SimpleModule/.github/workflows/ci.yml at main · antosubash/SimpleModule · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install npm dependencies
        run: npm ci

      - name: Lint and format check
        run: npx biome check .

      - name: Validate pages registry
        run: npm run validate-pages

      - name: Validate i18n keys
        run: npm run validate:i18n

      - name: Validate framework scope
        run: node scripts/validate-framework-scope.mjs

      - name: TypeScript type check
        run: npm run typecheck

  build:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-build

      - name: Test
        run: dotnet test --no-build

      # SimpleModule.Cli.Tests sets IsTestProject=false (its scaffolding tests
      # spawn `dotnet build` and take ~15min), so `dotnet test` above skips the
      # whole project. Run the fast, pure template tests explicitly — otherwise
      # they guard nothing.
      - name: Test CLI templates
        run: >-
          dotnet run --project tests/SimpleModule.Cli.Tests --no-build --
          -class SimpleModule.Cli.Tests.HostTemplatesAppCssTests

  vulnerable-packages:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - run: dotnet restore

      - name: Audit NuGet packages for known vulnerabilities
        run: |
          dotnet list package --vulnerable --include-transitive 2>&1 | tee vulnerable.txt
          if grep -q "has the following vulnerable packages" vulnerable.txt; then
            echo "::error::Vulnerable NuGet packages found — see log above"
            exit 1
          fi

  e2e:
    runs-on: ubuntu-latest
    needs: lint
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
      - uses: ./.github/actions/setup-build

      - name: Install Playwright browsers
        run: npx -w tests/e2e playwright install --with-deps

      - name: Run smoke tests
        run: npm run test:smoke -w tests/e2e

      - name: Upload Playwright report
        uses: actions/upload-artifact@v4
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: tests/e2e/playwright-report/
          retention-days: 14

  pack-smoke:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-dotnet@v5
        with:
          dotnet-version: '10.0.x'

      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'

      - run: npm ci
      - run: npm run build
      - run: dotnet restore
      - run: dotnet pack -c Release -p:Version=0.0.0-ci --no-restore -o ./nupkgs

      - name: Verify module .nupkgs contain static web assets
        run: node scripts/verify-nupkg-static-assets.mjs ./nupkgs

      - name: Smoke-test packed nupkgs against a real consumer
        run: node scripts/smoke-test-nupkg-consumer.mjs ./nupkgs --version 0.0.0-ci

  docker:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
          push: false
          tags: simplemodule:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max