server-2/.github/workflows/cd.yml at master · solid-stats/server-2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
name: CI

on:
  pull_request:
  push:
    branches:
      - main
      - master
  workflow_dispatch:

concurrency:
  group: server-2-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  packages: write

env:
  IMAGE_NAME: ghcr.io/${{ github.repository }}

jobs:
  verify:
    name: Verify
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 25
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Start integration services
        run: |
          set -euo pipefail
          docker compose up -d postgres rabbitmq minio
          timeout 120 bash -c 'until docker compose exec -T postgres pg_isready -U solid -d solid_stats; do sleep 2; done'
          timeout 120 bash -c 'until docker compose exec -T rabbitmq rabbitmq-diagnostics -q ping; do sleep 2; done'
          timeout 120 bash -c 'until curl -fsS http://127.0.0.1:9000/minio/health/live; do sleep 2; done'
          docker compose run --rm minio-create-bucket

      - name: Run verification
        run: pnpm run verify

      - name: Stop integration services
        if: always()
        run: docker compose down --volumes --remove-orphans

  golden-oracle:
    name: Golden oracle (master-only)
    runs-on: ubuntu-latest
    # Master-only, slow, pre-deploy behavioral regression gate. NOT part of `verify`
    # and NOT a PR-required check — it needs the docker-compose services and may run
    # for several minutes. It pins the current ingest→stats behavior so a
    # behavior-preserving refactor stays green and any drift turns red.
    if: github.event_name == 'push' && (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main')
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Setup pnpm
        uses: pnpm/action-setup@v6
        with:
          run_install: false

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 25
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Start integration services
        run: |
          set -euo pipefail
          docker compose up -d postgres rabbitmq minio
          timeout 120 bash -c 'until docker compose exec -T postgres pg_isready -U solid -d solid_stats; do sleep 2; done'
          timeout 120 bash -c 'until docker compose exec -T rabbitmq rabbitmq-diagnostics -q ping; do sleep 2; done'
          timeout 120 bash -c 'until curl -fsS http://127.0.0.1:9000/minio/health/live; do sleep 2; done'
          docker compose run --rm minio-create-bucket

      - name: Run golden oracle
        run: pnpm run test:golden

      - name: Stop integration services
        if: always()
        run: docker compose down --volumes --remove-orphans

  contract-diff:
    name: Contract diff
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Classify OpenAPI breaking changes
        uses: oasdiff/oasdiff-action/breaking@5ffbc910f1d1742f0dd9bf846a7f86954353556b # v0.0.56
        with:
          base: "origin/${{ github.base_ref }}:openapi/server-2.openapi.json"
          revision: "HEAD:openapi/server-2.openapi.json"
          fail-on: ERR

  image:
    name: Build image
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: verify
    if: github.event_name != 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Login to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ env.IMAGE_NAME }}
          tags: |
            type=raw,value=${{ github.sha }}
            type=ref,event=branch

      - name: Build and push
        uses: docker/build-push-action@v7
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}