69a7997dc4
The lean-build job proved the delete-a-plugin guarantee with two plugins and four hand-picked marker components. It now builds a real twelve-plugin set, and the assertions follow a rule instead of a hunch: one component from EVERY omitted plugin must be absent, one from EVERY chosen plugin must be present, and the backend tree is checked both ways. An omitted set that grows without its check growing is how a leak ships. CHANGELOG had not been touched across the whole range, so the largest security-behaviour change in the product - per-PC endpoint credentials, the shared-key refusal for enrolled PCs, server pinning, agent 1.20.1 and tray 1.7.1 - had no release record. An [Unreleased] section now carries it, written from the commits rather than from memory. CLAUDE.md and the agent quick-reference stated that ADR-016 bans storing credentials in the registry. It does not, and this fleet depends on HKLM for its collector key and server pins: the next person following that text removes them and silently breaks reporting and pinning on every un-enrolled PC. Corrected, along with two other statements that were false on this branch - the database is MySQL, not PostgreSQL, and column names are lowercase concatenated, not snake_case, which is the opposite of what the gate enforces. The wiki drafts are updated against the code as it stands, each old finding given a verdict with a file and line rather than left as an assertion from a week ago, and a new page records the ADR conformance result - including that the ADR set itself is not on this branch, so nothing here enforces it except the naming and style script. They are also scrubbed of the things that must not reach a published wiki: the site name, the internal git server, developer home paths and the assistant tooling. They now pass the repository's own publishability patterns, which is what the scrub is for.
166 lines
7.3 KiB
YAML
166 lines
7.3 KiB
YAML
# CI for shopdb-flask on GitHub Actions.
|
|
#
|
|
# Mirrors the internal CI pipeline. Jobs on push + pull_request:
|
|
# backend - pytest (SQLite via TestingConfig, no DB service needed)
|
|
# naming - the CONTRIBUTING.md naming/style gate
|
|
# gates - proves those checks actually RAN rather than skipping
|
|
# frontend - vitest + Vue build
|
|
# lean-build - ADR-013: a per-site build carries only its plugins
|
|
# migrations-mysql - the REAL multi-site deploy path: fresh flask db upgrade
|
|
# + every plugin's chain on utf8mb4 MySQL 8, idempotent on
|
|
# a second run. The pytest suite only exercises SQLite
|
|
# create_all(), so this is what catches an Alembic
|
|
# regression on MySQL before it ships.
|
|
|
|
name: CI
|
|
|
|
# Action versions are the Node 24 native releases (checkout@v5, setup-node@v5,
|
|
# setup-python@v6). The v4/v5 generation targets Node 20, which the runners now
|
|
# force onto Node 24 with a deprecation warning on every job - working today,
|
|
# a hard failure whenever GitHub drops the shim.
|
|
#
|
|
# Jobs run on the org's self-hosted "arc-runner-set" (enterprise
|
|
# ge-aerospace-runner-group, Linux). GitHub-hosted runners are blocked by the
|
|
# org IP allow list (hosted Azure runner IPs are not allow-listed -> checkout
|
|
# 403), so ubuntu-latest cannot be used here. arc-runner-set checks out from an
|
|
# internal allow-listed IP and, being Linux, still supports service containers.
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
# A second push supersedes the first: the older run answers a question nobody is
|
|
# asking any more, and it holds a self-hosted runner while doing it.
|
|
concurrency:
|
|
group: ci-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
backend:
|
|
runs-on: arc-runner-set
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-python@v6
|
|
with:
|
|
python-version: '3.14'
|
|
cache: pip
|
|
- run: pip install -r requirements-dev.txt
|
|
- run: python -m pytest -q
|
|
|
|
naming:
|
|
runs-on: arc-runner-set
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- run: bash scripts/check-naming-and-style.sh
|
|
|
|
gates:
|
|
# Prove the gates RAN. Several skip themselves when the file they read is
|
|
# absent, which is correct in this checkout (docs/ becomes the wiki) and was
|
|
# silently wrong here for months: the modules skipped, CI went green, and an
|
|
# outside branch added nine routes documented nowhere and passed.
|
|
#
|
|
# A gate that stops running is worse than no gate, because nobody looks at
|
|
# it again.
|
|
runs-on: arc-runner-set
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-python@v6
|
|
with:
|
|
python-version: '3.14'
|
|
cache: pip
|
|
- run: pip install -r requirements-dev.txt
|
|
- run: bash scripts/check-gates-ran.sh
|
|
|
|
frontend:
|
|
runs-on: arc-runner-set
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: '20'
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- run: npm ci
|
|
- run: npx vitest run
|
|
- run: npm run build
|
|
|
|
lean-build:
|
|
# ADR-013 Phase 5: prove a per-site build carries only its chosen plugins.
|
|
# The profile is the WJ plugin set, so this job proves the build this branch
|
|
# actually ships, not a two-plugin toy. The omission guarantee is what is
|
|
# under test, so the assertions below name a component from EVERY omitted
|
|
# plugin: a set that grows without its check growing is how a leak ships.
|
|
#
|
|
# Chosen (12): backups computers endpoints guides knowledgebase machines
|
|
# network notifications printers slides tools warranty
|
|
# Omitted (5): employees geenforce measuringtools printedparts usb
|
|
# 'applications' is manifest-less core and ships in every build (ADR-013).
|
|
# endpoints hard-depends on computers, which is already chosen, so the
|
|
# closure adds nothing - if that changes, resolve_plugin_closure.py pulls
|
|
# the dependency in and the absence assertions below start failing, which is
|
|
# the signal to update this list rather than to loosen the check.
|
|
runs-on: arc-runner-set
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: '20'
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- run: cd frontend && npm ci
|
|
- name: Build lean site (WJ plugin set)
|
|
run: |
|
|
printf '%s' '{ "site": "ci-lean", "plugins": ["backups", "computers", "endpoints", "guides", "knowledgebase", "machines", "network", "notifications", "printers", "slides", "tools", "warranty"] }' \
|
|
> /tmp/lean-profile.json
|
|
bash scripts/build-site.sh /tmp/lean-profile.json /tmp/leansite
|
|
- name: Assert omitted plugin code is absent, chosen present
|
|
run: |
|
|
assets=/tmp/leansite/frontend-dist/assets
|
|
# One component per OMITTED plugin: employees, geenforce,
|
|
# measuringtools, printedparts, usb.
|
|
for code in EmployeeDirectory ManifestEditor MeasuringToolsList PartsKiosk USBLabelBatch; do
|
|
if grep -rqoh "$code" "$assets"/*.js; then
|
|
echo "FAIL: omitted-plugin code '$code' leaked into the lean bundle"
|
|
exit 1
|
|
fi
|
|
done
|
|
# One component per CHOSEN plugin, so a plugin silently dropped from
|
|
# the bundle fails here instead of on the floor.
|
|
for code in BackupHistory PCsList EndpointsList GuidesList \
|
|
KnowledgeBaseDetail MachineDetail NetworkDevicesList \
|
|
NotificationsList PrinterDetail SlideManager ToolsIndex \
|
|
WarrantiesList; do
|
|
grep -rqoh "$code" "$assets"/*.js || {
|
|
echo "FAIL: chosen-plugin code '$code' missing from the lean bundle"
|
|
exit 1; }
|
|
done
|
|
# Core frontends (no manifest, e.g. applications) must ship in EVERY
|
|
# build regardless of SITE_PLUGINS, or a lean site loses a core page.
|
|
grep -rqoh "ApplicationsList" "$assets"/*.js || {
|
|
echo "FAIL: core page 'ApplicationsList' missing from the lean bundle"
|
|
exit 1; }
|
|
for plugin in backups computers endpoints guides knowledgebase \
|
|
machines network notifications printers slides tools \
|
|
warranty; do
|
|
test -d "/tmp/leansite/plugins/$plugin" || {
|
|
echo "FAIL: chosen plugin '$plugin' missing from the backend tree"
|
|
exit 1; }
|
|
done
|
|
for plugin in employees geenforce measuringtools printedparts usb; do
|
|
test ! -d "/tmp/leansite/plugins/$plugin" || {
|
|
echo "FAIL: omitted plugin '$plugin' staged into the backend tree"
|
|
exit 1; }
|
|
done
|
|
echo "lean build verified: only chosen plugins present"
|
|
|
|
# NOTE: the MySQL-8 migration/seed job (fresh `flask db upgrade` + every
|
|
# plugin chain + strict-mode seeders on a real MySQL 8) runs on the internal
|
|
# CI server, which supports service containers. The org's arc-runner-set is
|
|
# Kubernetes/ARC without docker-in-docker, so GitHub Actions service
|
|
# containers ("services: mysql") are unavailable here ("Job Container is
|
|
# required"). That coverage stays on the internal CI rather than being
|
|
# duplicated on GitHub.
|