73 lines
2.2 KiB
YAML
73 lines
2.2 KiB
YAML
name: Test and SonarQube
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
# Full history so SonarQube can attribute issues to commits (blame).
|
|
fetch-depth: 0
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Set up Node
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Install Node dependencies
|
|
run: npm ci || npm install
|
|
|
|
# Checks that run without a live server. The Playwright suite in tests/
|
|
# drives the running application (Docker, port 7890) and cannot execute
|
|
# on a bare CI runner, so it is deliberately NOT wired in here — a step
|
|
# that always fails would make the Quality Gate meaningless. Wire it up
|
|
# once the app can be started in CI.
|
|
- name: Verify Python sources compile
|
|
run: python -m compileall -q core routes scripts server.py ttsvc_cli.py
|
|
|
|
- name: Run Python security regressions
|
|
run: python -m unittest discover -s tests -p 'test_*.py'
|
|
|
|
- name: Verify JavaScript parses
|
|
run: |
|
|
for f in $(git ls-files 'static/js/*.js' 'scripts/*.mjs'); do
|
|
node --check "$f" || exit 1
|
|
done
|
|
|
|
- name: Run frontend collision and manifest checks
|
|
run: npm run check:frontend
|
|
|
|
- name: Build the frontend bundle
|
|
run: node scripts/minify.mjs
|
|
|
|
# Advisory until pre-existing failures are fixed (see architecture/qa.md).
|
|
- name: Central QA (fast)
|
|
continue-on-error: true
|
|
run: npm run qa -- --fast
|
|
|
|
- name: SonarQube scan
|
|
uses: SonarSource/sonarqube-scan-action@v8.1.0
|
|
env:
|
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|
|
SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
|
|
with:
|
|
# Project key, sources and exclusions live in sonar-project.properties
|
|
# so they stay identical for local and CI scans.
|
|
args: >-
|
|
-Dsonar.qualitygate.wait=true
|
|
-Dsonar.qualitygate.timeout=300
|