Repository navigation
fix: enforce AI control contracts at the edge (#32) #262
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Docker Image | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| quality: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Set up Deno | |
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5 | |
| with: | |
| deno-version: 2.9.6 | |
| cache: true | |
| - name: Lint | |
| run: npm run lint | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Test | |
| run: npm test -- --coverage | |
| - name: Edge function tests | |
| run: npm run test:edge | |
| - name: Build | |
| run: npm run build | |
| - name: Upload production assets | |
| if: github.event_name != 'pull_request' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: production-assets-${{ github.sha }} | |
| path: dist/ | |
| if-no-files-found: error | |
| retention-days: 1 | |
| database-tests: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Set up Supabase CLI | |
| uses: supabase/setup-cli@46f7f98c7f948ad727d22c1e67fab04c223a0520 # v3.0.0 | |
| with: | |
| version: 2.116.0 | |
| - name: Start isolated database and apply migrations | |
| run: supabase db start | |
| - name: Database policy tests | |
| run: npm run test:db | |
| - name: Stop isolated database | |
| if: always() | |
| run: supabase stop --no-backup | |
| browser-tests: | |
| if: github.event_name == 'pull_request' | |
| needs: quality | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Install Chromium | |
| run: npx playwright install --with-deps chromium | |
| - name: Browser tests | |
| env: | |
| CI: 1 | |
| PORT: 18080 | |
| PLAYWRIGHT_BASE_URL: http://127.0.0.1:18080 | |
| run: npm run test:e2e | |
| - name: Upload browser failure artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: chromium-browser-failure-${{ github.run_id }} | |
| path: | | |
| test-results/ | |
| playwright-report/ | |
| if-no-files-found: ignore | |
| retention-days: 7 | |
| docker: | |
| if: github.event_name != 'pull_request' | |
| needs: quality | |
| runs-on: ubuntu-latest | |
| env: | |
| DOCKER_PUSH: ${{ github.event_name == 'push' && secrets.DOCKER_USERNAME != '' && secrets.DOCKER_PASSWORD != '' }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Download production assets | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: production-assets-${{ github.sha }} | |
| path: dist/ | |
| - name: Set up QEMU | |
| if: env.DOCKER_PUSH == 'true' | |
| uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 | |
| - name: Set up Docker Buildx | |
| if: env.DOCKER_PUSH == 'true' | |
| uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 | |
| - name: Login to Docker Hub | |
| if: env.DOCKER_PUSH == 'true' | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| username: ${{ secrets.DOCKER_USERNAME }} | |
| password: ${{ secrets.DOCKER_PASSWORD }} | |
| # Create a minimal Dockerfile for multi-arch that just uses pre-built assets | |
| - name: Create production Dockerfile | |
| if: env.DOCKER_PUSH == 'true' | |
| run: | | |
| cat > Dockerfile.prod << 'EOF' | |
| FROM nginx:alpine | |
| RUN rm -rf /usr/share/nginx/html/* | |
| COPY dist /usr/share/nginx/html | |
| COPY nginx.conf /etc/nginx/conf.d/default.conf | |
| EXPOSE 80 | |
| CMD ["nginx", "-g", "daemon off;"] | |
| EOF | |
| - name: Build and push | |
| if: env.DOCKER_PUSH == 'true' | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| file: Dockerfile.prod | |
| push: ${{ env.DOCKER_PUSH == 'true' }} | |
| tags: adamgaborjaniszabo/debate-trainer:latest | |
| platforms: linux/amd64,linux/arm64 |