mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 04:32:42 +00:00
Marc-André Bombeck
de7c89a462
The audit had moved off the pull_request trigger entirely, which left a window in which a tag could be cut from a merge the audit had not seen. It runs on pull requests again as an advisory job (continue-on-error), stays blocking on the push run for main and on the daily schedule, and a tag is only ever cut from a green push run.
180 lines
7.5 KiB
YAML
180 lines
7.5 KiB
YAML
name: Security & Quality
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
schedule:
|
|
# Daily, 05:47 UTC. Carries the dependency audit only — every other job
|
|
# here answers "is this change safe" and has nothing to say about a tree
|
|
# nobody touched. See the note on `dependency-audit`.
|
|
- cron: "47 5 * * *"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
quality:
|
|
name: Lint, Typecheck & Test
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'schedule'
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- run: pnpm db:generate
|
|
|
|
# The hero-geometry check in the unit suite renders the real panel in a
|
|
# real browser and measures the boxes. Without a browser here it caught
|
|
# its own launch failure and passed anyway, so from its first day until
|
|
# v1.38 it measured nothing on any run of this job. The browser is part
|
|
# of the gate now; the test refuses to skip when CI is set.
|
|
#
|
|
# Headless shell only: `chromium.launch()` resolves to
|
|
# chromium_headless_shell, which is what the failing runs named, and the
|
|
# full headed build is several times the download for nothing this job
|
|
# uses. The e2e job keeps `--with-deps chromium` — it drives a real app.
|
|
- name: Cache Playwright headless shell
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-shell-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
playwright-shell-${{ runner.os }}-
|
|
|
|
- run: pnpm exec playwright install --only-shell chromium
|
|
|
|
# Blocking since v1.15.20 — the settings-split refactor that kept
|
|
# this warn-only is long done and the tree lints clean.
|
|
- name: ESLint
|
|
run: pnpm lint
|
|
|
|
# Prettier formatting gate. The format pass excludes generator-owned
|
|
# artifacts via .prettierignore (notably docs/api/openapi.yaml, which
|
|
# the OpenAPI drift check below enforces byte-for-byte).
|
|
- name: Prettier format check
|
|
run: pnpm format:check
|
|
|
|
- name: TypeScript strict check
|
|
run: pnpm typecheck
|
|
|
|
- name: Unit tests
|
|
run: pnpm test
|
|
|
|
# OpenAPI spec drift gate — hard-fail (flipped from warn-only in v1.4.25).
|
|
#
|
|
# The Zod registry is the source of truth for the public API contract.
|
|
# Any route signature change must be reflected in `docs/api/openapi.yaml`
|
|
# so downstream consumers (notably the v1.5 iOS Swift codegen) stay in
|
|
# lockstep. If this step fails, run `pnpm openapi:generate` locally and
|
|
# commit the regenerated spec.
|
|
- name: OpenAPI spec drift check
|
|
run: |
|
|
pnpm openapi:generate
|
|
if ! git diff --exit-code docs/api/openapi.yaml; then
|
|
echo "::error::OpenAPI drift detected — regenerate the spec via 'pnpm openapi:generate' and commit the result. The Zod registry under src/lib/openapi/ is the source of truth for the public API contract."
|
|
exit 1
|
|
fi
|
|
echo "::notice::OpenAPI spec in sync with Zod source schemas."
|
|
|
|
# Not on pull requests. `pnpm audit` answers a question about the published
|
|
# advisory database, not about the diff: the same lockfile passes on Monday
|
|
# and fails on Tuesday because someone else published, and the branch that
|
|
# goes red changed nothing. Seventeen of the forty-one failures this workflow
|
|
# produced in thirty days were exactly that, and a gate that fails for
|
|
# reasons the author cannot act on is a gate people learn to re-run rather
|
|
# than read. It runs on every push to `main` and once a day on the schedule
|
|
# above, which is the cadence the question actually has. What ships is still
|
|
# gated: `docker-security` scans the built image on every push to `main`, and
|
|
# `trivy.yml` scans the lockfile (dev dependencies included) and the
|
|
# published image daily.
|
|
dependency-audit:
|
|
name: Dependency Audit
|
|
runs-on: ubuntu-latest
|
|
# Runs on pull requests too, but advisory: an advisory published against a
|
|
# dependency the branch did not touch must not block the branch. The push
|
|
# run on main and the daily schedule stay blocking, and a tag is only ever
|
|
# cut from a main whose push run is green.
|
|
continue-on-error: ${{ github.event_name == 'pull_request' }}
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
# Blocking since v1.15.20 — a HIGH/CRITICAL advisory against a
|
|
# production dependency fails the build. If an advisory has no
|
|
# upstream fix yet, pin an `auditConfig.ignoreCves` entry in
|
|
# package.json (pnpm's documented suppression mechanism) with a
|
|
# comment referencing the tracking issue, rather than flipping
|
|
# this step back to warn-only.
|
|
- name: Audit for known vulnerabilities
|
|
run: pnpm audit --prod --audit-level=high
|
|
|
|
secret-scan:
|
|
name: Secret Scanning
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'schedule'
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Gitleaks secret scan
|
|
uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
docker-security:
|
|
name: Container Security
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: Build Docker image
|
|
run: docker build -t healthlog:scan .
|
|
|
|
# The release binary, pinned, straight from the Trivy release. The apt
|
|
# route ran `apt-get update` across every repository on the runner
|
|
# image, and an unrelated one (the Chrome repository the runner ships
|
|
# with) answering with a corrupt index failed the step twice in a row
|
|
# on a release commit. The installer downloads the tarball for this
|
|
# exact version and checks it against the published checksums.
|
|
- name: Install Trivy
|
|
env:
|
|
TRIVY_VERSION: v0.74.0
|
|
run: |
|
|
curl -sfL "https://raw.githubusercontent.com/aquasecurity/trivy/${TRIVY_VERSION}/contrib/install.sh" \
|
|
| sh -s -- -b /usr/local/bin "${TRIVY_VERSION}"
|
|
trivy --version
|
|
|
|
# Blocking since v1.15.20 — a HIGH/CRITICAL finding in the built
|
|
# image fails the job. For a finding without an upstream fix
|
|
# (e.g. a base-image CVE Alpine has not patched yet), add the CVE
|
|
# id to a `.trivyignore` file at the repository root — Trivy reads
|
|
# it automatically — one CVE per line, each with a comment naming
|
|
# the tracking issue and the re-check condition. Never suppress a
|
|
# finding that has a fixed version available; bump instead.
|
|
- name: Trivy container scan
|
|
run: trivy image --format table --severity CRITICAL,HIGH --exit-code 1 healthlog:scan
|