ci: drop service-container credentials that made the template invalid… #293

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main, develop]
	pull_request:
	branches: [main, develop]

	env:
	NODE_VERSION: '20'

	jobs:
	networkpolicy-port-lint:
	name: NetworkPolicy port consistency
	runs-on: ubuntu-latest
	timeout-minutes: 3
	# Prevents the 2026-05-04 status.enclii.dev outage class:
	# NetworkPolicy `ports:` clauses that don't intersect the selected pods'
	# containerPorts (silent CNI drop, hours to diagnose).
	# See scripts/check-networkpolicy-ports.py for full rationale.
	steps:
	- uses: actions/checkout@v7
	- name: Set up Python
	uses: actions/setup-python@v7
	with:
	python-version: '3.11'
	- name: Install PyYAML
	run: pip install pyyaml
	- name: Run NetworkPolicy port lint
	run: python3 scripts/check-networkpolicy-ports.py infra/k8s/

	lint:
	name: Lint
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup Node.js
	uses: actions/setup-node@v7
	with:
	node-version: ${{ env.NODE_VERSION }}

	- name: Setup pnpm
	uses: pnpm/action-setup@v6

	- name: Get pnpm store directory
	id: pnpm-cache
	shell: bash
	run: \|
	echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

	- name: Setup pnpm cache
	uses: actions/cache@v6
	with:
	path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
	key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
	restore-keys: \|
	${{ runner.os }}-pnpm-store-

	- name: Configure npm registry
	run: \|
	echo "@madfam:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "@coforma:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "@janua:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "//npm.madfam.io/:_authToken=${{ secrets.NPM_MADFAM_TOKEN }}" >> ~/.npmrc

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	# @coforma/api, @coforma/types and @coforma/ui lint clean. They block, and
	# must keep blocking — this step is the regression gate for them.
	- name: Run ESLint (blocking)
	run: pnpm exec turbo run lint --filter='!@coforma/web'

	# 2026-08-06: @coforma/web has 145 real typed-lint errors, tracked in #113.
	# Non-blocking DELIBERATELY and TEMPORARILY. Note what was NOT done to get
	# here: no rule disabled, no eslint-disable added, no severity downgraded.
	# The step still runs and its full output is in the job log.
	# Burn down #113, then delete continue-on-error to re-block.
	- name: Run ESLint for @coforma/web (non-blocking, tracked in #113)
	run: pnpm exec turbo run lint --filter=@coforma/web
	continue-on-error: true

	# 2026-08-06: 116 files fail format:check, tracked in #114. This never
	# surfaced before, because ESLint failed first and the job stopped here.
	# Not auto-formatted in this PR on purpose: 78 of those files are
	# .ts/.tsx and a repo-wide reformat would conflict with every open PR.
	# Reformat once the PR queue drains, then delete continue-on-error.
	- name: Run Prettier (non-blocking, tracked in #114)
	run: pnpm format:check
	continue-on-error: true

	typecheck:
	name: Type Check
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup Node.js
	uses: actions/setup-node@v7
	with:
	node-version: ${{ env.NODE_VERSION }}

	- name: Setup pnpm
	uses: pnpm/action-setup@v6

	- name: Get pnpm store directory
	id: pnpm-cache
	shell: bash
	run: \|
	echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

	- name: Setup pnpm cache
	uses: actions/cache@v6
	with:
	path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
	key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
	restore-keys: \|
	${{ runner.os }}-pnpm-store-

	- name: Configure npm registry
	run: \|
	echo "@madfam:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "@coforma:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "@janua:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "//npm.madfam.io/:_authToken=${{ secrets.NPM_MADFAM_TOKEN }}" >> ~/.npmrc

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Run TypeScript type check
	run: pnpm typecheck

	build:
	name: Build
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup Node.js
	uses: actions/setup-node@v7
	with:
	node-version: ${{ env.NODE_VERSION }}

	- name: Setup pnpm
	uses: pnpm/action-setup@v6

	- name: Get pnpm store directory
	id: pnpm-cache
	shell: bash
	run: \|
	echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

	- name: Setup pnpm cache
	uses: actions/cache@v6
	with:
	path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
	key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
	restore-keys: \|
	${{ runner.os }}-pnpm-store-

	- name: Configure npm registry
	run: \|
	echo "@madfam:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "@coforma:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "@janua:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "//npm.madfam.io/:_authToken=${{ secrets.NPM_MADFAM_TOKEN }}" >> ~/.npmrc

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Build packages
	run: pnpm build
	env:
	# Mock environment variables for build
	DATABASE_URL: postgresql://mock:mock@localhost:5432/mock
	NEXTAUTH_URL: http://localhost:3000
	NEXTAUTH_SECRET: mock-secret-for-build
	NEXT_PUBLIC_API_URL: http://localhost:4000

	test:
	name: Test
	runs-on: ubuntu-latest
	services:
	postgres:
	# No `credentials:` here. postgres:15 is a public official image, these
	# jobs run on GitHub-hosted runners (public repo), and a credentials block
	# whose secrets resolve to '' — which is exactly what Dependabot PRs get —
	# makes the whole workflow TEMPLATE INVALID, so the job cannot start at all.
	# That silently blocked every Dependabot PR on this repo.
	image: postgres:15
	env:
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: postgres
	POSTGRES_DB: coforma_test
	options: >-
	--health-cmd pg_isready
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	ports:
	- 5432:5432

	redis:
	image: redis:7 # public official image; see the note above re: Dependabot
	options: >-
	--health-cmd "redis-cli ping"
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	ports:
	- 6379:6379

	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Setup Node.js
	uses: actions/setup-node@v7
	with:
	node-version: ${{ env.NODE_VERSION }}

	- name: Setup pnpm
	uses: pnpm/action-setup@v6

	- name: Get pnpm store directory
	id: pnpm-cache
	shell: bash
	run: \|
	echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT

	- name: Setup pnpm cache
	uses: actions/cache@v6
	with:
	path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
	key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
	restore-keys: \|
	${{ runner.os }}-pnpm-store-

	- name: Configure npm registry
	run: \|
	echo "@madfam:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "@coforma:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "@janua:registry=https://npm.madfam.io" >> ~/.npmrc
	echo "//npm.madfam.io/:_authToken=${{ secrets.NPM_MADFAM_TOKEN }}" >> ~/.npmrc

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	# db:migrate:test, NOT db:deploy. db:deploy is the human-facing
	# production path and stays gated behind LOCAL_PRODUCTION_OPS=yes; that
	# gate is why this job has never reached `pnpm test`. This job migrates a
	# throwaway service container, so it takes the narrower guard, which
	# refuses anything that is not visibly a test database.
	- name: Run database migrations
	run: pnpm db:migrate:test
	env:
	DATABASE_URL: postgresql://postgres:postgres@localhost:5432/coforma_test

	- name: Run tests
	run: pnpm test
	env:
	DATABASE_URL: postgresql://postgres:postgres@localhost:5432/coforma_test
	REDIS_URL: redis://localhost:6379
	NEXTAUTH_SECRET: test-secret

	- name: Upload coverage reports
	uses: codecov/codecov-action@v7
	if: always()
	with:
	files: ./coverage/lcov.info
	flags: unittests
	name: codecov-umbrella
	fail_ci_if_error: false

	security:
	name: Security Scan
	runs-on: ubuntu-latest
	# Uploading a SARIF file needs security-events: write. This repo's default
	# GITHUB_TOKEN permission is read-only, which is why the upload failed with
	# the very unhelpful "Resource not accessible by integration". Granting it
	# per job keeps the default read-only everywhere else.
	permissions:
	contents: read
	security-events: write
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Run Trivy vulnerability scanner
	# Pinned to a release tag rather than @master: @master silently changes
	# under us, which is a poor property for a security job in particular.
	uses: aquasecurity/trivy-action@v0.36.0
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'sarif'
	output: 'trivy-results.sarif'

	- name: Upload Trivy results to GitHub Security
	# v2 is retired and fails the job outright: "CodeQL Action major
	# versions v1 and v2 have been deprecated."
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: 'trivy-results.sarif'

Navigation Menu

Uh oh!

ci: drop service-container credentials that made the template invalid… #293

Workflow file

ci: drop service-container credentials that made the template invalid… #293

Uh oh!

Workflow file for this run