Nightly Contract Tests #98
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nightly Contract Tests | |
| on: | |
| schedule: | |
| - cron: "0 6 * * *" | |
| workflow_dispatch: | |
| # Least-privilege default. CodeQL alert #1 — actions/missing-workflow-permissions. | |
| permissions: | |
| contents: read | |
| jobs: | |
| contracts: | |
| name: Graph backend contract tests | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| services: | |
| # Issue #42 — service images pinned by digest. Tag-only references | |
| # (e.g. `neo4j:5.26`) are vulnerable to a compromised-tag supply-chain | |
| # attack: a malicious push to the same tag would silently affect this | |
| # CI run. The `supply-chain-lint` job in `ci.yml` now scans this file | |
| # so any future `image:` reference without `@sha256:` fails CI. | |
| neo4j: | |
| image: neo4j:5.26@sha256:b357872da95a164c5243ca8d9060601130717ff43cee3c829402fab46209a412 | |
| env: | |
| NEO4J_AUTH: neo4j/beever_atlas_dev | |
| NEO4J_PLUGINS: '["apoc"]' | |
| ports: | |
| - 7687:7687 | |
| - 7474:7474 | |
| options: >- | |
| --health-cmd "wget -q -O- http://localhost:7474 || exit 1" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 20 | |
| nebula-metad: | |
| image: vesoft/nebula-metad:v3.8.0@sha256:ab687bd32d3e441d436842b41427ba0961a5e169c46997ef03fa4dcfd5388b35 | |
| ports: | |
| - 9559:9559 | |
| nebula-storaged: | |
| image: vesoft/nebula-storaged:v3.8.0@sha256:7142642ee69001a5b5c50520196538d58bb2ec3930707c067cb4c4e2be3890f9 | |
| ports: | |
| - 9779:9779 | |
| nebula-graphd: | |
| image: vesoft/nebula-graphd:v3.8.0@sha256:1040573cc684ea6cc5e673b667422e9abab607c9d553c2c17c7bac6ad8a74e05 | |
| ports: | |
| - 9669:9669 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| - name: Install dependencies | |
| run: uv sync --extra dev --extra nebula | |
| - name: Run contract tests | |
| env: | |
| NEO4J_URI: bolt://localhost:7687 | |
| NEO4J_AUTH: neo4j/beever_atlas_dev | |
| NEBULA_HOSTS: 127.0.0.1:9669 | |
| NEBULA_USER: root | |
| NEBULA_PASSWORD: nebula | |
| NEBULA_SPACE: beever_atlas | |
| run: uv run pytest tests/contracts/ -v |