forked from cleveragents/cleveragents-core
freemo
72e0db2592
All 8 nox-running CI jobs in .forgejo/workflows/ci.yml now capture
stdout+stderr to build/nox-<job>-output.log via `2>&1 | tee` and upload
the log as a named Forgejo artifact (if: always(), retention-days: 30).
Artifact names follow the pattern ci-logs-<job>:
ci-logs-lint, ci-logs-typecheck, ci-logs-security, ci-logs-quality,
ci-logs-unit-tests, ci-logs-integration-tests, ci-logs-e2e-tests,
ci-logs-coverage
Seven agent definitions updated with a CI Log Artifacts section:
ca-pr-checker.md: artifact table + curl download instructions; Step 2
now downloads the relevant artifact before dispatching fix subagents.
ca-lint-fixer.md, ca-typecheck-fixer.md, ca-unit-test-runner.md,
ca-integration-test-runner.md, ca-coverage-checker.md,
ca-pr-self-reviewer.md: each receives a section explaining which
artifact corresponds to its domain and how to use it.
Design notes:
- tee (not redirect) preserves output in CI job logs AND captures to file
- if: always() ensures artifacts are available even when the job fails
- Multi-session jobs (lint, security) use tee -a to append to one file
- Existing coverage-reports artifact preserved alongside ci-logs-coverage
ISSUES CLOSED: #2750
671 lines
25 KiB
YAML
671 lines
25 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [master, develop]
|
|
pull_request:
|
|
branches: [master, develop*]
|
|
|
|
env:
|
|
UV_VERSION: "0.8.0"
|
|
PYTHON_VERSION: "3.13"
|
|
NOX_DEFAULT_VENV_BACKEND: "uv"
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install Node.js (required by actions/checkout)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs && rm -rf /var/lib/apt/lists/*
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Run lint via nox
|
|
run: |
|
|
mkdir -p build
|
|
nox -s lint 2>&1 | tee build/nox-lint-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
- name: Run format check via nox
|
|
run: |
|
|
nox -s format -- --check 2>&1 | tee -a build/nox-lint-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
- name: Upload lint log artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ci-logs-lint
|
|
path: build/nox-lint-output.log
|
|
retention-days: 30
|
|
|
|
typecheck:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install Node.js (required by actions/checkout)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs && rm -rf /var/lib/apt/lists/*
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Run typecheck via nox
|
|
run: |
|
|
mkdir -p build
|
|
nox -s typecheck 2>&1 | tee build/nox-typecheck-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
- name: Upload typecheck log artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ci-logs-typecheck
|
|
path: build/nox-typecheck-output.log
|
|
retention-days: 30
|
|
|
|
security:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install Node.js (required by actions/checkout)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs && rm -rf /var/lib/apt/lists/*
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Run security scan via nox
|
|
run: |
|
|
mkdir -p build
|
|
nox -s security_scan 2>&1 | tee build/nox-security-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
- name: Run dead code detection via nox
|
|
run: |
|
|
nox -s dead_code 2>&1 | tee -a build/nox-security-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
- name: Upload security log artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ci-logs-security
|
|
path: build/nox-security-output.log
|
|
retention-days: 30
|
|
|
|
quality:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install Node.js (required by actions/checkout)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs && rm -rf /var/lib/apt/lists/*
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Run complexity check via nox
|
|
run: |
|
|
mkdir -p build
|
|
nox -s complexity 2>&1 | tee build/nox-quality-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
- name: Upload quality log artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ci-logs-quality
|
|
path: build/nox-quality-output.log
|
|
retention-days: 30
|
|
|
|
unit_tests:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install system dependencies (nodejs for checkout, git for merge tests, curl/tar for Helm)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs git curl tar && rm -rf /var/lib/apt/lists/*
|
|
|
|
- name: Install Helm CLI
|
|
run: |
|
|
HELM_VERSION="v3.16.4"
|
|
ARCH="amd64"
|
|
HELM_TARBALL="helm-${HELM_VERSION}-linux-${ARCH}.tar.gz"
|
|
curl -fsSL "https://get.helm.sh/${HELM_TARBALL}" -o "/tmp/${HELM_TARBALL}"
|
|
curl -fsSL "https://get.helm.sh/${HELM_TARBALL}.sha256sum" -o /tmp/helm.sha256sum
|
|
cd /tmp && sha256sum -c helm.sha256sum
|
|
tar -xzf "/tmp/${HELM_TARBALL}" -C /tmp
|
|
mv /tmp/linux-${ARCH}/helm /usr/local/bin/helm
|
|
chmod +x /usr/local/bin/helm
|
|
helm version --short
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Run unit tests via nox
|
|
run: |
|
|
mkdir -p build
|
|
nox -s unit_tests 2>&1 | tee build/nox-unit-tests-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
- name: Upload unit tests log artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ci-logs-unit-tests
|
|
path: build/nox-unit-tests-output.log
|
|
retention-days: 30
|
|
|
|
integration_tests:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install system dependencies (nodejs for checkout, git for integration tests, curl/tar for Helm)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs git curl tar && rm -rf /var/lib/apt/lists/*
|
|
|
|
- name: Install Helm CLI
|
|
run: |
|
|
HELM_VERSION="v3.16.4"
|
|
ARCH="amd64"
|
|
HELM_TARBALL="helm-${HELM_VERSION}-linux-${ARCH}.tar.gz"
|
|
curl -fsSL "https://get.helm.sh/${HELM_TARBALL}" -o "/tmp/${HELM_TARBALL}"
|
|
curl -fsSL "https://get.helm.sh/${HELM_TARBALL}.sha256sum" -o /tmp/helm.sha256sum
|
|
cd /tmp && sha256sum -c helm.sha256sum
|
|
tar -xzf "/tmp/${HELM_TARBALL}" -C /tmp
|
|
mv /tmp/linux-${ARCH}/helm /usr/local/bin/helm
|
|
chmod +x /usr/local/bin/helm
|
|
helm version --short
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Run integration tests via nox
|
|
run: |
|
|
mkdir -p build
|
|
nox -s integration_tests 2>&1 | tee build/nox-integration-tests-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
CLEVERAGENTS_REQUIRE_HELM_RENDER_ASSERTIONS: "true"
|
|
# LLM API keys required for Robot Framework integration tests.
|
|
# These secrets must be configured in Forgejo UI:
|
|
# Repository Settings > Actions > Secrets
|
|
# See docs/development/ci-cd.md for details.
|
|
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
|
|
- name: Upload integration tests log artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ci-logs-integration-tests
|
|
path: build/nox-integration-tests-output.log
|
|
retention-days: 30
|
|
|
|
e2e_tests:
|
|
runs-on: docker
|
|
timeout-minutes: 45
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install system dependencies (nodejs for checkout, git for E2E tests)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs git && rm -rf /var/lib/apt/lists/*
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Run E2E tests via nox
|
|
run: |
|
|
mkdir -p build
|
|
nox -s e2e_tests 2>&1 | tee build/nox-e2e-tests-output.log
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
|
GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
|
|
|
|
- name: Upload E2E tests log artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ci-logs-e2e-tests
|
|
path: build/nox-e2e-tests-output.log
|
|
retention-days: 30
|
|
|
|
coverage:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
needs: [lint, typecheck, security, quality]
|
|
steps:
|
|
- name: Install system dependencies (nodejs for checkout, git for merge tests)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs git && rm -rf /var/lib/apt/lists/*
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Run coverage report via nox (fail-under 97%)
|
|
id: coverage
|
|
run: |
|
|
mkdir -p build
|
|
nox -s coverage_report 2>&1 | tee build/nox-coverage-output.log
|
|
# Extract the single-line CI summary from nox output
|
|
grep -E '^(nox > )?COVERAGE (OK|FAILED):' build/nox-coverage-output.log || true
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
- name: Surface coverage summary
|
|
if: always()
|
|
run: |
|
|
if [ -f build/coverage.json ]; then
|
|
python3 -c "
|
|
import json, sys
|
|
with open('build/coverage.json') as f:
|
|
data = json.load(f)
|
|
summary = data.get('summary') or data.get('totals') or {}
|
|
pct = round(summary.get('percent_covered', 0), 1)
|
|
threshold = 97
|
|
if pct >= threshold:
|
|
print(f'COVERAGE OK: {pct}% (threshold: {threshold}%)')
|
|
else:
|
|
print(f'COVERAGE FAILED: {pct}% < {threshold}% threshold')
|
|
sys.exit(1)
|
|
"
|
|
else
|
|
echo "COVERAGE FAILED: no coverage data generated"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Upload coverage log artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ci-logs-coverage
|
|
path: build/nox-coverage-output.log
|
|
retention-days: 30
|
|
|
|
- name: Upload coverage artifacts
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: coverage-reports
|
|
path: |
|
|
build/coverage.xml
|
|
build/coverage.json
|
|
build/htmlcov/
|
|
retention-days: 30
|
|
|
|
benchmark-regression:
|
|
if: forgejo.event_name == 'pull_request'
|
|
runs-on: docker-benchmark
|
|
container:
|
|
image: python:3.13-slim
|
|
needs: [lint, typecheck, security, quality]
|
|
steps:
|
|
- name: Install system dependencies (nodejs for checkout, git for merge tests)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs git && rm -rf /var/lib/apt/lists/*
|
|
|
|
- name: Checkout full history
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Compute base commit
|
|
id: hash
|
|
run: |
|
|
git fetch origin "${{ forgejo.base_ref }}" --depth=200
|
|
BASE_SHA=$(git merge-base HEAD "origin/${{ forgejo.base_ref }}")
|
|
echo "ASV_BASE_SHA=${BASE_SHA}" >> $FORGEJO_OUTPUT
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install -U pip
|
|
python -m pip install asv virtualenv uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Restore prior ASV benchmarks
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
|
|
ASV_S3_BUCKET: ${{ secrets.ASV_S3_BUCKET }}
|
|
run: |
|
|
python -m pip install awscli
|
|
mkdir -p build/asv/results
|
|
aws s3 sync "s3://${ASV_S3_BUCKET}/asv/results" build/asv/results --delete || true
|
|
|
|
- name: Run asv continuous via nox
|
|
env:
|
|
ASV_BASE_SHA: ${{ steps.hash.outputs.ASV_BASE_SHA }}
|
|
run: |
|
|
nox -s benchmark_regression
|
|
|
|
- name: Archive the results
|
|
run: |
|
|
tar cf /tmp/asv-results.tar build/asv/results build/asv/html
|
|
|
|
- name: Upload benchmark artifacts
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: asv-results-pr
|
|
path: /tmp/asv-results.tar
|
|
rentention-days: 30
|
|
|
|
benchmark-publish:
|
|
if: forgejo.event_name == 'push' && ( forgejo.ref == 'refs/heads/master' || forgejo.ref == 'refs/heads/develop' )
|
|
runs-on: docker-benchmark
|
|
container: python:3.13-slim
|
|
steps:
|
|
- name: Install system dependencies (nodejs for checkout, git for merge tests)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs git && rm -rf /var/lib/apt/lists/*
|
|
|
|
- name: Checkout full history
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install -U pip
|
|
python -m pip install asv virtualenv uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Restore prior ASV benchmarks
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
|
|
ASV_S3_BUCKET: ${{ secrets.ASV_S3_BUCKET }}
|
|
run: |
|
|
python -m pip install awscli
|
|
mkdir -p build/asv/results
|
|
aws s3 sync "s3://${ASV_S3_BUCKET}/asv/results" build/asv/results --delete || true
|
|
|
|
- name: Run asv via nox
|
|
run: |
|
|
nox -s benchmark
|
|
|
|
- name: Upload updated benchmarks and website to S3
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
|
|
ASV_S3_BUCKET: ${{ secrets.ASV_S3_BUCKET }}
|
|
run: |
|
|
python -m pip install awscli
|
|
aws s3 sync build/asv/results "s3://${ASV_S3_BUCKET}/asv/results" --delete
|
|
aws s3 sync build/asv/html "s3://${ASV_S3_BUCKET}/asv/html" --delete
|
|
|
|
- name: Archive the results
|
|
run: |
|
|
tar cf /tmp/asv-results.tar build/asv/results build/asv/html
|
|
|
|
- name: Upload benchmark artifacts
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: asv-results-pr
|
|
path: /tmp/asv-results.tar
|
|
rentention-days: 30
|
|
|
|
build:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install Node.js (required by actions/checkout)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs && rm -rf /var/lib/apt/lists/*
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install uv and nox
|
|
run: |
|
|
pip install -q uv==${{ env.UV_VERSION }} nox
|
|
|
|
- name: Cache uv packages
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: ~/.cache/uv
|
|
key: uv-${{ hashFiles('pyproject.toml') }}
|
|
restore-keys: |
|
|
uv-
|
|
|
|
- name: Build wheel via nox
|
|
run: |
|
|
nox -s build
|
|
env:
|
|
NOX_DEFAULT_VENV_BACKEND: uv
|
|
|
|
docker:
|
|
needs: [lint, typecheck, security, quality, unit_tests]
|
|
runs-on: docker
|
|
container:
|
|
image: docker:dind
|
|
options: --privileged
|
|
steps:
|
|
- name: Start Docker daemon and install dependencies
|
|
run: |
|
|
dockerd &
|
|
apk add --no-cache git nodejs
|
|
for i in $(seq 1 30); do docker info >/dev/null 2>&1 && break || sleep 1; done
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Build Docker image (CLI)
|
|
run: |
|
|
docker build -t cleverernie:test .
|
|
|
|
- name: Test Docker image (CLI)
|
|
run: |
|
|
docker run --rm cleverernie:test --version
|
|
|
|
- name: Build Docker image (Server)
|
|
run: |
|
|
docker build -f Dockerfile.server -t cleveragents-server:test .
|
|
|
|
helm:
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Install system dependencies (nodejs for checkout, curl for Helm and kubeconform)
|
|
run: |
|
|
apt-get update && apt-get install -y -qq nodejs curl tar && rm -rf /var/lib/apt/lists/*
|
|
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Install Helm CLI
|
|
run: |
|
|
HELM_VERSION="v3.16.4"
|
|
ARCH="amd64"
|
|
HELM_TARBALL="helm-${HELM_VERSION}-linux-${ARCH}.tar.gz"
|
|
curl -fsSL "https://get.helm.sh/${HELM_TARBALL}" -o "/tmp/${HELM_TARBALL}"
|
|
curl -fsSL "https://get.helm.sh/${HELM_TARBALL}.sha256sum" -o /tmp/helm.sha256sum
|
|
cd /tmp && sha256sum -c helm.sha256sum
|
|
tar -xzf "/tmp/${HELM_TARBALL}" -C /tmp
|
|
mv /tmp/linux-${ARCH}/helm /usr/local/bin/helm
|
|
chmod +x /usr/local/bin/helm
|
|
helm version --short
|
|
|
|
- name: Install kubeconform
|
|
run: |
|
|
KUBECONFORM_VERSION="v0.7.0"
|
|
ARCH="amd64"
|
|
KUBECONFORM_TARBALL="kubeconform-linux-${ARCH}.tar.gz"
|
|
curl -fsSL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/${KUBECONFORM_TARBALL}" \
|
|
-o "/tmp/${KUBECONFORM_TARBALL}"
|
|
tar -xzf "/tmp/${KUBECONFORM_TARBALL}" -C /tmp
|
|
mv /tmp/kubeconform /usr/local/bin/kubeconform
|
|
chmod +x /usr/local/bin/kubeconform
|
|
kubeconform -v
|
|
|
|
- name: Build Helm chart dependencies
|
|
run: |
|
|
helm dependency build ./k8s
|
|
|
|
- name: Helm lint chart
|
|
run: |
|
|
helm lint ./k8s \
|
|
--set database.url="postgresql+asyncpg://user:pass@db-host:5432/cleveragents"
|
|
|
|
- name: Helm template smoke render
|
|
run: |
|
|
helm template cleveragents ./k8s \
|
|
--set database.url="postgresql+asyncpg://user:pass@db-host:5432/cleveragents" >/tmp/rendered.yaml
|
|
test -s /tmp/rendered.yaml
|
|
|
|
- name: Validate rendered manifests with kubeconform
|
|
run: |
|
|
kubeconform \
|
|
-strict \
|
|
-ignore-missing-schemas \
|
|
-kubernetes-version 1.29.0 \
|
|
-summary \
|
|
/tmp/rendered.yaml
|
|
|
|
status-check:
|
|
if: always()
|
|
needs: [lint, typecheck, security, quality, unit_tests, integration_tests, e2e_tests, coverage, build, docker, helm]
|
|
runs-on: docker
|
|
container:
|
|
image: python:3.13-slim
|
|
steps:
|
|
- name: Check required job results
|
|
run: |
|
|
echo "lint: ${{ needs.lint.result }}"
|
|
echo "typecheck: ${{ needs.typecheck.result }}"
|
|
echo "security: ${{ needs.security.result }}"
|
|
echo "quality: ${{ needs.quality.result }}"
|
|
echo "unit_tests: ${{ needs.unit_tests.result }}"
|
|
echo "integration_tests: ${{ needs.integration_tests.result }}"
|
|
echo "e2e_tests: ${{ needs.e2e_tests.result }}"
|
|
echo "coverage: ${{ needs.coverage.result }}"
|
|
echo "build: ${{ needs.build.result }}"
|
|
echo "docker: ${{ needs.docker.result }}"
|
|
echo "helm: ${{ needs.helm.result }}"
|
|
|
|
if [ "${{ needs.lint.result }}" != "success" ] || \
|
|
[ "${{ needs.typecheck.result }}" != "success" ] || \
|
|
[ "${{ needs.security.result }}" != "success" ] || \
|
|
[ "${{ needs.quality.result }}" != "success" ] || \
|
|
[ "${{ needs.unit_tests.result }}" != "success" ] || \
|
|
[ "${{ needs.integration_tests.result }}" != "success" ] || \
|
|
[ "${{ needs.e2e_tests.result }}" != "success" ] || \
|
|
[ "${{ needs.coverage.result }}" != "success" ] || \
|
|
[ "${{ needs.build.result }}" != "success" ] || \
|
|
[ "${{ needs.docker.result }}" != "success" ] || \
|
|
[ "${{ needs.helm.result }}" != "success" ]; then
|
|
echo "FAILED: One or more required jobs did not succeed"
|
|
exit 1
|
|
fi
|
|
echo "All required CI checks passed"
|