39 lines
1.8 KiB
YAML
39 lines
1.8 KiB
YAML
name: Verify container release contracts
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.11"
|
|
- run: python -m pip install "uv==0.11.14"
|
|
- run: uv sync --extra dev --locked
|
|
- run: uv run pytest -q
|
|
- name: Honest scoped lint for release additions
|
|
run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py tests/release
|
|
- name: Validate container contracts without registry writes
|
|
run: uv run pytest -q tests/release
|
|
- name: Build and smoke exact pull-request or main source image
|
|
run: |
|
|
uv run python -c 'from app.db.migrations import migration_inventory; print("\n".join(migration_inventory()))' > migration-inventory.txt
|
|
printf '%s\n' 'PORTFOLIO_HUB_SECRET_CANARY_DO_NOT_SHIP' > .env.ci-canary
|
|
RELEASE_VERSION="v$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
|
|
docker build --platform linux/amd64 --provenance=false \
|
|
--build-arg "SOURCE_COMMIT=${GITHUB_SHA}" --build-arg "RELEASE_VERSION=${RELEASE_VERSION}" \
|
|
--tag "portfolio-hub-ci:${GITHUB_SHA}" .
|
|
uv run python scripts/image_release.py smoke --image "portfolio-hub-ci:${GITHUB_SHA}" --inventory migration-inventory.txt --timeout 180
|
|
docker save --output portfolio-hub-image.tar "portfolio-hub-ci:${GITHUB_SHA}"
|
|
uv run python scripts/image_release.py scan --image "portfolio-hub-ci:${GITHUB_SHA}" --archive portfolio-hub-image.tar
|