name: Managed validation run-name: "Managed validation / ${{ inputs.profile || 'full' }}" on: push: branches: [main] pull_request: workflow_dispatch: inputs: profile: description: Allowlisted validation profile required: true default: full type: choice options: [test, lint, typecheck, build, security, full] permissions: contents: read concurrency: group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }} cancel-in-progress: true jobs: full: name: full runs-on: linux-validation timeout-minutes: 30 env: CI: "true" services: postgres: image: postgres:16 env: POSTGRES_DB: projectbrain_integration POSTGRES_USER: projectbrain POSTGRES_PASSWORD: projectbrain-test-password options: >- --health-cmd "pg_isready -U projectbrain -d projectbrain_integration" --health-interval 5s --health-timeout 5s --health-retries 10 steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Validate repository with a bounded profile shell: bash env: REQUESTED_PROFILE: ${{ inputs.profile }} run: | set -euo pipefail profile="${REQUESTED_PROFILE:-full}" case "${profile}" in test|lint|typecheck|build|security|full) ;; *) echo "Profile is not allowlisted" >&2; exit 2 ;; esac if [[ "${profile}" == security && ( ! -f package.json || ! -f pnpm-lock.yaml ) ]]; then echo "Security profile requires the repository's pinned pnpm audit:security command" >&2 exit 2 fi git diff --check if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then echo "Unresolved merge markers detected" >&2 exit 1 fi # MANAGED_FAST_PATH: only documentation may skip product tests. # Include deletions and renames; workflow and runner changes must # always execute validation. if [[ -n "${GITHUB_BASE_REF:-}" ]]; then git fetch --no-tags origin "+refs/heads/${GITHUB_BASE_REF}:refs/remotes/origin/${GITHUB_BASE_REF}" managed_base="origin/${GITHUB_BASE_REF}" git diff --check "${managed_base}..HEAD" mapfile -t managed_changed_files < <( git diff --name-only --no-renames "${managed_base}..HEAD" ) managed_runtime_change=0 for managed_path in "${managed_changed_files[@]}"; do case "${managed_path}" in *.md|*.mdx) ;; *) managed_runtime_change=1 break ;; esac done if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \ "${#managed_changed_files[@]}" if [[ "${profile}" == full ]]; then node scripts/check-doc-links.mjs node scripts/check-unraid-template-readiness.mjs fi exit 0 fi fi if [[ -f pyproject.toml || -f requirements.txt ]]; then # Compile only tracked Python sources. Running compileall after a # Node install would otherwise traverse node_modules and turn a # lightweight baseline into a large runner workload. git ls-files -z '*.py' | xargs -0 -r python -m py_compile if [[ -f uv.lock ]]; then python -m venv "${RUNNER_TEMP}/managed-uv" uv_python="${RUNNER_TEMP}/managed-uv/bin/python" "${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0 managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv" export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv" "${managed_uv}" sync --locked export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}" if [[ "${profile}" == test || "${profile}" == full ]]; then if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then "${managed_uv}" run python -m pytest fi fi if [[ "${profile}" == lint || "${profile}" == full ]]; then if "${managed_uv}" run python -c 'import ruff' 2>/dev/null; then "${managed_uv}" run python -m ruff check . fi fi elif [[ -f requirements.txt ]]; then python -m venv "${RUNNER_TEMP}/managed-python" managed_python="${RUNNER_TEMP}/managed-python/bin/python" "${managed_python}" -m pip install --disable-pip-version-check -r requirements.txt export PATH="${RUNNER_TEMP}/managed-python/bin:${PATH}" if [[ "${profile}" == test || "${profile}" == full ]]; then if "${managed_python}" -c 'import pytest' 2>/dev/null; then "${managed_python}" -m pytest fi fi fi fi # Keep ordinary unit/contract validation database-independent. The # real PostgreSQL suite is enabled only after migrations are applied # in the deployment-authoritative full profile below. if [[ -f package.json ]]; then corepack enable if [[ -f pnpm-lock.yaml ]]; then pnpm install --frozen-lockfile if [[ "${profile}" == test ]]; then pnpm --if-present test [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run test elif [[ "${profile}" == full ]]; then pnpm run test:coverage [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run test:coverage fi if [[ "${profile}" == security ]]; then pnpm run audit:security fi if [[ "${profile}" == lint || "${profile}" == full ]]; then pnpm --if-present lint [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run lint fi if [[ "${profile}" == typecheck || "${profile}" == full ]]; then pnpm --if-present typecheck [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run typecheck fi if [[ "${profile}" == build || "${profile}" == full ]]; then pnpm --if-present build [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run build fi if [[ "${profile}" == full ]]; then pnpm run audit:openapi pnpm run audit:architecture pnpm run audit:docs pnpm run audit:v1-freeze pnpm run audit:unraid-template fi if [[ "${profile}" == full && -f backend/package.json ]]; then export DATABASE_URL="postgresql://projectbrain:projectbrain-test-password@postgres:5432/projectbrain_integration?schema=public" export TEST_DATABASE_URL="${DATABASE_URL}" pnpm --dir backend prisma:generate pnpm --dir backend db:deploy pnpm --dir backend db:seed pnpm --dir backend test:database pnpm --dir backend exec prisma migrate reset --schema prisma/schema.prisma --force --skip-seed pnpm --dir backend db:seed fi if [[ "${profile}" == full && -f playwright.config.ts ]]; then pnpm exec playwright install --with-deps --force chromium chromium-headless-shell pnpm test:e2e pnpm test:e2e:real fi elif [[ -f package-lock.json ]]; then npm ci [[ "${profile}" == test || "${profile}" == full ]] && npm run --if-present test [[ "${profile}" == lint || "${profile}" == full ]] && npm run --if-present lint if [[ "${profile}" == typecheck || "${profile}" == full ]]; then npm run --if-present typecheck fi [[ "${profile}" == build || "${profile}" == full ]] && npm run --if-present build fi fi if [[ -f go.mod ]]; then if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then go test ./... fi fi if [[ -f Cargo.toml ]]; then if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then cargo test --locked fi fi if compgen -G '*.sln' >/dev/null; then if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then dotnet test --configuration Release fi fi