272 lines
13 KiB
YAML
272 lines
13 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
frozen-install:
|
|
name: Frozen lockfile install
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Verify workspace groups
|
|
run: pnpm -r list --depth -1
|
|
|
|
# E00-S02-T08: the static assertions of tests/secrets-not-embedded.test.mjs
|
|
# gate every PR (the docker-gated layer-scan probe inside the same file runs
|
|
# where a Docker daemon is available and skips cleanly otherwise).
|
|
secrets-not-embedded:
|
|
name: Secrets not embedded (E00-S02-T08)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run secrets-not-embedded test suite
|
|
run: node --test tests/secrets-not-embedded.test.mjs
|
|
|
|
# E00-S03-T02: the static assertions of tests/database-postgres-imports.test.mjs
|
|
# gate every PR — the scan proves pg/Kysely imports live only in
|
|
# packages/database-postgres and the mutation probes prove the scan catches
|
|
# a driver import injected into any other package.
|
|
database-postgres-imports:
|
|
name: Database-postgres import isolation (E00-S03-T02)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run database-postgres import isolation suite
|
|
run: node --test tests/database-postgres-imports.test.mjs
|
|
|
|
# E00-S03-T03: the static assertions of tests/database-postgres-ledger.test.mjs
|
|
# gate every PR — the suite locks in the migration ledger (schema_migrations
|
|
# table DDL, idempotent parameterized record, driver-boundary re-export)
|
|
# with mutation probes, and the docker-gated real-stack probe (migrate an
|
|
# empty database and confirm the ledger exists) runs where a Docker daemon
|
|
# is available and skips cleanly otherwise. The job installs the frozen
|
|
# workspace because the real-stack probe executes the committed ledger
|
|
# module from the host (it imports `pg` through the package's own links).
|
|
database-postgres-ledger:
|
|
name: Migration ledger (E00-S03-T03)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Run migration ledger test suite
|
|
run: node --test tests/database-postgres-ledger.test.mjs
|
|
|
|
# E00-S03-T04: the static assertions of tests/database-postgres-lock.test.mjs
|
|
# gate every PR — the suite locks in the migration advisory lock (session-
|
|
# scoped pg_advisory_lock/pg_try_advisory_lock over a stable keyed hash on a
|
|
# dedicated connection, re-entrant-safe in-flight acquire so concurrent
|
|
# acquire() calls share one connection, driver-boundary re-export) with
|
|
# mutation probes, and the docker-gated real-stack concurrent probe (a
|
|
# second runner waits or fails while the first holds the lock; concurrent
|
|
# acquire() checks out exactly one connection; the lock releases when the
|
|
# holding session ends) runs where a Docker daemon is available and skips
|
|
# cleanly otherwise. The job installs the frozen workspace because the
|
|
# real-stack probe executes the committed lock module from the host (it
|
|
# imports `pg` through the package's own links).
|
|
database-postgres-lock:
|
|
name: Migration advisory lock (E00-S03-T04)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Run migration advisory lock test suite
|
|
run: node --test tests/database-postgres-lock.test.mjs
|
|
|
|
# E00-S03-T05: the static assertions of tests/database-postgres-diagnostic.test.mjs
|
|
# gate every PR — the suite locks in the migration failure diagnostic (a
|
|
# structured MigrationFailedError whose diagnostic identifies the failing
|
|
# migration, the failure phase, the underlying cause, and the applied/pending
|
|
# ledger state, serializable via toJSON) with mutation probes, and a
|
|
# deterministic stub-pool behavioral probe (intentionally failing migration
|
|
# fixture -> structured diagnostic naming the failing migration) runs on
|
|
# Node 24; the docker-gated real-stack probe (the issue's test plan: "run an
|
|
# intentionally failing migration fixture and confirm the diagnostic") runs
|
|
# where a Docker daemon is available and skips cleanly otherwise. The job
|
|
# installs the frozen workspace because the probes execute the committed
|
|
# runner module from the host (it imports `pg` through the package's own
|
|
# links).
|
|
database-postgres-diagnostic:
|
|
name: Migration failure diagnostic (E00-S03-T05)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Run migration failure diagnostic test suite
|
|
run: node --test tests/database-postgres-diagnostic.test.mjs
|
|
|
|
# E00-S03-T06: the static assertions of tests/app-readiness.test.mjs gate
|
|
# every PR — the suite locks in the readiness gate (the app answers
|
|
# GET /health with 503 {"status":"not ready"} until the startup migration
|
|
# run completes, then 200 {"status":"ok"}) with mutation probes, the
|
|
# deterministic probes (boot the committed server: no DATABASE_URL ->
|
|
# ready immediately; unreachable DATABASE_URL -> stays not-ready) run on
|
|
# Node 24, and the docker-gated real-stack probe (the issue's test plan:
|
|
# "start with pending migrations and confirm readiness waits" — the app's
|
|
# migration run is blocked behind a held ACCESS EXCLUSIVE lock on the
|
|
# migration ledger, /health stays not-ready, then flips ready once the lock
|
|
# releases) runs where a Docker daemon is available and skips cleanly
|
|
# otherwise. The job installs the frozen workspace and builds the config
|
|
# and database-postgres packages because the probes boot the committed
|
|
# server from the host (it imports @personal-blog/config and
|
|
# @personal-blog/database-postgres through the packages' own links; the
|
|
# required EPPP_SESSION_SECRET is provided by the probe's boot env).
|
|
app-readiness:
|
|
name: App readiness after migrations (E00-S03-T06)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Build the config and database-postgres packages (the probes boot the committed server which imports them)
|
|
run: pnpm --filter @personal-blog/config build && pnpm --filter @personal-blog/database-postgres build
|
|
- name: Run app readiness test suite
|
|
run: node --test tests/app-readiness.test.mjs
|
|
|
|
# E00-S04-T02: the static assertions of tests/config-startup-error.test.mjs
|
|
# gate every PR — the suite locks in the field-specific startup error (a
|
|
# missing required setting fails startup with an error naming the missing
|
|
# field: packages/config's MissingRequiredSettingError/assertValidConfig,
|
|
# wired into the committed server before it binds) with mutation probes, and
|
|
# the deterministic probes execute the issue's test plan ("start with a
|
|
# missing required field and confirm the error names it"): booting the
|
|
# committed server without EPPP_SESSION_SECRET exits non-zero naming
|
|
# sessionSecret, while a valid secret boots to GET /health 200. The job
|
|
# installs the frozen workspace and builds the config and database-postgres
|
|
# packages because the probes boot the committed server which imports them.
|
|
config-startup-error:
|
|
name: Field-specific startup errors (E00-S04-T02)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Build the config and database-postgres packages (the probes boot the committed server which imports them)
|
|
run: pnpm --filter @personal-blog/config build && pnpm --filter @personal-blog/database-postgres build
|
|
- name: Run config startup error test suite
|
|
run: node --test tests/config-startup-error.test.mjs
|
|
|
|
# E00-S04-T03: the static assertions of tests/config-log-redaction.test.mjs
|
|
# gate every PR — the suite locks in automatic secret redaction from logs
|
|
# (packages/config's redactConfig/redactText + the server's redacting
|
|
# logger: every log line is scrubbed of the config's secret values) with
|
|
# mutation probes, and the deterministic probes execute the issue's test
|
|
# plan ("log configuration and confirm secret values are redacted"):
|
|
# booting the committed server logs its resolved configuration with the
|
|
# secret values replaced by [REDACTED], and no secret value appears in the
|
|
# log output. The job installs the frozen workspace and builds the config
|
|
# and database-postgres packages because the probes boot the committed
|
|
# server which imports them.
|
|
config-log-redaction:
|
|
name: Secret redaction from logs (E00-S04-T03)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Build the config and database-postgres packages (the probes boot the committed server which imports them)
|
|
run: pnpm --filter @personal-blog/config build && pnpm --filter @personal-blog/database-postgres build
|
|
- name: Run config log redaction test suite
|
|
run: node --test tests/config-log-redaction.test.mjs
|
|
|
|
# E00-S04-T01: the static assertions of tests/config-schema.test.mjs gate
|
|
# every PR — the suite locks in the TypeBox/Ajv configuration schema
|
|
# (packages/config, golden-tuple pins @sinclair/typebox@0.34.52 +
|
|
# ajv@8.20.0) with mutation probes, and the deterministic probe executes
|
|
# the issue's test plan ("validate a full config against the TypeBox/Ajv
|
|
# schema") against the committed schema through Ajv. The job installs the
|
|
# frozen workspace and builds the config package because the probe also
|
|
# exercises the compiled package boundary (@personal-blog/config) exactly
|
|
# as the later configuration adapter will consume it.
|
|
config-schema:
|
|
name: TypeBox/Ajv config schema (E00-S04-T01)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Enable pnpm (corepack, pinned to 11.23.0 via packageManager)
|
|
run: corepack enable
|
|
- name: Install dependencies (frozen lockfile)
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Build the config package (the probe exercises the compiled package boundary)
|
|
run: pnpm --filter @personal-blog/config build
|
|
- name: Run config schema test suite
|
|
run: node --test tests/config-schema.test.mjs
|
|
|
|
# E00-S03-T01: the static assertions of tests/compose-config.test.mjs (db
|
|
# image pinned to postgres:18.6-bookworm, health gate, volume persistence,
|
|
# build platforms) gate every PR (the docker-gated real-stack probes inside
|
|
# the same file run where a Docker daemon is available and skip cleanly
|
|
# otherwise).
|
|
compose-config:
|
|
name: Compose config (E00-S03-T01)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Install Node.js 24
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '24'
|
|
- name: Run compose-config test suite
|
|
run: node --test tests/compose-config.test.mjs
|