openhive/.github/workflows/ci.yml at 0c31cc1f34ab4b7cf681d784c3a314cf6762ffb5 · terrywangcode/openhive · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  k8s:
    name: K8s manifests
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Install kubectl
        shell: bash
        run: |
          set -euo pipefail
          version="v1.30.0"
          curl -fsSLo kubectl "https://dl.k8s.io/release/${version}/bin/linux/amd64/kubectl"
          curl -fsSLo kubectl.sha256 "https://dl.k8s.io/release/${version}/bin/linux/amd64/kubectl.sha256"
          echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check
          chmod +x kubectl
          sudo install -m 0755 kubectl /usr/local/bin/kubectl
          kubectl version --client

      - name: Validate kustomize renders
        run: make k8s-validate

  baseline:
    name: Validation baseline (Python 3.12 / Node 20)
    runs-on: ubuntu-latest

    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: openhive_test
          POSTGRES_USER: openhive
          POSTGRES_PASSWORD: openhive
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U openhive"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      DATABASE_URL: postgresql+asyncpg://openhive:openhive@localhost:5432/openhive_test
      LLM_API_KEY: test-key

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: web/package-lock.json

      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0
        with:
          version: "latest"

      - name: Install dependencies
        working-directory: server
        env:
          UV_DEFAULT_INDEX: https://pypi.org/simple
        run: uv sync --all-extras

      - name: Install frontend dependencies
        working-directory: web
        run: npm ci

      - name: Run repo validation baseline
        run: python3 scripts/validate.py quick

  backend-typecheck:
    name: Backend typecheck (Python 3.12)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0
        with:
          version: "latest"

      - name: Install dependencies
        working-directory: server
        env:
          UV_DEFAULT_INDEX: https://pypi.org/simple
        run: uv sync --all-extras

      - name: Type check (pyright)
        working-directory: server
        run: uv run pyright hive/
        continue-on-error: true   # remove once pyright strict is fully clean

  credential-boundary:
    name: Credential boundary acceptance (Python 3.12)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0
        with:
          version: "latest"

      - name: Install dependencies
        working-directory: server
        env:
          UV_DEFAULT_INDEX: https://pypi.org/simple
        run: uv sync --all-extras

      - name: Run credential boundary acceptance
        working-directory: server
        run: uv run pytest tests/test_acceptance/test_relay_secret_boundary.py -q

  frontend-typecheck:
    name: Frontend typecheck (Node 20)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: web/package-lock.json

      - name: Install dependencies
        working-directory: web
        run: npm ci

      - name: Type check (tsc)
        working-directory: web
        run: npx tsc --noEmit

  e2e:
    name: E2E (Playwright)
    runs-on: ubuntu-latest
    needs:
      - baseline
      - frontend-typecheck

    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "npm"
          cache-dependency-path: web/package-lock.json

      - name: Install dependencies
        working-directory: web
        run: npm ci

      - name: Install Playwright browsers
        working-directory: web
        run: npx playwright install --with-deps chromium

      - name: Run E2E tests
        working-directory: web
        run: npx playwright test

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v6
        with:
          name: playwright-report
          path: web/playwright-report/
          retention-days: 7