feat(registry): 完善 Web 并迁移至 CPython 与 Neon #103
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Registry checks | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: registry-checks-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| dependency-review: | |
| name: Dependency review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Reject new high-severity vulnerabilities | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: high | |
| fail-on-scopes: development, runtime | |
| repository: | |
| name: ext-reg checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| services: | |
| postgres: | |
| image: postgres:17 | |
| env: | |
| POSTGRES_USER: registry | |
| POSTGRES_PASSWORD: registry-check | |
| POSTGRES_DB: registry_check | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U registry -d registry_check" | |
| --health-interval 5s --health-timeout 5s --health-retries 12 | |
| env: | |
| REGISTRY_TEST_DATABASE_URL: postgres://registry:registry-check@localhost:5432/registry_check | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version-file: .python-version | |
| - name: Install PDM | |
| run: python -m pip install pdm==2.28.0 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| with: | |
| version: 11.11.0 | |
| - name: Set up Node | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version-file: package.json | |
| cache: pnpm | |
| - name: Install frozen dependencies | |
| run: | | |
| pdm install --frozen-lockfile | |
| pnpm install --frozen-lockfile | |
| - name: Run repository contract | |
| run: pnpm check | |
| - name: Enforce append-only deployed migration history | |
| if: github.event_name == 'pull_request' | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| git fetch --no-tags origin "$BASE_SHA" | |
| git diff --exit-code --diff-filter=DMRT "$BASE_SHA" HEAD -- migrations src/inkcre_extension_registry/migrations | |
| - name: Build the single CPython service image | |
| run: docker build --build-arg SOURCE_REVISION="$GITHUB_SHA" --tag registry-check . | |
| - name: Verify the installed image serves HTTP and the migrated database | |
| run: | | |
| docker run --detach --rm --name registry-image-check --network host \ | |
| --env DATABASE_URL="$REGISTRY_TEST_DATABASE_URL" \ | |
| --env PUBLIC_ORIGIN=http://localhost:8000 \ | |
| --env S3_ENDPOINT_URL=http://localhost:9000 --env S3_BUCKET=unused \ | |
| --env AWS_ACCESS_KEY_ID=testing --env AWS_SECRET_ACCESS_KEY=testing \ | |
| registry-check | |
| trap 'docker logs registry-image-check; docker stop registry-image-check' EXIT | |
| curl --fail --silent --show-error --retry 20 --retry-connrefused --retry-delay 1 \ | |
| http://localhost:8000/livez | jq -e '.status == "ok" and .revision == env.GITHUB_SHA' | |
| curl --fail --silent --show-error http://localhost:8000/v1/extensions | jq -e '. == []' | |
| curl --fail --silent --show-error http://localhost:8000/publish | grep -F 'Extension Registry' |