getcourt/.github/workflows/ci.yml at main · denis1011101/getcourt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
name: CI

on:
  pull_request:
  push:
    branches: [ main ]

jobs:
  scan_ruby:
    runs-on: ubuntu-latest

    steps:
      - name: Install system packages
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libvips42

      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true

      - name: Scan for common Rails security vulnerabilities using static analysis
        run: bin/brakeman --no-pager

  scan_js:
    runs-on: ubuntu-latest

    steps:
      - name: Install system packages
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libvips42

      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true

      # Аудит ходит в реестр npm по сети, и тот регулярно отвечает 503 или рвёт
      # соединение — проверка падала на PR, где JS никто не трогал. Уязвимость
      # так же уронит шаг, просто не с первой попытки.
      - name: Scan for security vulnerabilities in JavaScript dependencies
        run: |
          for attempt in 1 2 3; do
            bin/importmap audit && exit 0
            echo "importmap audit failed (attempt $attempt of 3), retrying in 15s"
            sleep 15
          done
          exit 1

  lint:
    runs-on: ubuntu-latest
    steps:
      - name: Install system packages
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libvips42

      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true

      - name: Lint code for consistent style
        run: bin/rubocop -f github

  test:
    runs-on: ubuntu-latest

    # services:
    #  redis:
    #    image: redis
    #    ports:
    #      - 6379:6379
    #    options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
    steps:
      - name: Install packages
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y build-essential git libyaml-dev libvips42 pkg-config google-chrome-stable

      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: .ruby-version
          bundler-cache: true

      - name: Check that every autoloaded file eager loads
        env:
          RAILS_ENV: test
        run: bin/rails zeitwerk:check

      - name: Run tests
        env:
          RAILS_ENV: test
          # REDIS_URL: redis://localhost:6379/0
        run: bin/rails db:test:prepare test test:system

      - name: Keep screenshots from failed system tests
        uses: actions/upload-artifact@v7
        if: failure()
        with:
          name: screenshots
          path: ${{ github.workspace }}/tmp/screenshots
          if-no-files-found: ignore

      - name: Extract coverage percentage
        if: success() && github.ref == 'refs/heads/main'
        id: coverage
        run: |
          COVERAGE=$(grep -oP '[\d.]+(?=%)' coverage/summary.txt | head -1)
          echo "percent=$COVERAGE" >> "$GITHUB_OUTPUT"

      - name: Extract Ruby version
        if: success() && github.ref == 'refs/heads/main'
        id: ruby
        run: |
          RUBY_VER=$(cat .ruby-version | sed 's/ruby-//')
          echo "version=$RUBY_VER" >> "$GITHUB_OUTPUT"

      - name: Extract Rails version
        if: success() && github.ref == 'refs/heads/main'
        id: rails
        run: |
          RAILS_VER=$(grep -A1 '^\s*rails ' Gemfile.lock | grep -oP '[\d.]+' | head -1)
          echo "version=$RAILS_VER" >> "$GITHUB_OUTPUT"

      - name: Update coverage badge
        if: success() && github.ref == 'refs/heads/main'
        uses: schneegans/dynamic-badges-action@v1.9.0
        with:
          auth: ${{ secrets.GIST_SECRET }}
          gistID: ${{ vars.BADGE_GIST_ID }}
          filename: coverage.json
          label: coverage
          message: "${{ steps.coverage.outputs.percent }}%"
          valColorRange: ${{ steps.coverage.outputs.percent }}
          minColorRange: 0
          maxColorRange: 100

      - name: Update Ruby badge
        if: success() && github.ref == 'refs/heads/main'
        uses: schneegans/dynamic-badges-action@v1.9.0
        with:
          auth: ${{ secrets.GIST_SECRET }}
          gistID: ${{ vars.BADGE_GIST_ID }}
          filename: ruby.json
          label: ruby
          message: "${{ steps.ruby.outputs.version }}"
          color: CC342D

      - name: Update Rails badge
        if: success() && github.ref == 'refs/heads/main'
        uses: schneegans/dynamic-badges-action@v1.9.0
        with:
          auth: ${{ secrets.GIST_SECRET }}
          gistID: ${{ vars.BADGE_GIST_ID }}
          filename: rails.json
          label: rails
          message: "${{ steps.rails.outputs.version }}"
          color: D30001