Normalize UI radius, typography, and card spacing #357
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| security: | |
| name: Security Baseline | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: | | |
| backend/package-lock.json | |
| sonus-react/package-lock.json | |
| - name: Ensure dotenv files are not tracked | |
| run: | | |
| if git ls-files | grep -E '(^|/)\.env$'; then | |
| echo "Tracked .env files detected." | |
| exit 1 | |
| fi | |
| - name: Scan for likely secrets | |
| run: | | |
| if grep -R -nE --exclude-dir=.git --exclude=package-lock.json --exclude=.env.example \ | |
| '(SUPABASE_SERVICE_ROLE_KEY\s*=\s*.+|AKIA[0-9A-Z]{16}|-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----|ghp_[A-Za-z0-9]{36,})' .; then | |
| echo "Potential secret material detected." | |
| exit 1 | |
| fi | |
| - name: Block unsafe Prisma raw queries | |
| run: | | |
| if grep -R -nE --include='*.ts' '\$(queryRawUnsafe|executeRawUnsafe)\b' backend/src; then | |
| echo "Unsafe Prisma raw query API detected." | |
| exit 1 | |
| fi | |
| - name: Install frontend dependencies | |
| run: npm ci --prefix sonus-react | |
| - name: Install backend dependencies | |
| run: npm ci --prefix backend | |
| - name: Audit frontend production dependencies | |
| run: npm audit --prefix sonus-react --omit=dev --audit-level=high | |
| - name: Audit backend production dependencies | |
| run: npm audit --prefix backend --omit=dev --audit-level=high | |
| frontend: | |
| name: Frontend Lint + Build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: sonus-react/package-lock.json | |
| - name: Install frontend dependencies | |
| run: npm ci --prefix sonus-react | |
| - name: Lint frontend | |
| run: npm --prefix sonus-react run lint | |
| - name: Unit tests (frontend) | |
| run: npm --prefix sonus-react run test:unit | |
| - name: Build frontend | |
| run: npm --prefix sonus-react run build | |
| - name: Enforce frontend bundle budgets | |
| run: npm --prefix sonus-react run check:budgets | |
| frontend-e2e-smoke: | |
| name: Frontend E2E Smoke | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: sonus-react/package-lock.json | |
| - name: Install frontend dependencies | |
| run: npm ci --prefix sonus-react | |
| - name: Install Playwright Chromium | |
| run: npx --prefix sonus-react playwright install --with-deps chromium | |
| - name: Run frontend smoke tests | |
| run: npm --prefix sonus-react run test:e2e -- tests/e2e/support-impact.spec.ts tests/e2e/support-impact-error.spec.ts tests/e2e/speak-mode-smoke.spec.ts | |
| backend: | |
| name: Backend Build + Core Regression | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_USER: sonus | |
| POSTGRES_PASSWORD: sonus_dev_password | |
| POSTGRES_DB: sonus | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U sonus -d sonus" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: backend/package-lock.json | |
| - name: Install backend dependencies | |
| run: npm ci --prefix backend | |
| - name: Write backend env | |
| run: | | |
| cat > backend/.env << 'EOF' | |
| DATABASE_URL=postgresql://sonus:sonus_dev_password@localhost:5432/sonus | |
| AUTH_MODE=mock | |
| DEV_USER_ID=00000000-0000-4000-8000-000000000001 | |
| DEV_USER_EMAIL=dev@local.test | |
| PORT=4000 | |
| RATE_LIMIT_MODE=memory | |
| TRUST_PROXY=false | |
| EOF | |
| - name: Prepare database | |
| run: | | |
| npm --prefix backend run prisma:generate | |
| npm --prefix backend run prisma:push | |
| - name: Lint backend | |
| run: npm --prefix backend run lint | |
| - name: Typecheck backend | |
| run: npm --prefix backend run typecheck | |
| - name: Route integration tests (backend) | |
| run: npm --prefix backend run test:routes | |
| - name: Format check backend | |
| run: npm --prefix backend run format:check | |
| - name: Build backend | |
| run: npm --prefix backend run build | |
| - name: Security regression checks | |
| run: npm --prefix backend run test:security | |
| - name: Auth mode boundary checks | |
| run: npm --prefix backend run test:auth-modes | |
| - name: Start backend and run core regression | |
| run: | | |
| npm --prefix backend run dev > /tmp/backend-dev.log 2>&1 & | |
| BACKEND_PID=$! | |
| trap "kill ${BACKEND_PID}" EXIT | |
| for i in {1..40}; do | |
| if curl -fsS http://127.0.0.1:4000/health > /dev/null; then | |
| break | |
| fi | |
| sleep 1 | |
| done | |
| curl -fsS http://127.0.0.1:4000/health > /dev/null | |
| npm --prefix backend run test:core | |
| PERF_RUNS=5 npm --prefix backend run perf:smoke |