implementer
e52b19b1e7
CI / Frozen lockfile install (pull_request) Successful in 56s
CI / Secrets not embedded (E00-S02-T08) (pull_request) Successful in 25s
CI / Database-postgres import isolation (E00-S03-T02) (pull_request) Successful in 28s
CI / Migration ledger (E00-S03-T03) (pull_request) Successful in 42s
CI / Compose config (E00-S03-T01) (pull_request) Successful in 29s
Static assertions on the committed ledger source (idempotent table DDL, parameterized idempotent record, has/applied queries, driver-boundary re-export, CI enforcement) with mutation probes proving non-vacuousness; docker-gated real-stack probe migrates an empty database (isolated compose project + host port) and confirms the ledger exists, the applied migrations are recorded, and a re-run records nothing twice. New additive database-postgres-ledger CI job gates the criterion on every PR.
96 lines
3.6 KiB
YAML
96 lines
3.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
frozen-install:
|
|
name: Frozen lockfile install
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Verify workspace groups
|
|
run: pnpm -r list --depth -1
|
|
|
|
# E00-S02-T08: the static assertions of tests/secrets-not-embedded.test.mjs
|
|
# gate every PR (the docker-gated layer-scan probe inside the same file runs
|
|
# where a Docker daemon is available and skips cleanly otherwise).
|
|
secrets-not-embedded:
|
|
name: Secrets not embedded (E00-S02-T08)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run secrets-not-embedded test suite
|
|
run: node --test tests/secrets-not-embedded.test.mjs
|
|
|
|
# E00-S03-T02: the static assertions of tests/database-postgres-imports.test.mjs
|
|
# gate every PR — the scan proves pg/Kysely imports live only in
|
|
# packages/database-postgres and the mutation probes prove the scan catches
|
|
# a driver import injected into any other package.
|
|
database-postgres-imports:
|
|
name: Database-postgres import isolation (E00-S03-T02)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run database-postgres import isolation suite
|
|
run: node --test tests/database-postgres-imports.test.mjs
|
|
|
|
# E00-S03-T03: the static assertions of tests/database-postgres-ledger.test.mjs
|
|
# gate every PR — the suite locks in the migration ledger (schema_migrations
|
|
# table DDL, idempotent parameterized record, driver-boundary re-export)
|
|
# with mutation probes, and the docker-gated real-stack probe (migrate an
|
|
# empty database and confirm the ledger exists) runs where a Docker daemon
|
|
# is available and skips cleanly otherwise. The job installs the frozen
|
|
# workspace because the real-stack probe executes the committed ledger
|
|
# module from the host (it imports `pg` through the package's own links).
|
|
database-postgres-ledger:
|
|
name: Migration ledger (E00-S03-T03)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Run migration ledger test suite
|
|
run: node --test tests/database-postgres-ledger.test.mjs
|
|
|
|
# E00-S03-T01: the static assertions of tests/compose-config.test.mjs (db
|
|
# image pinned to postgres:18.6-bookworm, health gate, volume persistence,
|
|
# build platforms) gate every PR (the docker-gated real-stack probes inside
|
|
# the same file run where a Docker daemon is available and skip cleanly
|
|
# otherwise).
|
|
compose-config:
|
|
name: Compose config (E00-S03-T01)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run compose-config test suite
|
|
run: node --test tests/compose-config.test.mjs
|