mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-08-28 05:25:25 +00:00
8efc272609
* Initial plan * fix: add pull-requests write permissions to GitHub Actions workflows Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> * fix(ci): remove ineffective job-level permissions from reusable workflow * fix(ci): pass PR write permission from caller to reusable unit-tests workflow * fix(ci): harden CI/CD workflows with security fixes and reliability improvements - Pin all actions to commit SHAs to prevent supply-chain attacks - Fix shell injection in ci-integration.yml by using env vars instead of direct interpolation - Scope permissions per-job in publish.yml (was granting pull-requests:write to publish job) - Restrict claude-code-review to trusted contributors only (OWNER/MEMBER/COLLABORATOR) - Switch claude-code-review to pull_request_target for fork PR support - Fix fail-fast: false in ci-unit-tests.yml cross-platform matrix - Remove duplicate ubuntu-latest from unit test matrix - Add timeouts to all workflow jobs - Improve kuzu-db test loop to continue on failure and report per-file errors Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix(ci): read thresholds from `vitest.config.ts` * fix(ci): move PR report to workflow_run for fork PR support The sticky-pull-request-comment and vitest-coverage-report-action both fail on fork PRs because pull_request events receive a read-only GITHUB_TOKEN. This extracts PR reporting into a separate ci-report.yml workflow triggered by workflow_run, which always gets read/write tokens. Changes: - ci.yml: replace pr-report job with save-pr-meta artifact upload - ci-unit-tests.yml: remove davelosert/vitest-coverage-report-action, add coverage-final.json to artifact for merging - ci-integration.yml: add ubuntu coverage job for non-kuzu groups - ci-report.yml (new): workflow_run handler that downloads artifacts, merges unit + integration coverage via Istanbul, and posts combined PR comment with sticky-pull-request-comment * feat(ci): show unit, integration, and merged coverage in PR report - Disable coverage thresholds for integration-only run (partial coverage) - Display combined coverage as the primary metric - Show per-suite breakdown (unit / integration) in expandable details - Thresholds applied against combined coverage, not individual suites * fix(ci): add coverage collection input for PR reports and validate job results * fix(ci): refine Claude Code Review workflow to support issue comments and enhance trusted contributor checks --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: magyargergo <11230420+magyargergo@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
99 lines
3.2 KiB
YAML
99 lines
3.2 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths-ignore: ['**.md', 'docs/**', 'LICENSE']
|
|
pull_request:
|
|
branches: [main]
|
|
paths-ignore: ['**.md', 'docs/**', 'LICENSE']
|
|
workflow_call:
|
|
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# ── Reusable workflow orchestration ─────────────────────────────────
|
|
# Each concern lives in its own workflow file for maintainability:
|
|
# ci-quality.yml — typecheck (tsc --noEmit)
|
|
# ci-unit-tests.yml — unit tests with coverage + cross-platform
|
|
# ci-integration.yml — integration test matrix (3 OS x 4 groups)
|
|
#
|
|
# Shared setup is DRY via .github/actions/setup-gitnexus composite action.
|
|
|
|
jobs:
|
|
quality:
|
|
uses: ./.github/workflows/ci-quality.yml
|
|
permissions:
|
|
contents: read
|
|
|
|
unit-tests:
|
|
uses: ./.github/workflows/ci-unit-tests.yml
|
|
permissions:
|
|
contents: read
|
|
|
|
integration:
|
|
uses: ./.github/workflows/ci-integration.yml
|
|
with:
|
|
collect-coverage: ${{ github.event_name == 'pull_request' }}
|
|
permissions:
|
|
contents: read
|
|
|
|
# ── Save PR metadata for the reporting workflow ─────────────────
|
|
# The ci-report.yml workflow (triggered by workflow_run) needs the
|
|
# PR number and job results to post a comment. We save them as an
|
|
# artifact because workflow_run context doesn't reliably carry PR
|
|
# info for fork PRs.
|
|
save-pr-meta:
|
|
name: Save PR Metadata
|
|
if: always() && github.event_name == 'pull_request'
|
|
needs: [quality, unit-tests, integration]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Write metadata
|
|
shell: bash
|
|
env:
|
|
PR_NUMBER: ${{ github.event.number }}
|
|
QUALITY: ${{ needs.quality.result }}
|
|
UNIT: ${{ needs.unit-tests.result }}
|
|
INTEG: ${{ needs.integration.result }}
|
|
run: |
|
|
mkdir -p pr-meta
|
|
echo "$PR_NUMBER" > pr-meta/pr_number
|
|
echo "$QUALITY" > pr-meta/quality_result
|
|
echo "$UNIT" > pr-meta/unit_result
|
|
echo "$INTEG" > pr-meta/integration_result
|
|
|
|
- name: Upload PR metadata
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: pr-meta
|
|
path: pr-meta/
|
|
retention-days: 1
|
|
|
|
# ── Unified CI gate ──────────────────────────────────────────────
|
|
# Single required check for branch protection.
|
|
ci-status:
|
|
name: CI Gate
|
|
needs: [quality, unit-tests, integration]
|
|
if: always()
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- name: Check all jobs passed
|
|
shell: bash
|
|
env:
|
|
QUALITY: ${{ needs.quality.result }}
|
|
UNIT: ${{ needs.unit-tests.result }}
|
|
INTEG: ${{ needs.integration.result }}
|
|
run: |
|
|
echo "Quality: $QUALITY"
|
|
echo "Unit Tests: $UNIT"
|
|
echo "Integration: $INTEG"
|
|
if [[ "$QUALITY" != "success" ]] ||
|
|
[[ "$UNIT" != "success" ]] ||
|
|
[[ "$INTEG" != "success" ]]; then
|
|
echo "::error::One or more CI jobs failed"
|
|
exit 1
|
|
fi
|