parkly/.github/workflows/ci.yml at db71a9fddef7afc3efc546dc05cae9fa04586f00 · lhcaps/parkly · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
name: Parkly Quality Gate

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

concurrency:
  group: parkly-quality-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  NODE_VERSION: '22'
  PNPM_VERSION: '10'

jobs:
  quality:
    name: Quality Gate
    runs-on: ubuntu-latest
    timeout-minutes: 40
    steps:
      - uses: actions/checkout@v4

      - name: i18n locales (validate, parity, schema)
        run: |
          python scripts/i18n-safe-edit.py validate apps/web/src/i18n/locales/en.json
          python scripts/i18n-safe-edit.py validate apps/web/src/i18n/locales/vi.json
          python scripts/i18n-safe-edit.py parity apps/web/src/i18n/locales/en.json apps/web/src/i18n/locales/vi.json
          python scripts/i18n-safe-edit.py schema-validate apps/web/src/i18n/locales/en.json apps/web/src/i18n/locales/i18n.locale.schema.json
          python scripts/i18n-safe-edit.py schema-validate apps/web/src/i18n/locales/vi.json apps/web/src/i18n/locales/i18n.locale.schema.json

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Install Playwright browser runtime
        run: pnpm --dir apps/web playwright:runtime:install

      - name: Run monorepo quality gate
        run: pnpm test:full

      - name: Upload coverage and test artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: quality-artifacts
          path: |
            apps/api/coverage/vitest
            apps/web/coverage/unit
            apps/web/playwright-report
            apps/web/test-results
            apps/web/dist
          retention-days: 7

  migrations:
    name: Migration Validation
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      mysql:
        image: mysql:8.4
        env:
          MYSQL_ROOT_PASSWORD: test_root_password
          MYSQL_DATABASE: parking_mgmt
        ports:
          - 3306:3306
        options: >-
          --health-cmd="mysqladmin ping -h localhost -ptest_root_password --silent"
          --health-interval=10s
          --health-timeout=5s
          --health-retries=10
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Setup Flyway
        run: |
          wget -qO- https://download.red-gate.com/maven/release/com/redgate/flyway/flyway-commandline/12.0.2/flyway-commandline-12.0.2-linux-x64.tar.gz | tar xz
          echo "$PWD/flyway-12.0.2" >> $GITHUB_PATH

      - name: Run migrations
        working-directory: apps/api
        run: |
          flyway -url="jdbc:mysql://127.0.0.1:3306/parking_mgmt?useSSL=false&allowPublicKeyRetrieval=true" \
                 -user=root -password=test_root_password \
                 -locations="filesystem:db/migrations" \
                 migrate

      - name: Validate migrations
        working-directory: apps/api
        run: |
          flyway -url="jdbc:mysql://127.0.0.1:3306/parking_mgmt?useSSL=false&allowPublicKeyRetrieval=true" \
                 -user=root -password=test_root_password \
                 -locations="filesystem:db/migrations" \
                 validate

  security:
    name: Security Gate
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4

      - name: Dependency review
        if: github.event_name == 'pull_request'
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high

      - uses: pnpm/action-setup@v4
        with:
          version: ${{ env.PNPM_VERSION }}

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Capture dependency audit report
        id: audit
        continue-on-error: true
        run: pnpm audit --audit-level=high --json > audit-report.json

      - name: Upload audit report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-audit-report
          path: audit-report.json
          retention-days: 7