raptr/.github/workflows/ci.yml at main · CompassSecurity/raptr · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: CI

on:
  workflow_dispatch:
  pull_request:
    branches: [ "main" ]

permissions: {}

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    outputs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      docker: ${{ steps.filter.outputs.docker }}
    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - uses: dorny/paths-filter@v3
      id: filter
      with:
        filters: |
          backend:
            - 'backend/**'
          frontend:
            - 'frontend/**'
          docker:
            - 'Dockerfile'
            - 'entrypoint.sh'
            - 'backend/**'
            - 'frontend/**'

  backend-checks:
    needs: changes
    if: ${{ needs.changes.outputs.backend == 'true' || github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read

    defaults:
      run:
        working-directory: ./backend

    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Set up Python 3.14
      uses: actions/setup-python@v5
      with:
        python-version: "3.14"

    - name: Install uv
      run: curl -LsSf https://astral.sh/uv/install.sh | sh

    - name: Install dependencies
      run: uv sync --frozen

    - name: Lint with Ruff
      run: uv run ruff check .

    - name: Format check with Ruff
      run: uv run ruff format --check .

    - name: Run tests
      run: uv run pytest

  frontend-checks:
    needs: changes
    if: ${{ needs.changes.outputs.frontend == 'true' || github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read

    defaults:
      run:
        working-directory: ./frontend

    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Set up Bun
      uses: oven-sh/setup-bun@v2

    - name: Install dependencies
      run: bun install --frozen-lockfile

    - name: Lint and format check
      run: bun run lint

    - name: Type check and build
      run: bun run build

  security-scan:
    name: Security Scan (zizmor)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false
    - name: Run zizmor
      uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
      with:
        inputs: .

  docker-build-check:
    needs: changes
    if: ${{ needs.changes.outputs.docker == 'true' || github.event_name != 'pull_request' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build Docker Image (Dry Run)
      uses: docker/build-push-action@v5
      with:
        context: .
        file: Dockerfile
        push: false
        tags: raptr:test