d6d74f2267
Some checks failed
CI / Portal Lint (pull_request) Failing after 33s
CI / Portal Type Check (pull_request) Successful in 57s
CI / Portal Build (pull_request) Failing after 33s
CI / Orchestrator Type Check (pull_request) Failing after 5s
CI / Orchestrator Build (pull_request) Failing after 5s
CI / Orchestrator Test (pull_request) Failing after 5s
CI / Contracts Compile (pull_request) Failing after 12s
CI / Contracts Test (pull_request) Failing after 7s
Code Quality / SonarQube Analysis (pull_request) Failing after 20s
Code Quality / Code Quality Checks (pull_request) Failing after 5s
Security Scan / Dependency Vulnerability Scan (pull_request) Failing after 4s
Security Scan / OWASP ZAP Scan (pull_request) Failing after 4s
Closes gap-analysis v2 §8.1 / §8.4 / §8.6 and §10.1 / §10.2. - assertProductionEnv() in config/env.ts fails-fast in NODE_ENV=production when SESSION_SECRET / EVENT_BUS_HMAC_SECRET / CHAIN_138_RPC_URL / NOTARY_REGISTRY_ADDRESS / ORCHESTRATOR_PRIVATE_KEY / DATABASE_URL is missing or uses the dev placeholder. Catches the silent-degrade-to-mock failure mode that would turn the Ledger Anchor back into a lie. - New EVENT_BUS_HMAC_SECRET env added to the schema. - .github/workflows/ci.yml rewritten: portal jobs target repo root (not the removed webapp/ gitlink), orchestrator type-check + test job added, contracts jobs kept as-is. - 7 unit tests for assertProductionEnv; full suite 87/87 green.
139 lines
3.6 KiB
YAML
139 lines
3.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
branches: [main, develop]
|
|
|
|
jobs:
|
|
# -------------------------------------------------------------------------
|
|
# Portal (Vite + React, lives at repo root after the webapp/ gitlink was
|
|
# removed in PR #4)
|
|
# -------------------------------------------------------------------------
|
|
portal-lint:
|
|
name: Portal Lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
- run: npm ci
|
|
- run: npm run lint
|
|
|
|
portal-type-check:
|
|
name: Portal Type Check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
- run: npm ci
|
|
- run: npx tsc --noEmit
|
|
|
|
portal-build:
|
|
name: Portal Build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
- run: npm ci
|
|
- run: npm run build
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: portal-dist
|
|
path: dist
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Orchestrator (TypeScript + Express + Jest)
|
|
# -------------------------------------------------------------------------
|
|
orchestrator-type-check:
|
|
name: Orchestrator Type Check
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: orchestrator
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: orchestrator/package-lock.json
|
|
- run: npm ci
|
|
- run: npx tsc --noEmit
|
|
|
|
orchestrator-build:
|
|
name: Orchestrator Build
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: orchestrator
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: orchestrator/package-lock.json
|
|
- run: npm ci
|
|
- run: npm run build
|
|
|
|
orchestrator-test:
|
|
name: Orchestrator Test
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: orchestrator
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: orchestrator/package-lock.json
|
|
- run: npm ci
|
|
- run: npm test -- --ci
|
|
|
|
# -------------------------------------------------------------------------
|
|
# Smart Contracts (Hardhat)
|
|
# -------------------------------------------------------------------------
|
|
contracts-compile:
|
|
name: Contracts Compile
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: contracts
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: contracts/package-lock.json
|
|
- run: npm ci
|
|
- run: npm run compile
|
|
|
|
contracts-test:
|
|
name: Contracts Test
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: contracts
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
cache-dependency-path: contracts/package-lock.json
|
|
- run: npm ci
|
|
- run: npm run test
|