Skip to content
CI/CD Pipeline

Add security headers, view dedup, audit trail, and RBAC logging (#889, #888, #887, #886, #890) #819

Sign in to view logs

Add security headers, view dedup, audit trail, and RBAC logging (#889, #888, #887, #886, #890)

Add security headers, view dedup, audit trail, and RBAC logging (#889, #888, #887, #886, #890) #819

Workflow file for this run

.github/workflows/ci.yml at 0128a37
name: CI/CD Pipeline
on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main, develop ]
jobs:
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '20'
cache: 'npm'
- name: Install dependencies
run: npm ci
# Issue #924 – Fail CI on any ESLint warning or error
- name: Run ESLint (zero warnings allowed)
run: npm run lint -- --max-warnings=0
validate-migrations:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '20'
cache: 'npm'
- name: Install dependencies
run: npm ci
# Issue #923 – Detect destructive migration changes before they reach production
- name: Validate migrations for destructive changes
run: npx ts-node scripts/validate-migrations.ts
test:
runs-on: ubuntu-latest
services:
postgres:
image: postgres:15
env:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: test
ports:
- 5432:5432
options: >-
--health-cmd pg_isready
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- uses: actions/checkout@v3
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '20'
cache: 'npm'
- name: Install dependencies
run: npm ci
- name: Generate Prisma Client
run: npm run db:generate
env:
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
- name: Wait for Postgres to be ready
run: |
for i in {1..30}; do
pg_isready -h localhost -p 5432 -U postgres && break
echo "Waiting for Postgres... ($i)"
sleep 2
done
- name: Sync Prisma schema to test database
run: npx prisma db push --skip-generate --accept-data-loss
env:
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
- name: Run tests
run: npm test
env:
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
JWT_SECRET: test-secret-key
JWT_REFRESH_SECRET: test-refresh-secret-key
- name: Check documents module test coverage (>70%)
run: npx jest src/documents --coverage --collectCoverageFrom="src/documents/**/*.ts" --collectCoverageFrom="!src/documents/**/*.module.ts" --collectCoverageFrom="!src/documents/**/*.dto.ts" --coverageThreshold='{"global":{"statements":70,"branches":70,"functions":70,"lines":70}}'
env:
DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
JWT_SECRET: test-secret-key
JWT_REFRESH_SECRET: test-refresh-secret-key
build:
runs-on: ubuntu-latest
needs: [lint, validate-migrations, test]
steps:
- uses: actions/checkout@v3
- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '20'
cache: 'npm'
- name: Install dependencies
run: npm ci
- name: Build application
run: npm run build
- name: Upload build artifacts
uses: actions/upload-artifact@v4
with:
name: dist
path: dist/
deploy-staging:
runs-on: ubuntu-latest
needs: [build]
if: github.ref == 'refs/heads/develop'
steps:
- uses: actions/checkout@v3
- name: Download build artifacts
uses: actions/download-artifact@v4
with:
name: dist
- name: Deploy to staging
run: |
echo "Deploying to staging environment..."
# Add your deployment commands here
deploy-production:
runs-on: ubuntu-latest
needs: [build]
if: github.ref == 'refs/heads/main'
steps:
- uses: actions/checkout@v3
- name: Download build artifacts
uses: actions/download-artifact@v4
with:
name: dist
- name: Deploy to production
run: |
echo "Deploying to production environment..."
# Add your deployment commands here