Sisyphus/.github/workflows/ci.yml at develop · ChronoAIProject/Sisyphus · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
name: CI

on:
  pull_request:
    branches: [develop, main]
    types: [opened, synchronize, reopened]

jobs:
  typecheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install sisyphus-api
        working-directory: sisyphus-api
        run: npm ci --ignore-scripts
      - name: tsoa generate
        working-directory: sisyphus-api
        run: npx tsoa spec-and-routes
      - name: typecheck sisyphus-api
        working-directory: sisyphus-api
        run: npx tsc --noEmit
      # sisyphus-web's `file:../../NyxID/sdk/...` deps require a sibling
      # NyxID checkout, which CI doesn't have. Web typecheck is skipped
      # in CI for now — covered locally via `npm run build` on the dev
      # machine before pushing.

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install sisyphus-api
        working-directory: sisyphus-api
        run: npm ci --ignore-scripts
      - name: Run sisyphus-api tests
        working-directory: sisyphus-api
        run: npm test

  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install sisyphus-api
        working-directory: sisyphus-api
        run: npm ci --ignore-scripts
      - name: Build sisyphus-api
        working-directory: sisyphus-api
        run: npm run build

  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install gitleaks
        run: |
          VERSION=$(curl -sI https://github.com/gitleaks/gitleaks/releases/latest | grep -i location | grep -oE 'v[0-9.]+' | head -1 | sed 's/^v//')
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" | tar xz
          sudo mv gitleaks /usr/local/bin/
      - name: Scan for secrets
        run: gitleaks detect --source . --log-opts="origin/${{ github.base_ref }}..HEAD" --verbose

  docker-build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - name: Build sisyphus-api image
        run: docker build -t sisyphus-api-ci sisyphus-api/
      # sisyphus-web image build requires a sibling NyxID/ checkout in
      # the build context, which CI doesn't have set up. Verified locally
      # before each release for now.