Pouzor
7c2417f5a9
Add least-privilege 'permissions: contents: read' to quality, security and docker-ci workflows (actions/missing-workflow-permissions). Harden markdown table cell escaping in exportMarkdown: escape backslash before pipe and collapse newlines so untrusted values can't break the table (js/incomplete-sanitization). Add regression tests. ha-relevant: maybe
63 lines
1.4 KiB
YAML
63 lines
1.4 KiB
YAML
name: Quality
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint-scripts:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: ShellCheck — lxc-install.sh
|
|
uses: ludeeus/action-shellcheck@2.0.0
|
|
with:
|
|
scandir: './scripts'
|
|
- name: Hadolint — Dockerfile.backend
|
|
uses: hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: Dockerfile.backend
|
|
ignore: DL3008
|
|
- name: Hadolint — Dockerfile.frontend
|
|
uses: hadolint/hadolint-action@v3.1.0
|
|
with:
|
|
dockerfile: Dockerfile.frontend
|
|
ignore: DL3008
|
|
|
|
frontend:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: frontend
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'npm'
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- run: npm ci
|
|
- run: npm run lint
|
|
- run: npm run typecheck
|
|
- run: npm test -- --run
|
|
|
|
backend:
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
working-directory: backend
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
- run: pip install -r requirements.txt
|
|
- run: ruff check .
|
|
- run: mypy app/
|
|
- run: pytest
|