@@ -19,137 +19,93 @@ concurrency:
1919 group : ci-${{ github.ref }}
2020 cancel-in-progress : true
2121
22- env :
23- # tests/__init__.py sets these too, but alembic loads app.models -> app.config,
24- # which validates settings at import time and exits if they are missing.
25- BOT_TOKEN : " 123456:CITOKEN1234567890"
26- BOT_USERNAME : quoto_ci_bot
27-
2822jobs :
2923 test :
30- name : Test
24+ name : Build, vet, test
3125 runs-on : ubuntu-latest
3226 steps :
3327 - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
34-
35- - uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
28+ - uses : actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
3629 with :
37- python -version: " 3.12 "
38- cache : pip
39- cache-dependency-path : requirements.txt
40-
41- - name : Install dependencies
30+ go -version-file : go.mod
31+ cache : true
32+ - name : No local replace in go.mod
33+ # A replace points at a checkout on one machine. It builds there and
34+ # nowhere else, the Docker build included.
4235 run : |
43- python -m pip install --upgrade pip
44- pip install -r requirements.txt
45-
46- name : Every direct dependency is pinned in requirements.txt
47- # requirements.in is the intent, requirements.txt is what installs. A
48- # package added to the first and never compiled into the second is a
49- # dependency the container will not have.
36+ if grep -nE '^\s*replace\b' go.mod; then
37+ echo "go.mod has a replace directive; release the module it points at and require the tag"
38+ exit 1
39+ fi
40+ name : Verify modules
5041 run : |
51- missing=0
52- while read -r pkg; do
53- case "$pkg" in ''|'#'*) continue ;; esac
54- name=$(printf '%s' "$pkg" | sed 's/[<>=!~;[].*//' | tr -d '[:space:]')
55- [ -z "$name" ] && continue
56- grep -qiE "^${name}(\[|==)" requirements.txt || {
57- echo "missing from requirements.txt: ${name}"; missing=1; }
58- done < requirements.in
59- exit "$missing"
60-
61- name : Compile all sources
62- run : python -m compileall -q app tests scripts main.py healthcheck.py
63-
42+ go mod verify
43+ go mod tidy
44+ git diff --exit-code -- go.mod go.sum
45+ name : Format
46+ run : test -z "$(gofmt -l .)"
47+ - name : Build
48+ run : go build ./...
49+ - name : Vet
50+ run : go vet ./...
6451 - name : Test
65- run : python -m pytest -q tests
52+ run : go test -race ./...
6653
67- audit :
68- name : Dependency advisories
54+ database :
55+ name : Database tests
6956 runs-on : ubuntu-latest
70- # Known advisories are reported on every run but only fail the weekly one:
71- # a new advisory against a pinned package is not a reason to hold a release
72- # of unrelated code, and Dependabot opens the upgrade.
73- continue-on-error : ${{ github.event_name != 'schedule' }}
74- steps :
75- - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
76-
77- - uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
78- with :
79- python-version : " 3.12"
80- cache : pip
81- cache-dependency-path : requirements.txt
82-
83- - name : Audit requirements.txt
84- run : |
85- python -m pip install --upgrade pip pip-audit
86- pip-audit -r requirements.txt --progress-spinner off
87-
88- migrations :
89- name : Migrations
90- runs-on : ubuntu-latest
91- env :
92- DB_URL : postgresql+asyncpg://quoto:quoto@localhost:5432/quoto
93- PGPASSWORD : quoto
9457 services :
9558 postgres :
9659 image : postgres:17-alpine
9760 env :
98- POSTGRES_USER : quoto
99- POSTGRES_PASSWORD : quoto
100- POSTGRES_DB : quoto
101- options : >-
102- --health-cmd "pg_isready -U quoto"
103- --health-interval 5s --health-timeout 5s --health-retries 10
61+ POSTGRES_USER : postgres
62+ POSTGRES_PASSWORD : postgres
63+ POSTGRES_DB : quoto_test
10464 ports : ["5432:5432"]
65+ options : >-
66+ --health-cmd "pg_isready -U postgres -d quoto_test"
67+ --health-interval 5s
68+ --health-timeout 5s
69+ --health-retries 20
10570steps :
10671 - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
107-
108- - uses : actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
72+ - uses : actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
10973 with :
110- python-version : " 3.12"
111- cache : pip
112- cache-dependency-path : requirements.txt
113-
114- - name : Install dependencies
115- run : |
116- python -m pip install --upgrade pip
117- pip install -r requirements.txt
118-
119- name : Reject a branched migration history
120- # Two heads mean two migrations claim the same parent. Alembic then
121- # refuses to upgrade on the host, after the deploy has already started.
122- run : |
123- heads=$(alembic heads | grep -c . || true)
124- if [ "$heads" -ne 1 ]; then
125- echo "expected exactly one alembic head, found ${heads}:"
126- alembic heads
127- exit 1
128- fi
129-
130- name : Seed the shared core schema
131- # Production applies these from the core repository. deploy/core-init.sql
132- # is the verbatim copy quoto's foreign keys need to exist first.
133- run : psql -h localhost -U quoto -d quoto -v ON_ERROR_STOP=1 -f deploy/core-init.sql
74+ go-version-file : go.mod
75+ cache : true
76+ - name : Run database tests
77+ # Every integration test drops and recreates schema quoto, so the
78+ # packages must not run at the same time.
79+ env :
80+ QUOTO_TEST_DATABASE_URL : postgres://postgres:postgres@localhost:5432/quoto_test?sslmode=disable
81+ run : go test -tags=integration -race -p 1 ./...
13482
135- - name : Upgrade, step back down, upgrade again
136- # A migration that cannot be undone is a migration that cannot be rolled
137- # back on the host either.
83+ govulncheck :
84+ name : Vulnerability scan
85+ runs-on : ubuntu-latest
86+ steps :
87+ - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
88+ - uses : actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
89+ with :
90+ go-version-file : go.mod
91+ cache : true
92+ - name : Run govulncheck
13893 run : |
139- alembic upgrade head
140- alembic downgrade -1
141- alembic upgrade head
94+ go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
95+ "$(go env GOPATH)/bin/govulncheck" ./...
14296
14397image :
14498 name : Docker build
14599 runs-on : ubuntu-latest
146100 steps :
147101 - uses : actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
148-
149102 - name : Build image
150103 run : docker build -t quoto:ci .
151-
152- - name : Validate compose
104+ - name : Validate Compose
153105 run : |
154106 cp .env.example .env
155- docker compose config >/dev/null
107+ cp .env.example deploy/ws04/.env
108+ QUOTO_IMAGE=ghcr.io/freshlabdev/quoto:test \
109+ QUOTO_CORE_PASSWORD=ci-validation-only \
110+ docker compose -f deploy/ws04/compose.yaml config >/dev/null
111+ docker compose -f deploy/ws04/compose.test.yaml config >/dev/null
0 commit comments