mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 07:41:23 +00:00
Tomas DvorakandDevin
fffac52295
- Remove managed connection seeding: platform-postgres/dragonfly carried the backend's own DATABASE_URL/DRAGONFLY_URL into tenant projects where any member could run arbitrary DBX queries against core tables (Codex P1). NewPlatformService loses the seeds param; firstPartyDBSeeds deleted. - Seal db_connections passwords with the existing AES-256-GCM encryptor (enc:v1:<b64> marker); decrypted only in dbxArgsFor. Legacy plaintext values still read, but migration 00008 strips them (Codex P1). - Migration 00008: delete is_managed rows, drop plaintext password keys. - dbxConnectionName uses the full project UUID — the 8-hex prefix could collide and alias another project's credentials (Codex P2). - ci.yml triggers on master, not the nonexistent main/develop branches. - demo-mode stubs renamed to user-managed connections; CHANGELOG notes under Unreleased. Authored By: TDvorak <[email protected]> Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
239 lines
5.7 KiB
YAML
239 lines
5.7 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [master]
|
|
pull_request:
|
|
branches: [master]
|
|
|
|
jobs:
|
|
backend-tests:
|
|
name: Backend Tests
|
|
runs-on: ubuntu-latest
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: primora_test
|
|
POSTGRES_PASSWORD: test
|
|
POSTGRES_DB: primora_test
|
|
options: >-
|
|
--health-cmd pg_isready
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
ports:
|
|
- 5432:5432
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: apps/backend/go.sum
|
|
|
|
- name: Run backend tests
|
|
working-directory: apps/backend
|
|
env:
|
|
DATABASE_URL: postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable
|
|
run: go test -v ./...
|
|
|
|
frontend-tests:
|
|
name: Frontend Tests
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Run frontend tests
|
|
run: npm run test --workspace @primora/frontend
|
|
|
|
- name: TypeScript check
|
|
run: npm run typecheck:frontend
|
|
|
|
build:
|
|
name: Build All Services
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: apps/backend/go.sum
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build frontend
|
|
run: npm run build --workspace @primora/frontend
|
|
|
|
- name: Build auth
|
|
run: npm run build --workspace @primora/auth
|
|
|
|
- name: Build backend
|
|
working-directory: apps/backend
|
|
run: go build -v ./cmd/server
|
|
|
|
docker-build:
|
|
name: Docker Build Test
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build backend image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: apps/backend/Dockerfile
|
|
push: false
|
|
tags: primora-backend:test
|
|
|
|
- name: Build auth image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: apps/auth/Dockerfile
|
|
push: false
|
|
tags: primora-auth:test
|
|
|
|
- name: Build frontend image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: apps/frontend/Dockerfile
|
|
push: false
|
|
tags: primora-frontend:test
|
|
|
|
migrations:
|
|
name: Migration Up/Down
|
|
runs-on: ubuntu-latest
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: primora_test
|
|
POSTGRES_PASSWORD: test
|
|
POSTGRES_DB: primora_test
|
|
options: >-
|
|
--health-cmd pg_isready
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
ports:
|
|
- 5432:5432
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: apps/backend/go.sum
|
|
|
|
- name: Install goose
|
|
run: go install github.com/pressly/goose/v3/cmd/[email protected]
|
|
|
|
- name: Migrations up
|
|
run: |
|
|
goose -dir apps/backend/db/migrations \
|
|
postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" up
|
|
|
|
- name: Migrations reset (all downs)
|
|
run: |
|
|
goose -dir apps/backend/db/migrations \
|
|
postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" reset
|
|
|
|
- name: Migrations up again (idempotent re-apply)
|
|
run: |
|
|
goose -dir apps/backend/db/migrations \
|
|
postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" up
|
|
|
|
e2e-smoke:
|
|
name: Compose E2E Smoke
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Prepare env
|
|
run: cp .env.example .env
|
|
|
|
- name: Start stack
|
|
run: >-
|
|
docker compose
|
|
-f docker-compose.yml -f docker-compose.dev.yml
|
|
up -d --build
|
|
|
|
- name: Run smoke checks
|
|
run: ./scripts/smoke-e2e.sh
|
|
|
|
- name: Dump logs on failure
|
|
if: failure()
|
|
run: >-
|
|
docker compose
|
|
-f docker-compose.yml -f docker-compose.dev.yml
|
|
logs --tail=200
|
|
|
|
- name: Tear down
|
|
if: always()
|
|
run: >-
|
|
docker compose
|
|
-f docker-compose.yml -f docker-compose.dev.yml
|
|
down -v
|
|
|
|
lint:
|
|
name: Lint
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: apps/backend/go.sum
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Run golangci-lint
|
|
uses: golangci/golangci-lint-action@v6
|
|
with:
|
|
version: latest
|
|
working-directory: apps/backend
|