mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 07:41:23 +00:00
Tomas DvorakandDevin
55edbf8b56
Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
auth middleware; scope picker + badges in Settings UI; scopeless legacy
keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY
Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
(migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)
Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
(429s = configured rate limiter working)
Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.
Authored By: TDvorak <[email protected]>
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
239 lines
5.7 KiB
YAML
239 lines
5.7 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main, develop]
|
|
pull_request:
|
|
branches: [main, develop]
|
|
|
|
jobs:
|
|
backend-tests:
|
|
name: Backend Tests
|
|
runs-on: ubuntu-latest
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: primora_test
|
|
POSTGRES_PASSWORD: test
|
|
POSTGRES_DB: primora_test
|
|
options: >-
|
|
--health-cmd pg_isready
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
ports:
|
|
- 5432:5432
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: apps/backend/go.sum
|
|
|
|
- name: Run backend tests
|
|
working-directory: apps/backend
|
|
env:
|
|
DATABASE_URL: postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable
|
|
run: go test -v ./...
|
|
|
|
frontend-tests:
|
|
name: Frontend Tests
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Run frontend tests
|
|
run: npm run test --workspace @primora/frontend
|
|
|
|
- name: TypeScript check
|
|
run: npm run typecheck:frontend
|
|
|
|
build:
|
|
name: Build All Services
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: apps/backend/go.sum
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build frontend
|
|
run: npm run build --workspace @primora/frontend
|
|
|
|
- name: Build auth
|
|
run: npm run build --workspace @primora/auth
|
|
|
|
- name: Build backend
|
|
working-directory: apps/backend
|
|
run: go build -v ./cmd/server
|
|
|
|
docker-build:
|
|
name: Docker Build Test
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build backend image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: apps/backend/Dockerfile
|
|
push: false
|
|
tags: primora-backend:test
|
|
|
|
- name: Build auth image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: apps/auth/Dockerfile
|
|
push: false
|
|
tags: primora-auth:test
|
|
|
|
- name: Build frontend image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: apps/frontend/Dockerfile
|
|
push: false
|
|
tags: primora-frontend:test
|
|
|
|
migrations:
|
|
name: Migration Up/Down
|
|
runs-on: ubuntu-latest
|
|
|
|
services:
|
|
postgres:
|
|
image: postgres:17-alpine
|
|
env:
|
|
POSTGRES_USER: primora_test
|
|
POSTGRES_PASSWORD: test
|
|
POSTGRES_DB: primora_test
|
|
options: >-
|
|
--health-cmd pg_isready
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
ports:
|
|
- 5432:5432
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: apps/backend/go.sum
|
|
|
|
- name: Install goose
|
|
run: go install github.com/pressly/goose/v3/cmd/[email protected]
|
|
|
|
- name: Migrations up
|
|
run: |
|
|
goose -dir apps/backend/db/migrations \
|
|
postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" up
|
|
|
|
- name: Migrations reset (all downs)
|
|
run: |
|
|
goose -dir apps/backend/db/migrations \
|
|
postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" reset
|
|
|
|
- name: Migrations up again (idempotent re-apply)
|
|
run: |
|
|
goose -dir apps/backend/db/migrations \
|
|
postgres "postgres://primora_test:test@localhost:5432/primora_test?sslmode=disable" up
|
|
|
|
e2e-smoke:
|
|
name: Compose E2E Smoke
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Prepare env
|
|
run: cp .env.example .env
|
|
|
|
- name: Start stack
|
|
run: >-
|
|
docker compose
|
|
-f docker-compose.yml -f docker-compose.dev.yml
|
|
up -d --build
|
|
|
|
- name: Run smoke checks
|
|
run: ./scripts/smoke-e2e.sh
|
|
|
|
- name: Dump logs on failure
|
|
if: failure()
|
|
run: >-
|
|
docker compose
|
|
-f docker-compose.yml -f docker-compose.dev.yml
|
|
logs --tail=200
|
|
|
|
- name: Tear down
|
|
if: always()
|
|
run: >-
|
|
docker compose
|
|
-f docker-compose.yml -f docker-compose.dev.yml
|
|
down -v
|
|
|
|
lint:
|
|
name: Lint
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: '1.26'
|
|
cache-dependency-path: apps/backend/go.sum
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Run golangci-lint
|
|
uses: golangci/golangci-lint-action@v6
|
|
with:
|
|
version: latest
|
|
working-directory: apps/backend
|