Merge pull request #118 from albert-einshutoin/codex/response-dlp-doc… #139
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Policy lint, build, and runtime tests | |
| # dist/ はコミットしない。ビルドが成功し dist/edge/ が生成されることを確認する。 | |
| name: Policy Lint & Build Check | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint-build-test: | |
| runs-on: ubuntu-latest | |
| env: | |
| # CI-only token. Required because CloudFront Functions cannot read env | |
| # at runtime, so static_token values are baked into the build artifact. | |
| # This is not a production secret — real deployments use GitHub Secrets. | |
| EDGE_ADMIN_TOKEN: ci-build-token-not-for-deploy | |
| # Origin-auth secret is consumed by the microservice-origin archetype | |
| # during drift checks; same CI-only convention applies. | |
| ORIGIN_SECRET: ci-origin-secret-not-for-deploy | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: npm audit (block HIGH/CRITICAL vulnerabilities) | |
| run: npm audit --audit-level=high | |
| - name: Policy lint (security / base) | |
| run: | | |
| if [ -f policy/security.yml ]; then npm run lint:policy -- policy/security.yml; else npm run lint:policy -- policy/base.yml; fi | |
| - name: Policy lint (profiles) | |
| run: | | |
| npm run lint:policy -- policy/profiles/balanced.yml | |
| npm run lint:policy -- policy/profiles/strict.yml | |
| npm run lint:policy -- policy/profiles/permissive.yml | |
| - name: Policy lint (archetypes) | |
| run: | | |
| npm run lint:policy -- policy/archetypes/spa-static-site.yml | |
| npm run lint:policy -- policy/archetypes/rest-api.yml | |
| npm run lint:policy -- policy/archetypes/admin-panel.yml | |
| npm run lint:policy -- policy/archetypes/microservice-origin.yml | |
| - name: Build AWS (compile policy → dist) | |
| run: npm run build | |
| - name: Build Cloudflare (compile policy → dist) | |
| run: node scripts/compile-cloudflare.js | |
| - name: Cloudflare WAF parity gate (base policy must build without approximation warnings) | |
| # base.yml intentionally uses only equivalent AWS rules. Any policy change | |
| # that introduces approximate or unsupported mappings must be accompanied | |
| # by an explicit docs/cloudflare-waf-parity.md update; this gate fails | |
| # CI loudly instead of silently degrading. | |
| run: node scripts/compile-cloudflare-waf.js --policy policy/base.yml --out-dir dist --fail-on-waf-approximation | |
| - name: Ensure build produces dist/ | |
| run: | | |
| test -f dist/edge/viewer-request.js || (echo "Missing dist/edge/viewer-request.js"; exit 1) | |
| test -f dist/edge/viewer-response.js || (echo "Missing dist/edge/viewer-response.js"; exit 1) | |
| test -f dist/edge/origin-request.js || (echo "Missing dist/edge/origin-request.js"; exit 1) | |
| test -f dist/edge/cloudflare/index.ts || (echo "Missing dist/edge/cloudflare/index.ts"; exit 1) | |
| - name: Runtime tests (AWS + Cloudflare) | |
| run: npm run test:runtime | |
| - name: Unit tests (compiler core + doctor + emit-waf) | |
| run: npm run test:unit | |
| - name: CLI doctor self-check (uses repo's own policy) | |
| run: node bin/cli.js doctor --no-report | |
| - name: ReDoS fuzz (user-supplied regexes must not backtrack catastrophically) | |
| run: npm run test:fuzz | |
| - name: Cloudflare Worker integration tests (Node-native fetch harness) | |
| run: npm run test:cloudflare-integration | |
| - name: Pseudo Edge container attack tests | |
| run: npm run test:edge-container | |
| - name: Drift check (base + profiles vs golden generated artifacts) | |
| run: npm run test:drift | |
| - name: Security baseline check (OWASP mapping + CI guardrails) | |
| run: npm run test:security-baseline | |
| - name: Coverage (c8, fail below 80% lines) | |
| run: npm run test:coverage | |
| - name: Verify npm package contents and packed install smoke | |
| run: npm run test:package | |
| package-smoke-matrix: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: ['20.17.0', '22', '24'] | |
| env: | |
| EDGE_ADMIN_TOKEN: ci-build-token-not-for-deploy | |
| ORIGIN_SECRET: ci-origin-secret-not-for-deploy | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: API contract | |
| run: npm run test:api-contract | |
| - name: Packed install smoke | |
| run: npm run test:package |