Repository navigation
refactor: consolidate coverage and final runtime safeguards #30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Search API Quality | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - dev | |
| - main | |
| merge_group: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: search-api-quality-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| dependency-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Review dependency changes | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: high | |
| fail-on-scopes: runtime, development | |
| quality: | |
| name: Search API Quality | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 24.14.1 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run quality checks | |
| run: npm run quality | |
| container: | |
| name: Runtime Container | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: Build production image | |
| run: docker build --tag cve-search-api:pr . | |
| - name: Report all high and critical image vulnerabilities | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: image | |
| image-ref: cve-search-api:pr | |
| format: table | |
| exit-code: 0 | |
| ignore-unfixed: false | |
| severity: CRITICAL,HIGH | |
| scanners: vuln | |
| trivyignores: /dev/null | |
| version: v0.69.3 | |
| - name: Enforce fixable high and critical image vulnerabilities | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: image | |
| image-ref: cve-search-api:pr | |
| format: table | |
| exit-code: 1 | |
| ignore-unfixed: true | |
| severity: CRITICAL,HIGH | |
| scanners: vuln | |
| trivyignores: .trivyignore | |
| version: v0.69.3 | |
| - name: Start production image | |
| run: | | |
| docker run --detach \ | |
| --name cve-search-api-pr \ | |
| --publish 4100:3000 \ | |
| --env NODE_CONFIG_ENV=prod \ | |
| --env OpenSearchDomainEndpoint=https://search.example.com \ | |
| --env OpenSearchCveIndex=cves \ | |
| cve-search-api:pr | |
| - name: Validate runtime image | |
| run: | | |
| for attempt in $(seq 1 30); do | |
| if curl --fail --silent --show-error http://127.0.0.1:4100/api/health-check; then | |
| break | |
| fi | |
| if [ "$attempt" -eq 30 ]; then | |
| exit 1 | |
| fi | |
| sleep 1 | |
| done | |
| curl --fail --silent --show-error http://127.0.0.1:4100/api-docs/openapi.json \ | |
| | jq --exit-status \ | |
| '.openapi == "3.0.2" and .info.title == "CVE Search API"' \ | |
| > /dev/null | |
| test "$(docker image inspect cve-search-api:pr --format '{{.Config.User}}')" = "65532:65532" | |
| test "$(docker image inspect cve-search-api:pr --format '{{json .Config.Cmd}}')" = '["server.js"]' | |
| - name: Capture container logs | |
| if: always() | |
| run: docker logs cve-search-api-pr || true | |
| - name: Remove test container | |
| if: always() | |
| run: docker rm --force cve-search-api-pr || true |