ext-reg/.github/workflows/ci.yml at main · InKCre/ext-reg · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: Registry checks

on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: registry-checks-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  dependency-review:
    name: Dependency review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Reject new high-severity vulnerabilities
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: high
          fail-on-scopes: development, runtime

  repository:
    name: ext-reg checks
    runs-on: ubuntu-latest
    timeout-minutes: 20
    services:
      postgres:
        image: postgres:17
        env:
          POSTGRES_USER: registry
          POSTGRES_PASSWORD: registry-check
          POSTGRES_DB: registry_check
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U registry -d registry_check"
          --health-interval 5s --health-timeout 5s --health-retries 12
    env:
      REGISTRY_TEST_DATABASE_URL: postgres://registry:registry-check@localhost:5432/registry_check
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version-file: .python-version

      - name: Install PDM
        run: python -m pip install pdm==2.28.0

      - name: Install pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 11.11.0

      - name: Set up Node
        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version-file: package.json
          cache: pnpm

      - name: Install frozen dependencies
        run: |
          pdm install --frozen-lockfile
          pnpm install --frozen-lockfile

      - name: Run repository contract
        run: pnpm check

      - name: Enforce append-only deployed migration history
        if: github.event_name == 'pull_request'
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          git fetch --no-tags origin "$BASE_SHA"
          git diff --exit-code --diff-filter=DMRT "$BASE_SHA" HEAD -- migrations src/inkcre_extension_registry/migrations

      - name: Build the single CPython service image
        run: docker build --build-arg SOURCE_REVISION="$GITHUB_SHA" --tag registry-check .

      - name: Verify the installed image serves HTTP and the migrated database
        run: |
          docker run --detach --rm --name registry-image-check --network host \
            --env DATABASE_URL="$REGISTRY_TEST_DATABASE_URL" \
            --env PUBLIC_ORIGIN=http://localhost:8000 \
            --env S3_ENDPOINT_URL=http://localhost:9000 --env S3_BUCKET=unused \
            --env AWS_ACCESS_KEY_ID=testing --env AWS_SECRET_ACCESS_KEY=testing \
            registry-check
          trap 'docker logs registry-image-check; docker stop registry-image-check' EXIT
          curl --fail --silent --show-error --retry 20 --retry-connrefused --retry-delay 1 \
            http://localhost:8000/livez | jq -e '.status == "ok" and .revision == env.GITHUB_SHA'
          curl --fail --silent --show-error http://localhost:8000/v1/extensions | jq -e '. == []'
          curl --fail --silent --show-error http://localhost:8000/publish | grep -F 'Extension Registry'