real PostgreSQL suite is enabled only after migrations are applied
|
||||
# in the deployment-authoritative full profile below.
|
||||
if [[ -f package.json ]]; then
|
||||
corepack enable
|
||||
if [[ -f pnpm-lock.yaml ]]; then
|
||||
pnpm install --frozen-lockfile
|
||||
if [[ "${profile}" == test ]]; then
|
||||
pnpm --if-present test
|
||||
[[ -f backend/package.json ]] && pnpm --filter projectbrain-api run test
|
||||
elif [[ "${profile}" == full ]]; then
|
||||
pnpm run test:coverage
|
||||
[[ -f backend/package.json ]] && pnpm --filter projectbrain-api run test:coverage
|
||||
fi
|
||||
if [[ "${profile}" == security ]]; then
|
||||
pnpm run audit:security
|
||||
fi
|
||||
if [[ "${profile}" == lint || "${profile}" == full ]]; then
|
||||
pnpm --if-present lint
|
||||
[[ -f backend/package.json ]] && pnpm --filter projectbrain-api run lint
|
||||
fi
|
||||
if [[ "${profile}" == typecheck || "${profile}" == full ]]; then
|
||||
pnpm --if-present typecheck
|
||||
[[ -f backend/package.json ]] && pnpm --filter projectbrain-api run typecheck
|
||||
fi
|
||||
if [[ "${profile}" == build || "${profile}" == full ]]; then
|
||||
pnpm --if-present build
|
||||
[[ -f backend/package.json ]] && pnpm --filter projectbrain-api run build
|
||||
fi
|
||||
if [[ "${profile}" == full ]]; then
|
||||
pnpm run audit:openapi
|
||||
pnpm run audit:architecture
|
||||
pnpm run audit:docs
|
||||
pnpm run audit:v1-freeze
|
||||
pnpm run audit:unraid-template
|
||||
fi
|
||||
if [[ "${profile}" == full && -f backend/package.json ]]; then
|
||||
export DATABASE_URL="postgresql://projectbrain:projectbrain-test-password@postgres:5432/projectbrain_integration?schema=public"
|
||||
export TEST_DATABASE_URL="${DATABASE_URL}"
|
||||
pnpm --dir backend prisma:generate
|
||||
pnpm --dir backend db:deploy
|
||||
pnpm --dir backend db:seed
|
||||
pnpm --dir backend test:database
|
||||
pnpm --dir backend exec prisma migrate reset --schema prisma/schema.prisma --force --skip-seed
|
||||
pnpm --dir backend db:seed
|
||||
fi
|
||||
if [[ "${profile}" == full && -f playwright.config.ts ]]; then
|
||||
pnpm exec playwright install --with-deps --force chromium chromium-headless-shell
|
||||
pnpm test:e2e
|
||||
pnpm test:e2e:real
|
||||
fi
|
||||
elif [[ -f package-lock.json ]]; then
|
||||
npm ci
|
||||
[[ "${profile}" == test || "${profile}" == full ]] && npm run --if-present test
|
||||
[[ "${profile}" == lint || "${profile}" == full ]] && npm run --if-present lint
|
||||
if [[ "${profile}" == typecheck || "${profile}" == full ]]; then
|
||||
npm run --if-present typecheck
|
||||
fi
|
||||
[[ "${profile}" == build || "${profile}" == full ]] && npm run --if-present build
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -f go.mod ]]; then
|
||||
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
|
||||
go test ./...
|
||||
fi
|
||||
fi
|
||||
if [[ -f Cargo.toml ]]; then
|
||||
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
|
||||
cargo test --locked
|
||||
fi
|
||||
fi
|
||||
if compgen -G '*.sln' >/dev/null; then
|
||||
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
|
||||
dotnet test --configuration Release
|
||||
fi
|
||||
fi
|
||||
Reference in new issue
Block a user