mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 04:32:42 +00:00
Marc-André Bombeck
d7bf0df10b
Every workflow action is pinned to a commit SHA, dependabot auto-merge is limited to patch and minor updates behind the now-required status checks on main, and the audit, Trivy and ESLint gates block instead of warning. The published image finally carries its build SHA and build timestamp so the version endpoint can prove which commit is running. The API-token HMAC key fails closed under 32 characters, compose pins the database minor and denies privilege escalation, and the changelog drops working-note references in favour of neutral wording.
74 lines
2.9 KiB
YAML
74 lines
2.9 KiB
YAML
name: Env-manifest <-> example lockstep
|
|
|
|
# v1.4.43 B5 -- enforce that `.env.production.example` stays in lockstep
|
|
# with `scripts/env-manifest.json`. A contributor adding a new required
|
|
# variable to the manifest must also add a placeholder to the example
|
|
# file in the same PR, otherwise the workflow fails with a grep-friendly
|
|
# list of missing required vars. Optional vars are reported but do not
|
|
# fail the build -- they exist for operator discovery, not deploy
|
|
# blocking.
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
branches: [main, develop]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
env-check:
|
|
name: pnpm check-env against .env.production.example
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Install pnpm
|
|
uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: 22
|
|
cache: pnpm
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Assert example file exists
|
|
run: |
|
|
if [ ! -f .env.production.example ]; then
|
|
echo "::error::.env.production.example is missing -- contributors must keep this file in lockstep with scripts/env-manifest.json. See docs/ops/env-check.md."
|
|
exit 1
|
|
fi
|
|
|
|
# The check-env script exits non-zero when at least one required
|
|
# variable from the manifest is missing/empty in the example file.
|
|
# We additionally grep the rendered output for `[MISSING-REQUIRED]`
|
|
# rows and surface them as GitHub Actions error annotations so the
|
|
# PR reviewer can see the missing var names without expanding the
|
|
# log.
|
|
- name: pnpm check-env --file .env.production.example
|
|
id: check
|
|
run: |
|
|
set +e
|
|
OUT=$(pnpm --silent check-env --file .env.production.example)
|
|
EC=$?
|
|
echo "$OUT"
|
|
if [ $EC -ne 0 ]; then
|
|
echo ""
|
|
echo "::group::Missing required variables"
|
|
echo "$OUT" | grep -E '^\s*\[MISSING-REQUIRED\]' | while IFS= read -r line; do
|
|
name=$(echo "$line" | sed -E 's/.*\[MISSING-REQUIRED\] ([A-Z0-9_]+).*/\1/')
|
|
echo "::error file=.env.production.example::Required env var $name missing from .env.production.example -- add a placeholder so the file stays in lockstep with scripts/env-manifest.json."
|
|
done
|
|
echo "::endgroup::"
|
|
echo ""
|
|
echo "::error::pnpm check-env reported missing required variables in .env.production.example. Either add a placeholder for each missing var, or downgrade the manifest entry to required:false if the variable is genuinely optional. See docs/ops/env-check.md."
|
|
exit $EC
|
|
fi
|