zaati-os/.github/workflows/ci.yml at 5becfb4682c12b62d78c6bb2552e47a7fb7cf886 · mohsinht/zaati-os · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: write

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  static-contracts:
    name: Static analysis and contracts
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run format:check
      - run: npm run lint
      - run: npm run typecheck
      - run: npm run repository:validate
      - run: npm run contracts:check

  unit-coverage:
    name: Unit tests and coverage
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run test:coverage
      - run: npm run tutorial:check

  build-performance:
    name: Production build and budgets
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run build
      - run: npm run performance:check

  accessibility:
    name: Accessibility matrix
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0
          persist-credentials: true
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm run build
      - name: Capture accessibility matrix and screenshots
        env:
          ZAATI_CAPTURE_SCREENSHOTS: "true"
          ZAATI_SCREENSHOT_DIR: examples/screenshots
        run: npm run accessibility:check
      - name: Rewrite PR head with refreshed desktop screenshots
        if: github.event_name == 'pull_request' && github.head_ref == 'codex/dashboard-design-polish'
        env:
          ZAATI_FINAL_BASE: ba9d26cd609894abcdf1b663e9efb26e7bd3a4fa
          ZAATI_EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }}
        run: |
          mkdir -p /tmp/zaati-screenshots
          cp examples/screenshots/*-1440-*.png /tmp/zaati-screenshots/
          git reset --hard "$ZAATI_FINAL_BASE"
          cp /tmp/zaati-screenshots/*.png examples/screenshots/
          git add examples/screenshots/*-1440-*.png
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          if git diff --cached --quiet; then
            echo "No desktop screenshot changes to commit."
          else
            git commit -m "Refresh desktop dashboard screenshots"
          fi
          final_sha="$(git rev-parse HEAD)"
          echo "ZAATI_FINAL_SHA=$final_sha"
          git push --force-with-lease=refs/heads/codex/dashboard-design-polish:$ZAATI_EXPECTED_HEAD origin HEAD:refs/heads/codex/dashboard-design-polish

  security-audit:
    name: Dependency security audit
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm audit --audit-level=high

  quality-gate:
    name: Quality gate
    if: always()
    needs: [static-contracts, unit-coverage, build-performance, accessibility, security-audit]
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - name: Require every quality dimension
        env:
          ACCESSIBILITY_RESULT: ${{ needs.accessibility.result }}
          BUILD_RESULT: ${{ needs['build-performance'].result }}
          SECURITY_RESULT: ${{ needs['security-audit'].result }}
          STATIC_RESULT: ${{ needs['static-contracts'].result }}
          UNIT_RESULT: ${{ needs['unit-coverage'].result }}
        run: |
          failed=0
          for result in "$STATIC_RESULT" "$UNIT_RESULT" "$BUILD_RESULT" "$ACCESSIBILITY_RESULT" "$SECURITY_RESULT"; do
            if [ "$result" != "success" ]; then
              failed=1
            fi
          done
          if [ "$failed" -ne 0 ]; then
            echo "One or more required quality jobs did not pass."
            exit 1
          fi
      - name: Publish quality summary
        run: |
          {
            echo "## Zaati OS quality gate"
            echo
            echo "All required formatting, static analysis, contract, coverage, build, performance, accessibility, and dependency audit jobs passed."
          } >> "$GITHUB_STEP_SUMMARY"