zaati-os/.github/workflows/ci.yml at 04c9a0d14dcb65bc672ca4571bd56b382c11032d · mohsinht/zaati-os · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  static-contracts:
    name: Static analysis and contracts
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run format:check
      - run: npm run lint
      - run: npm run typecheck
      - run: npm run repository:validate
      - run: npm run contracts:check

  unit-coverage:
    name: Unit tests and coverage
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run test:coverage
      - run: npm run tutorial:check

  build-performance:
    name: Production build and budgets
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: npm run performance:check

  accessibility:
    name: Accessibility matrix
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: npm run accessibility:check

  security-audit:
    name: Dependency security audit
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm audit --audit-level=high

  quality-gate:
    name: Quality gate
    if: always()
    needs: [static-contracts, unit-coverage, build-performance, accessibility, security-audit]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require every quality dimension
        env:
          ACCESSIBILITY_RESULT: ${{ needs.accessibility.result }}
          BUILD_RESULT: ${{ needs['build-performance'].result }}
          SECURITY_RESULT: ${{ needs['security-audit'].result }}
          STATIC_RESULT: ${{ needs['static-contracts'].result }}
          UNIT_RESULT: ${{ needs['unit-coverage'].result }}
        run: |
          failed=0
          for result in "$STATIC_RESULT" "$UNIT_RESULT" "$BUILD_RESULT" "$ACCESSIBILITY_RESULT" "$SECURITY_RESULT"; do
            if [ "$result" != "success" ]; then
              failed=1
            fi
          done
          if [ "$failed" -ne 0 ]; then
            echo "One or more required quality jobs did not pass."
            exit 1
          fi
      - name: Publish quality summary
        run: |
          {
            echo "## Zaati OS quality gate"
            echo
            echo "All required formatting, static analysis, contract, coverage, build, performance, accessibility, and dependency audit jobs passed."
          } >> "$GITHUB_STEP_SUMMARY"