chore(.secrets.baseline): Update secrets baseline timestamp #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| jobs: | |
| detect-secrets: | |
| name: Detect secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: '3.x' | |
| - name: Install detect-secrets | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install detect-secrets==1.5.0 | |
| - name: Run detect-secrets scan (project folders) and compare to baseline | |
| # Scan only project folders so CI compares the same scope as the committed baseline. | |
| run: | | |
| detect-secrets scan --exclude-files '\.secrets\.baseline$' --exclude-files 'detect_findings\.baseline$' auth_platform dev-portal-ui/dev-portal-ui > new.baseline || true | |
| if [ -f .secrets.baseline ]; then | |
| echo "Comparing new scan to committed baseline (scoped)..." | |
| # Strip the generated_at timestamp from both files before comparing so | |
| # timestamp-only differences won't fail the job. | |
| sed '/"generated_at"/d' .secrets.baseline > .secrets.baseline.filtered || true | |
| sed '/"generated_at"/d' new.baseline > new.baseline.filtered || true | |
| git --no-pager diff --no-index --exit-code .secrets.baseline.filtered new.baseline.filtered | |
| else | |
| echo "No .secrets.baseline found in repo; failing to avoid accidental leaks" | |
| cat new.baseline || true | |
| exit 1 | |
| fi | |
| backend-tests: | |
| name: Backend tests (Poetry) | |
| needs: detect-secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Python 3.10 | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: '3.10' | |
| - name: Install Poetry | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install poetry | |
| - name: Install dependencies (auth_platform) | |
| run: | | |
| cd auth_platform | |
| poetry install --no-interaction --no-ansi | |
| - name: Run pytest | |
| run: | | |
| cd auth_platform | |
| poetry run pytest -q | |
| ui-tests: | |
| name: UI unit tests | |
| needs: detect-secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| - name: Install UI dependencies | |
| working-directory: dev-portal-ui/dev-portal-ui | |
| run: | | |
| npm ci | |
| - name: Run UI unit tests | |
| working-directory: dev-portal-ui/dev-portal-ui | |
| run: | | |
| npm test -- --watchAll=false --silent |