66 lines
3.0 KiB
YAML
66 lines
3.0 KiB
YAML
name: Verify container release contracts
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
services:
|
|
timescaledb:
|
|
image: timescale/timescaledb@sha256:252a443e2936039b83dd8da1373d01e59e932d1054fa6adf1bc061f1d56ae60a
|
|
env:
|
|
POSTGRES_DB: portfolio_hub
|
|
POSTGRES_USER: portfolio_hub_user
|
|
POSTGRES_PASSWORD: change-me
|
|
ports:
|
|
- 5432:5432
|
|
options: >-
|
|
--health-cmd "pg_isready -U portfolio_hub_user -d portfolio_hub"
|
|
--health-interval 5s
|
|
--health-timeout 5s
|
|
--health-retries 12
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.11"
|
|
- run: python -m pip install "uv==0.11.14"
|
|
- run: uv sync --extra dev --locked
|
|
- run: uv run pytest -q
|
|
- name: Verify corporate-action atomicity and guarded recovery in PostgreSQL
|
|
env:
|
|
POSTGRES_PASSWORD: change-me
|
|
run: |
|
|
export PORTFOLIOHUB_TEST_POSTGRES_DSN="postgresql://portfolio_hub_user:${POSTGRES_PASSWORD}@127.0.0.1:5432/postgres"
|
|
uv run pytest -q tests/test_corporate_action_atomic_recovery_postgres.py
|
|
- name: Honest scoped lint for release additions
|
|
run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py scripts/ruff_ratchet.py tests/release
|
|
- name: Reject Ruff findings introduced by v0.3.0 or later patches
|
|
run: |
|
|
uv run python scripts/ruff_ratchet.py --base v0.2.1
|
|
uv run python scripts/ruff_ratchet.py --base v0.3.0
|
|
uv run python scripts/ruff_ratchet.py --base v0.3.1
|
|
- name: Validate container contracts without registry writes
|
|
run: uv run pytest -q tests/release
|
|
- name: Build and smoke exact pull-request or main source image
|
|
run: |
|
|
uv run python -c 'from app.db.migrations import migration_inventory; print("\n".join(migration_inventory()))' > migration-inventory.txt
|
|
printf '%s\n' 'PORTFOLIO_HUB_SECRET_CANARY_DO_NOT_SHIP' > .env.ci-canary
|
|
RELEASE_VERSION="v$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
|
|
docker build --platform linux/amd64 --provenance=false \
|
|
--build-arg "SOURCE_COMMIT=${GITHUB_SHA}" --build-arg "RELEASE_VERSION=${RELEASE_VERSION}" \
|
|
--tag "portfolio-hub-ci:${GITHUB_SHA}" .
|
|
uv run python scripts/image_release.py smoke --image "portfolio-hub-ci:${GITHUB_SHA}" --inventory migration-inventory.txt --timeout 180
|
|
docker save --output portfolio-hub-image.tar "portfolio-hub-ci:${GITHUB_SHA}"
|
|
uv run python scripts/image_release.py scan --image "portfolio-hub-ci:${GITHUB_SHA}" --archive portfolio-hub-image.tar
|