Build the claim-impound fields with UI::Forms::Group #7576

Workflow file for this run

	name: CI

	on:
	push:

	permissions:
	actions: write
	contents: write
	pull-requests: write

	jobs:
	# Dispatches review-app deploys from CI's single `on: push` run — a
	# `pull_request: synchronize` trigger + label gate in review-app.yml would
	# leave skipped check runs on every push to every unlabeled PR.
	# GITHUB_TOKEN can't fire event-driven triggers, but explicit
	# workflow_dispatch API calls are allowed (`actions: write` above).
	dispatch:
	name: "Dispatch - review app conditional triggering"
	runs-on: ubuntu-latest
	env:
	GH_TOKEN: ${{ github.token }}
	steps:
	# retry: gh has no built-in retry, and a sporadic API failure shouldn't
	# fail the job. Progress goes to stderr — stdout would be captured by
	# the $(command substitution) below.
	- name: Dispatch review-app deploy (labeled PRs only)
	run: \|
	retry() { local n=1; until "$@"; do [ $n -ge 3 ] && return 1; echo "attempt $n failed; retrying in 15s..." >&2; n=$((n+1)); sleep 15; done; }
	pr=$(retry gh pr list --repo "$GITHUB_REPOSITORY" --head "$GITHUB_REF_NAME" \
	--state open --label review-app --json number --jq '.[0].number')
	if [ -n "$pr" ]; then
	echo "PR #$pr is open with the 'review-app' label -> dispatching review-app deploy"
	retry gh workflow run review-app.yml --repo "$GITHUB_REPOSITORY" \
	--ref "$GITHUB_REF_NAME" -f pr_number="$pr" -f action=deploy
	else
	echo "No open PR with the 'review-app' label for branch '$GITHUB_REF_NAME' -> NOT dispatching review-app deploy"
	fi

	# Sandbox tracks main: redeploy the persistent sandbox app on every push to
	# main. Dispatched here (rather than via a workflow_run trigger in
	# sandbox.yml) so both deploys fire from CI's single push run.
	# NOTE: this runs in parallel with the `test` job, so sandbox does not wait
	# for the test suite to pass.
	- name: Dispatch sandbox deploy (main only)
	if: github.ref == 'refs/heads/main'
	run: \|
	retry() { local n=1; until "$@"; do [ $n -ge 3 ] && return 1; echo "attempt $n failed; retrying in 15s..." >&2; n=$((n+1)); sleep 15; done; }
	echo "Push to main -> dispatching sandbox deploy"
	retry gh workflow run sandbox.yml --repo "$GITHUB_REPOSITORY" --ref main

	lint_and_scan:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v7

	- name: Set up Ruby
	uses: ruby/setup-ruby@v1
	with:
	bundler-cache: true
	- run: bundle install

	- name: Set up Node
	uses: actions/setup-node@v7
	with:
	cache: 'npm'
	- run: npm install

	- name: Lint Ruby code with standard
	run: bundle exec standardrb --no-fix
	- name: Lint Ruby code with rubocops
	run: bundle exec rubocop -c .rubocop_custom.yml
	- name: Lint JavaScript code
	if: success() \|\| failure()
	run: npm run js:lint_check
	- name: Lint HTML code
	if: success() \|\| failure()
	run: npm run html:lint_check
	- name: Check HTML formatting
	if: success() \|\| failure()
	run: npm run html:format_check

	- name: Scan for common Rails security vulnerabilities using static analysis
	if: success() \|\| failure()
	run: bin/brakeman

	# Eventually this should be added:
	# - name: Scan for security vulnerabilities in JavaScript dependencies
	# run: bin/importmap audit

	# Builds (or reuses, via GHA layer cache) the tooling image the `test` job
	# runs in — see .github/ci/Dockerfile for what it bakes in and why.
	build_ci_image:
	name: "Build CI image"
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	outputs:
	image: ${{ steps.image.outputs.image }}
	env:
	REGISTRY: ghcr.io
	IMAGE_NAME: ${{ github.repository }}-ci
	steps:
	- name: Checkout code
	uses: actions/checkout@v7
	# Tag + build-args are both derived from the same tracked files, so a
	# version bump always produces a new tag AND a matching rebuild —
	# nothing to manually keep in sync.
	- name: Resolve build args and image tag
	id: image
	run: \|
	ruby_version=$(awk '$1=="ruby"{print $2}' .tool-versions)
	node_version=$(awk '$1=="nodejs"{print $2}' .tool-versions)
	playwright_version=$(node -p "require('./package.json').devDependencies.playwright")
	tag=${{ hashFiles('.github/ci/Dockerfile', '.tool-versions', 'package.json') }}
	echo "ruby_version=$ruby_version" >> "$GITHUB_OUTPUT"
	echo "node_version=$node_version" >> "$GITHUB_OUTPUT"
	echo "playwright_version=$playwright_version" >> "$GITHUB_OUTPUT"
	echo "image=$REGISTRY/$IMAGE_NAME:$tag" >> "$GITHUB_OUTPUT"
	- name: Log in to GHCR
	uses: docker/login-action@v4.5.2
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	# The tag is a content hash (see above) — if it already exists in GHCR
	# it's byte-identical to what we'd build, so skip buildx/build/push
	# entirely instead of paying their setup cost for a guaranteed no-op.
	- name: Check whether this image tag already exists
	id: existing
	env:
	DOCKER_CLI_EXPERIMENTAL: enabled
	run: \|
	if docker manifest inspect ${{ steps.image.outputs.image }} > /dev/null 2>&1; then
	echo "found=true" >> "$GITHUB_OUTPUT"
	else
	echo "found=false" >> "$GITHUB_OUTPUT"
	fi
	- name: Set up Docker Buildx
	if: steps.existing.outputs.found != 'true'
	uses: docker/setup-buildx-action@v4
	- name: Build and push CI image
	if: steps.existing.outputs.found != 'true'
	uses: docker/build-push-action@v7
	with:
	context: .
	file: .github/ci/Dockerfile
	push: true
	tags: ${{ steps.image.outputs.image }}
	build-args: \|
	RUBY_VERSION=${{ steps.image.outputs.ruby_version }}
	NODE_VERSION=${{ steps.image.outputs.node_version }}
	PLAYWRIGHT_VERSION=${{ steps.image.outputs.playwright_version }}
	cache-from: type=gha
	cache-to: type=gha,mode=max

	test:
	name: "Run tests"
	needs: build_ci_image
	runs-on: ubuntu-latest
	permissions:
	contents: write # translations-sync push fallback (see below)
	pull-requests: write # translations-sync PR fallback (see below)
	packages: read # pull the CI image built by build_ci_image
	container:
	image: ${{ needs.build_ci_image.outputs.image }}
	credentials:
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}
	services:
	# Service images pull from Google's pull-through cache of Docker Hub's
	# official images. Anonymous pulls from Docker Hub (and from AWS's
	# public.ecr.aws mirror) are rate-limited per source IP; Actions runners
	# share egress IPs, so on a busy push the parallel shards exhaust the
	# quota and the job fails at "Initialize containers" with
	# "toomanyrequests: Rate exceeded". mirror.gcr.io serves the identical
	# official images without imposing that limit, and needs no credentials.
	postgres:
	image: mirror.gcr.io/library/postgres:16-alpine
	ports:
	- 5432:5432
	env:
	POSTGRES_USER: rails
	POSTGRES_PASSWORD: password
	# needed because the postgres container does not provide a healthcheck
	# tmpfs makes DB faster by using RAM
	#
	# health-interval 1s, not 10s: docker runs the FIRST check only after the
	# interval elapses, so 10s meant every job idled ~10s+ waiting on a database
	# that was ready in ~3s. pg_isready is cheap enough to poll every second.
	# `-h 127.0.0.1` forces TCP — the entrypoint's temporary initdb-phase server
	# listens only on the unix socket, so a plain pg_isready reports ready
	# before the real server is up.
	options: >-
	--mount type=tmpfs,destination=/var/lib/postgresql/data
	--health-cmd "pg_isready -h 127.0.0.1"
	--health-interval 1s
	--health-retries 60
	redis:
	# 7-alpine: pinned to match the review-app host's redis:7 accessory, and
	# the alpine variant is a much smaller pull than debian-based latest.
	image: mirror.gcr.io/library/redis:7-alpine
	ports:
	- 6379:6379
	options: --entrypoint redis-server
	strategy:
	fail-fast: false
	matrix:
	ci_node_total: [5]
	ci_node_index: [0, 1, 2, 3, 4]
	env:
	# `test` now runs inside the CI image (container:), so services are
	# sibling containers reachable by name, not localhost.
	REDIS_URL: redis://redis:6379
	PGHOST: postgres
	RAILS_ENV: test
	TZ: "America/Chicago"
	COVERAGE: false # additional configuration is needed for parallelized tests
	CC_TEST_REPORTER_ID: 04daa6564351115dc1515504790cd379ad8dc25e7778f0641e0f8c63185f887c
	TRANSLATION_BRANCH: main
	TRANSLATIONS_SYNC_APP_ID: ${{ secrets.TRANSLATIONS_SYNC_APP_ID }}
	RETRY_FLAKY: true
	# spec/integration/register_spec.rb uploads to the bikeindex-test bucket for real - the
	# only way to exercise a presigned cross-origin PUT. Absent, that one example skips.
	R2_TEST_ACCESS_KEY: ${{ secrets.R2_TEST_ACCESS_KEY }}
	R2_TEST_ACCESS_KEY_SECRET: ${{ secrets.R2_TEST_ACCESS_KEY_SECRET }}
	R2_TEST_ENDPOINT: ${{ secrets.R2_TEST_ENDPOINT }}
	KNAPSACK_PRO_TEST_SUITE_TOKEN_RSPEC: ${{ secrets.KNAPSACK_PRO_TEST_SUITE_TOKEN_RSPEC }}
	KNAPSACK_PRO_CI_NODE_TOTAL: ${{ matrix.ci_node_total }}
	KNAPSACK_PRO_CI_NODE_INDEX: ${{ matrix.ci_node_index }}
	KNAPSACK_PRO_LOG_LEVEL: warn
	# Capybara binds to this port in `:js` specs (spec/support/capybara.rb).
	# Set explicitly so the assets:precompile step below can bake a matching
	# ENV['BASE_URL'] into any ERB-templated asset.
	CAPYBARA_PORT: 5042
	steps:
	- name: Get CPU cores
	id: cpu-info
	run: echo "cpu-cores=$(nproc)" >> $GITHUB_OUTPUT
	# Checkout persists this App token (below) as the git creds so the sync
	# branch is pushed as the App — only a non-default-token push fires
	# `on: push`, which is what attaches the required checks to the PR.
	# Falls back to default creds until the App secrets exist.
	- name: Mint translations-sync token
	id: translations_token
	if: matrix.ci_node_index == 1 && github.ref == 'refs/heads/main' && env.TRANSLATIONS_SYNC_APP_ID != ''
	uses: actions/create-github-app-token@v3
	with:
	app-id: ${{ secrets.TRANSLATIONS_SYNC_APP_ID }}
	private-key: ${{ secrets.TRANSLATIONS_SYNC_APP_PRIVATE_KEY }}
	- name: Checkout code
	uses: actions/checkout@v7
	with:
	token: ${{ steps.translations_token.outputs.token \|\| github.token }}
	# Ruby itself is baked into the CI image (.github/ci/Dockerfile) —
	# ruby/setup-ruby's own toolcache binary can't dynamically link inside
	# a minimal container. Gems still need their own cache: BUNDLE_PATH is
	# baked as /usr/local/bundle so this restores/saves the same directory
	# bundle install writes to.
	- name: Restore gem cache
	uses: actions/cache@v6
	with:
	path: /usr/local/bundle
	key: ${{ runner.os }}-gems-${{ hashFiles('Gemfile.lock') }}
	restore-keys: \|
	${{ runner.os }}-gems-
	- run: bundle install --jobs 4
	# :js system specs run through capybara-playwright-driver, which drives the
	# `playwright` npm package against the Chromium baked into the CI image
	# (.github/ci/Dockerfile) at PLAYWRIGHT_BROWSERS_PATH.
	- name: Set up Node
	uses: actions/setup-node@v7
	with:
	cache: 'npm'
	- run: npm install
	- name: Set up database
	run: bin/rails db:create db:schema:load:primary db:schema:load:analytics db:migrate
	- name: Sync translations (only on main by default)
	if: matrix.ci_node_index == 1
	env:
	GH_TOKEN: ${{ steps.translations_token.outputs.token \|\| github.token }}
	run: bin/check_translations ${{ secrets.TRANSLATION_IO_API_KEY }}
	# Cache compiled assets + sprockets' incremental cache.
	# Key hashes every input the three asset tools read:
	# - sprockets: app/assets/images, javascripts, config/manifest.js, Gemfile.lock (gem versions)
	# - dartsass-rails: app/assets/stylesheets, config/initializers/dartsass.rb
	# - tailwindcss-rails: app/assets/tailwind (theme + @source globs live here),
	# and everything tailwind scans (views/components/helpers/javascript)
	# On a partial-key restore, sprockets' tmp/cache makes the rebuild near-instant
	# for unchanged inputs, so the loose restore-keys fallback is worth keeping.
	#
	# Split into restore/save: all matrix jobs restore, but only ci_node_index == 0
	# writes the cache. With the combined actions/cache@v4 action, parallel jobs race
	# on reserveCache and all of them lose ("another job may be creating this cache"),
	# so the cache never gets populated.
	- name: Restore precompiled assets cache
	id: assets-cache
	uses: actions/cache/restore@v6
	with:
	path: \|
	tmp/cache/assets
	app/assets/builds
	public/assets
	# CAPYBARA_PORT is in the key because the precompile step bakes
	# `ENV['BASE_URL']` (derived from it) into ERB-templated assets;
	# a cached bundle from a different port would serve a stale URL.
	key: ${{ runner.os }}-assets-port${{ env.CAPYBARA_PORT }}-${{ hashFiles('app/assets/', 'app/views/', 'app/components/', 'app/helpers//.rb', 'app/javascript/*', 'config/initializers/dartsass.rb', 'config/initializers/assets.rb', 'Gemfile.lock') }}
	restore-keys: \|
	${{ runner.os }}-assets-port${{ env.CAPYBARA_PORT }}-
	- name: build assets
	if: steps.assets-cache.outputs.cache-hit != 'true'
	# BASE_URL must match the host:port that Capybara binds to in tests
	# so any ERB-baked asset URL resolves to the same host the browser
	# will hit (see spec/support/capybara.rb).
	env:
	BASE_URL: http://localhost:${{ env.CAPYBARA_PORT }}
	run: bin/rails assets:precompile --trace
	- name: Save precompiled assets cache
	if: matrix.ci_node_index == 0 && steps.assets-cache.outputs.cache-hit != 'true'
	uses: actions/cache/save@v6
	with:
	path: \|
	tmp/cache/assets
	app/assets/builds
	public/assets
	key: ${{ steps.assets-cache.outputs.cache-primary-key }}
	# Test bin/setup (verifies e.g. seeds work) - only run on 1 node, knapsack should balance
	# Done after asset compilation and caching to save time on that
	- name: Test bin/setup
	if: matrix.ci_node_index == 0
	run: bin/setup
	# Run tests
	- name: Run tests
	env:
	SKIP_CSS_BUILD: true
	run: bin/knapsack_pro_tests
	# Until parallel reporting is set up, skip sending code coverage reports
	# - name: publish code coverage
	# uses: paambaati/codeclimate-action@v9.0.0
	- name: Upload test results
	if: always()
	uses: actions/upload-artifact@v7
	with:
	name: test-results-${{ env.KNAPSACK_PRO_CI_NODE_INDEX }}
	# tmp/capybara holds the failure screenshots system specs write, which
	# are usually the only evidence of what a flaky :js spec actually saw
	path: \|
	tmp/rspec-${{ env.KNAPSACK_PRO_CI_NODE_INDEX }}.xml
	tmp/capybara/

	deploy_production:
	name: "Deploy to production"
	runs-on: ubuntu-latest
	needs: [test, lint_and_scan]
	if: github.ref == 'refs/heads/main'
	steps:
	- name: Deploy to Cloud66 production
	run: \|
	curl --insecure -X POST -d "" https://hooks.cloud66.com/stacks/redeploy/${{ secrets.CLOUD66_REDEPLOYMENT_KEY }}

	# Commenting out for now - it doesn't work for forked pull requests,
	# Which means forked PRs always fail
	# Also - I want to fix the thousands separator
	# github.com/EnricoMi/publish-unit-test-result-action/issues/698
	#
	# aggregate_test_results:
	# name: "Test Report"
	# runs-on: ubuntu-latest
	# needs: test
	# if: always()
	# steps:
	# - name: Download all test results
	# uses: actions/download-artifact@v4
	# with:
	# pattern: test-results-*
	# path: test-results

	# - name: Publish combined test results
	# id: test-results
	# uses: EnricoMi/publish-unit-test-result-action@v2
	# with:
	# files: test-results/*/.xml
	# json_thousands_separator: "," # Can't get this to work :/
	# comment_mode: off

Navigation Menu

Uh oh!

Uh oh!

Build the claim-impound fields with UI::Forms::Group #7576

Workflow file

Build the claim-impound fields with UI::Forms::Group #7576

Uh oh!

Workflow file for this run