implementer
5c202ba21e
- packages/database-postgres (@personal-blog/database-postgres): the single workspace package allowed to import the PostgreSQL driver — declares pg and kysely as exact dependencies (@types/pg for types) and its src/index.ts imports and re-exports the driver pieces (Pool, Kysely, PostgresDialect) so the isolation is real, not a placeholder - pnpm-lock.yaml: importer for packages/database-postgres plus the resolved pg/kysely dependency tree (frozen-lockfile install keeps working) - .gitea/workflows/ci.yml: new database-postgres-imports job runs tests/database-postgres-imports.test.mjs on every PR so the isolation criterion gates merges
72 lines
2.5 KiB
YAML
72 lines
2.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
frozen-install:
|
|
name: Frozen lockfile install
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Verify workspace groups
|
|
run: pnpm -r list --depth -1
|
|
|
|
# E00-S02-T08: the static assertions of tests/secrets-not-embedded.test.mjs
|
|
# gate every PR (the docker-gated layer-scan probe inside the same file runs
|
|
# where a Docker daemon is available and skips cleanly otherwise).
|
|
secrets-not-embedded:
|
|
name: Secrets not embedded (E00-S02-T08)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run secrets-not-embedded test suite
|
|
run: node --test tests/secrets-not-embedded.test.mjs
|
|
|
|
# E00-S03-T02: the static assertions of tests/database-postgres-imports.test.mjs
|
|
# gate every PR — the scan proves pg/Kysely imports live only in
|
|
# packages/database-postgres and the mutation probes prove the scan catches
|
|
# a driver import injected into any other package.
|
|
database-postgres-imports:
|
|
name: Database-postgres import isolation (E00-S03-T02)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run database-postgres import isolation suite
|
|
run: node --test tests/database-postgres-imports.test.mjs
|
|
|
|
# E00-S03-T01: the static assertions of tests/compose-config.test.mjs (db
|
|
# image pinned to postgres:18.6-bookworm, health gate, volume persistence,
|
|
# build platforms) gate every PR (the docker-gated real-stack probes inside
|
|
# the same file run where a Docker daemon is available and skip cleanly
|
|
# otherwise).
|
|
compose-config:
|
|
name: Compose config (E00-S03-T01)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run compose-config test suite
|
|
run: node --test tests/compose-config.test.mjs
|