mirror of
https://github.com/jjbrunton/Sauci.git
synced 2026-10-31 18:19:43 +00:00
jjbruntonandClaude Opus 5
d14869d745
The policy accepted only `staging` as a head for main, so any change production needed before the next promotion had nowhere to go: the PR was unmergeable by CI and branch protection blocks direct pushes. Accept `hotfix/*` and `release/*` heads as well. The naming requirement keeps a direct-to-main change deliberate and visible, and the master freeze plus the "features target staging" rule are unchanged. Document the escape hatch and the need to land the same commit on staging. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
95 lines
2.7 KiB
YAML
95 lines
2.7 KiB
YAML
name: Verify
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
push:
|
|
branches: [staging, main]
|
|
|
|
concurrency:
|
|
group: verify-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
branch-policy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Enforce promotion flow
|
|
if: github.event_name == 'pull_request'
|
|
env:
|
|
BASE_BRANCH: ${{ github.base_ref }}
|
|
HEAD_BRANCH: ${{ github.head_ref }}
|
|
run: |
|
|
if [ "$BASE_BRANCH" = "master" ]; then
|
|
echo "master is frozen; target staging or main" >&2
|
|
exit 1
|
|
fi
|
|
if [ "$BASE_BRANCH" = "main" ]; then
|
|
case "$HEAD_BRANCH" in
|
|
staging|hotfix/*|release/*) ;;
|
|
*)
|
|
echo "main takes staging promotions, or a hotfix/* or release/* branch for direct work" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
fi
|
|
if [ "$BASE_BRANCH" != "staging" ] && [ "$BASE_BRANCH" != "main" ]; then
|
|
echo "Feature pull requests target staging; promotions target main" >&2
|
|
exit 1
|
|
fi
|
|
- name: Confirm direct verification
|
|
if: github.event_name != 'pull_request'
|
|
run: echo "Direct branch verification requested for $GITHUB_SHA"
|
|
|
|
static:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm run learn:check
|
|
- run: npm run verify:fast
|
|
- name: Enforce API and mobile coverage floors
|
|
run: npm run test:coverage
|
|
- run: npm run build
|
|
|
|
backend-integration:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_DB: sauci_test
|
|
POSTGRES_USER: sauci
|
|
POSTGRES_PASSWORD: sauci_ci_only
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U sauci -d sauci_test"
|
|
--health-interval 5s
|
|
--health-timeout 3s
|
|
--health-retries 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: npm
|
|
- run: npm ci
|
|
- name: Run standalone backend integration tests
|
|
env:
|
|
DATABASE_URL: postgresql://sauci:sauci_ci_only@127.0.0.1:5432/sauci_test
|
|
run: npm run test:integration:coverage -w @sauci/api
|
|
|
|
container-contract:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Verify production Compose contract
|
|
run: infra/backend/verify-production.sh
|