Add customer delivery risk benchmark lane #169
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| jobs: | |
| k8s: | |
| name: K8s manifests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install kubectl | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| version="v1.30.0" | |
| curl -fsSLo kubectl "https://dl.k8s.io/release/${version}/bin/linux/amd64/kubectl" | |
| curl -fsSLo kubectl.sha256 "https://dl.k8s.io/release/${version}/bin/linux/amd64/kubectl.sha256" | |
| echo "$(cat kubectl.sha256) kubectl" | sha256sum --check | |
| chmod +x kubectl | |
| sudo install -m 0755 kubectl /usr/local/bin/kubectl | |
| kubectl version --client | |
| - name: Validate kustomize renders | |
| run: make k8s-validate | |
| baseline: | |
| name: Validation baseline (Python 3.12 / Node 20) | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_DB: openhive_test | |
| POSTGRES_USER: openhive | |
| POSTGRES_PASSWORD: openhive | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U openhive" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| env: | |
| DATABASE_URL: postgresql+asyncpg://openhive:openhive@localhost:5432/openhive_test | |
| LLM_API_KEY: test-key | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: web/package-lock.json | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.1.0 | |
| with: | |
| version: "latest" | |
| - name: Install dependencies | |
| working-directory: server | |
| env: | |
| UV_DEFAULT_INDEX: https://pypi.org/simple | |
| run: uv sync --all-extras | |
| - name: Install frontend dependencies | |
| working-directory: web | |
| run: npm ci | |
| - name: Run repo validation baseline | |
| run: python3 scripts/validate.py quick | |
| backend-typecheck: | |
| name: Backend typecheck (Python 3.12) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.1.0 | |
| with: | |
| version: "latest" | |
| - name: Install dependencies | |
| working-directory: server | |
| env: | |
| UV_DEFAULT_INDEX: https://pypi.org/simple | |
| run: uv sync --all-extras | |
| - name: Type check (pyright) | |
| working-directory: server | |
| run: uv run pyright hive/ | |
| continue-on-error: true # remove once pyright strict is fully clean | |
| credential-boundary: | |
| name: Credential boundary acceptance (Python 3.12) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v8.1.0 | |
| with: | |
| version: "latest" | |
| - name: Install dependencies | |
| working-directory: server | |
| env: | |
| UV_DEFAULT_INDEX: https://pypi.org/simple | |
| run: uv sync --all-extras | |
| - name: Run credential boundary acceptance | |
| working-directory: server | |
| run: uv run pytest tests/test_acceptance/test_relay_secret_boundary.py -q | |
| frontend-typecheck: | |
| name: Frontend typecheck (Node 20) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: web/package-lock.json | |
| - name: Install dependencies | |
| working-directory: web | |
| run: npm ci | |
| - name: Type check (tsc) | |
| working-directory: web | |
| run: npx tsc --noEmit | |
| e2e: | |
| name: E2E (Playwright) | |
| runs-on: ubuntu-latest | |
| needs: | |
| - baseline | |
| - frontend-typecheck | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| cache-dependency-path: web/package-lock.json | |
| - name: Install dependencies | |
| working-directory: web | |
| run: npm ci | |
| - name: Install Playwright browsers | |
| working-directory: web | |
| run: npx playwright install --with-deps chromium | |
| - name: Run E2E tests | |
| working-directory: web | |
| run: npx playwright test | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@v6 | |
| with: | |
| name: playwright-report | |
| path: web/playwright-report/ | |
| retention-days: 7 |