master
7e2fa0a42a
- Cleaned up code formatting and organization across multiple files for improved readability. - Introduced `OsScanAnalyzerDispatcher` to handle OS analyzer execution and plugin loading. - Updated `ScanJobContext` to include an `Analysis` property for storing scan results. - Enhanced `ScanJobProcessor` to utilize the new `OsScanAnalyzerDispatcher`. - Improved logging and error handling in `ScanProgressReporter` for better traceability. - Updated project dependencies and added references to new analyzer plugins. - Revised task documentation to reflect current status and dependencies.
424 lines
15 KiB
YAML
424 lines
15 KiB
YAML
# .gitea/workflows/build-test-deploy.yml
|
||
# Unified CI/CD workflow for git.stella-ops.org (Feedser monorepo)
|
||
|
||
name: Build Test Deploy
|
||
|
||
on:
|
||
push:
|
||
branches: [ main ]
|
||
paths:
|
||
- 'src/**'
|
||
- 'docs/**'
|
||
- 'scripts/**'
|
||
- 'Directory.Build.props'
|
||
- 'Directory.Build.targets'
|
||
- 'global.json'
|
||
- '.gitea/workflows/**'
|
||
pull_request:
|
||
branches: [ main, develop ]
|
||
paths:
|
||
- 'src/**'
|
||
- 'docs/**'
|
||
- 'scripts/**'
|
||
- '.gitea/workflows/**'
|
||
workflow_dispatch:
|
||
inputs:
|
||
force_deploy:
|
||
description: 'Ignore branch checks and run the deploy stage'
|
||
required: false
|
||
default: 'false'
|
||
type: boolean
|
||
|
||
env:
|
||
DOTNET_VERSION: '10.0.100-rc.1.25451.107'
|
||
BUILD_CONFIGURATION: Release
|
||
CI_CACHE_ROOT: /data/.cache/stella-ops/feedser
|
||
RUNNER_TOOL_CACHE: /toolcache
|
||
|
||
jobs:
|
||
profile-validation:
|
||
runs-on: ubuntu-22.04
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Install Helm
|
||
run: |
|
||
curl -fsSL https://get.helm.sh/helm-v3.16.0-linux-amd64.tar.gz -o /tmp/helm.tgz
|
||
tar -xzf /tmp/helm.tgz -C /tmp
|
||
sudo install -m 0755 /tmp/linux-amd64/helm /usr/local/bin/helm
|
||
|
||
- name: Validate deployment profiles
|
||
run: ./deploy/tools/validate-profiles.sh
|
||
|
||
build-test:
|
||
runs-on: ubuntu-22.04
|
||
environment: ${{ github.event_name == 'pull_request' && 'preview' || 'staging' }}
|
||
env:
|
||
PUBLISH_DIR: ${{ github.workspace }}/artifacts/publish/webservice
|
||
AUTHORITY_PUBLISH_DIR: ${{ github.workspace }}/artifacts/publish/authority
|
||
TEST_RESULTS_DIR: ${{ github.workspace }}/artifacts/test-results
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
with:
|
||
fetch-depth: 0
|
||
|
||
- name: Setup .NET ${{ env.DOTNET_VERSION }}
|
||
uses: actions/setup-dotnet@v4
|
||
with:
|
||
dotnet-version: ${{ env.DOTNET_VERSION }}
|
||
include-prerelease: true
|
||
|
||
- name: Restore dependencies
|
||
run: dotnet restore src/StellaOps.Feedser.sln
|
||
|
||
- name: Build solution (warnings as errors)
|
||
run: dotnet build src/StellaOps.Feedser.sln --configuration $BUILD_CONFIGURATION --no-restore -warnaserror
|
||
|
||
- name: Run unit and integration tests
|
||
run: |
|
||
mkdir -p "$TEST_RESULTS_DIR"
|
||
dotnet test src/StellaOps.Feedser.sln \
|
||
--configuration $BUILD_CONFIGURATION \
|
||
--no-build \
|
||
--logger "trx;LogFileName=stellaops-feedser-tests.trx" \
|
||
--results-directory "$TEST_RESULTS_DIR"
|
||
|
||
- name: Publish BuildX SBOM generator
|
||
run: |
|
||
dotnet publish src/StellaOps.Scanner.Sbomer.BuildXPlugin/StellaOps.Scanner.Sbomer.BuildXPlugin.csproj \
|
||
--configuration $BUILD_CONFIGURATION \
|
||
--output out/buildx
|
||
|
||
- name: Verify BuildX descriptor determinism
|
||
run: |
|
||
dotnet out/buildx/StellaOps.Scanner.Sbomer.BuildXPlugin.dll handshake \
|
||
--manifest out/buildx \
|
||
--cas out/cas
|
||
|
||
cat <<'JSON' > out/buildx-sbom.cdx.json
|
||
{"bomFormat":"CycloneDX","specVersion":"1.5"}
|
||
JSON
|
||
|
||
dotnet out/buildx/StellaOps.Scanner.Sbomer.BuildXPlugin.dll descriptor \
|
||
--manifest out/buildx \
|
||
--image sha256:5c2c5bfe0d4d77f1a0f9866fd415dd8da5b62af05d7c3d4b53f28de3ebef0101 \
|
||
--sbom out/buildx-sbom.cdx.json \
|
||
--sbom-name buildx-sbom.cdx.json \
|
||
--artifact-type application/vnd.stellaops.sbom.layer+json \
|
||
--sbom-format cyclonedx-json \
|
||
--sbom-kind inventory \
|
||
--repository ${{ github.repository }} \
|
||
--build-ref ${{ github.sha }} \
|
||
> out/buildx-descriptor.json
|
||
|
||
dotnet out/buildx/StellaOps.Scanner.Sbomer.BuildXPlugin.dll descriptor \
|
||
--manifest out/buildx \
|
||
--image sha256:5c2c5bfe0d4d77f1a0f9866fd415dd8da5b62af05d7c3d4b53f28de3ebef0101 \
|
||
--sbom out/buildx-sbom.cdx.json \
|
||
--sbom-name buildx-sbom.cdx.json \
|
||
--artifact-type application/vnd.stellaops.sbom.layer+json \
|
||
--sbom-format cyclonedx-json \
|
||
--sbom-kind inventory \
|
||
--repository ${{ github.repository }} \
|
||
--build-ref ${{ github.sha }} \
|
||
> out/buildx-descriptor-repeat.json
|
||
|
||
python - <<'PY'
|
||
import json, sys
|
||
from pathlib import Path
|
||
|
||
def normalize(path: str) -> dict:
|
||
data = json.loads(Path(path).read_text(encoding='utf-8'))
|
||
data.pop('generatedAt', None)
|
||
return data
|
||
|
||
baseline = normalize('out/buildx-descriptor.json')
|
||
repeat = normalize('out/buildx-descriptor-repeat.json')
|
||
|
||
if baseline != repeat:
|
||
sys.exit('BuildX descriptor output changed between runs.')
|
||
PY
|
||
|
||
- name: Upload BuildX determinism artifacts
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: buildx-determinism
|
||
path: |
|
||
out/buildx-descriptor.json
|
||
out/buildx-descriptor-repeat.json
|
||
out/buildx-sbom.cdx.json
|
||
if-no-files-found: error
|
||
retention-days: 7
|
||
|
||
- name: Publish Feedser web service
|
||
run: |
|
||
mkdir -p "$PUBLISH_DIR"
|
||
dotnet publish src/StellaOps.Feedser.WebService/StellaOps.Feedser.WebService.csproj \
|
||
--configuration $BUILD_CONFIGURATION \
|
||
--no-build \
|
||
--output "$PUBLISH_DIR"
|
||
|
||
- name: Upload published artifacts
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: feedser-publish
|
||
path: ${{ env.PUBLISH_DIR }}
|
||
if-no-files-found: error
|
||
retention-days: 7
|
||
|
||
- name: Restore Authority solution
|
||
run: dotnet restore src/StellaOps.Authority/StellaOps.Authority.sln
|
||
|
||
- name: Build Authority solution
|
||
run: dotnet build src/StellaOps.Authority/StellaOps.Authority.sln --configuration $BUILD_CONFIGURATION --no-restore -warnaserror
|
||
|
||
- name: Run Authority tests
|
||
run: |
|
||
dotnet test src/StellaOps.Configuration.Tests/StellaOps.Configuration.Tests.csproj \
|
||
--configuration $BUILD_CONFIGURATION \
|
||
--no-build \
|
||
--logger "trx;LogFileName=stellaops-authority-tests.trx" \
|
||
--results-directory "$TEST_RESULTS_DIR"
|
||
|
||
- name: Publish Authority web service
|
||
run: |
|
||
mkdir -p "$AUTHORITY_PUBLISH_DIR"
|
||
dotnet publish src/StellaOps.Authority/StellaOps.Authority/StellaOps.Authority.csproj \
|
||
--configuration $BUILD_CONFIGURATION \
|
||
--no-build \
|
||
--output "$AUTHORITY_PUBLISH_DIR"
|
||
|
||
- name: Upload Authority artifacts
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: authority-publish
|
||
path: ${{ env.AUTHORITY_PUBLISH_DIR }}
|
||
if-no-files-found: error
|
||
retention-days: 7
|
||
|
||
- name: Upload test results
|
||
if: always()
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: feedser-test-results
|
||
path: ${{ env.TEST_RESULTS_DIR }}
|
||
if-no-files-found: ignore
|
||
retention-days: 7
|
||
|
||
authority-container:
|
||
runs-on: ubuntu-22.04
|
||
needs: build-test
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Validate Authority compose file
|
||
run: docker compose -f ops/authority/docker-compose.authority.yaml config
|
||
|
||
- name: Build Authority container image
|
||
run: docker build -f ops/authority/Dockerfile -t stellaops-authority:ci .
|
||
|
||
docs:
|
||
runs-on: ubuntu-22.04
|
||
env:
|
||
DOCS_OUTPUT_DIR: ${{ github.workspace }}/artifacts/docs-site
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
|
||
- name: Setup Python
|
||
uses: actions/setup-python@v5
|
||
with:
|
||
python-version: '3.11'
|
||
|
||
- name: Install documentation dependencies
|
||
run: |
|
||
python -m pip install --upgrade pip
|
||
python -m pip install markdown pygments
|
||
|
||
- name: Render documentation bundle
|
||
run: |
|
||
python scripts/render_docs.py --source docs --output "$DOCS_OUTPUT_DIR" --clean
|
||
|
||
- name: Upload documentation artifact
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: feedser-docs-site
|
||
path: ${{ env.DOCS_OUTPUT_DIR }}
|
||
if-no-files-found: error
|
||
retention-days: 7
|
||
|
||
deploy:
|
||
runs-on: ubuntu-22.04
|
||
needs: [build-test, docs]
|
||
if: >-
|
||
needs.build-test.result == 'success' &&
|
||
needs.docs.result == 'success' &&
|
||
(
|
||
(github.event_name == 'push' && github.ref == 'refs/heads/main') ||
|
||
github.event_name == 'workflow_dispatch'
|
||
)
|
||
environment: staging
|
||
steps:
|
||
- name: Checkout repository
|
||
uses: actions/checkout@v4
|
||
with:
|
||
sparse-checkout: |
|
||
scripts
|
||
.gitea/workflows
|
||
sparse-checkout-cone-mode: true
|
||
|
||
- name: Check if deployment should proceed
|
||
id: check-deploy
|
||
run: |
|
||
if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
|
||
if [ "${{ github.event.inputs.force_deploy }}" = "true" ]; then
|
||
echo "should-deploy=true" >> $GITHUB_OUTPUT
|
||
echo "✅ Manual deployment requested"
|
||
else
|
||
echo "should-deploy=false" >> $GITHUB_OUTPUT
|
||
echo "ℹ️ Manual dispatch without force_deploy=true — skipping"
|
||
fi
|
||
elif [ "${{ github.ref }}" = "refs/heads/main" ]; then
|
||
echo "should-deploy=true" >> $GITHUB_OUTPUT
|
||
echo "✅ Deploying latest main branch build"
|
||
else
|
||
echo "should-deploy=false" >> $GITHUB_OUTPUT
|
||
echo "ℹ️ Deployment restricted to main branch"
|
||
fi
|
||
|
||
- name: Resolve deployment credentials
|
||
id: params
|
||
if: steps.check-deploy.outputs.should-deploy == 'true'
|
||
run: |
|
||
missing=()
|
||
|
||
host="${{ secrets.STAGING_DEPLOYMENT_HOST }}"
|
||
if [ -z "$host" ]; then host="${{ vars.STAGING_DEPLOYMENT_HOST }}"; fi
|
||
if [ -z "$host" ]; then host="${{ secrets.DEPLOYMENT_HOST }}"; fi
|
||
if [ -z "$host" ]; then host="${{ vars.DEPLOYMENT_HOST }}"; fi
|
||
if [ -z "$host" ]; then missing+=("STAGING_DEPLOYMENT_HOST"); fi
|
||
|
||
user="${{ secrets.STAGING_DEPLOYMENT_USERNAME }}"
|
||
if [ -z "$user" ]; then user="${{ vars.STAGING_DEPLOYMENT_USERNAME }}"; fi
|
||
if [ -z "$user" ]; then user="${{ secrets.DEPLOYMENT_USERNAME }}"; fi
|
||
if [ -z "$user" ]; then user="${{ vars.DEPLOYMENT_USERNAME }}"; fi
|
||
if [ -z "$user" ]; then missing+=("STAGING_DEPLOYMENT_USERNAME"); fi
|
||
|
||
path="${{ secrets.STAGING_DEPLOYMENT_PATH }}"
|
||
if [ -z "$path" ]; then path="${{ vars.STAGING_DEPLOYMENT_PATH }}"; fi
|
||
|
||
docs_path="${{ secrets.STAGING_DOCS_PATH }}"
|
||
if [ -z "$docs_path" ]; then docs_path="${{ vars.STAGING_DOCS_PATH }}"; fi
|
||
|
||
key="${{ secrets.STAGING_DEPLOYMENT_KEY }}"
|
||
if [ -z "$key" ]; then key="${{ secrets.DEPLOYMENT_KEY }}"; fi
|
||
if [ -z "$key" ]; then key="${{ vars.STAGING_DEPLOYMENT_KEY }}"; fi
|
||
if [ -z "$key" ]; then key="${{ vars.DEPLOYMENT_KEY }}"; fi
|
||
if [ -z "$key" ]; then missing+=("STAGING_DEPLOYMENT_KEY"); fi
|
||
|
||
if [ ${#missing[@]} -gt 0 ]; then
|
||
echo "❌ Missing deployment configuration: ${missing[*]}"
|
||
exit 1
|
||
fi
|
||
|
||
key_file="$RUNNER_TEMP/staging_deploy_key"
|
||
printf '%s\n' "$key" > "$key_file"
|
||
chmod 600 "$key_file"
|
||
|
||
echo "host=$host" >> $GITHUB_OUTPUT
|
||
echo "user=$user" >> $GITHUB_OUTPUT
|
||
echo "path=$path" >> $GITHUB_OUTPUT
|
||
echo "docs-path=$docs_path" >> $GITHUB_OUTPUT
|
||
echo "key-file=$key_file" >> $GITHUB_OUTPUT
|
||
|
||
- name: Download service artifact
|
||
if: steps.check-deploy.outputs.should-deploy == 'true' && steps.params.outputs.path != ''
|
||
uses: actions/download-artifact@v4
|
||
with:
|
||
name: feedser-publish
|
||
path: artifacts/service
|
||
|
||
- name: Download documentation artifact
|
||
if: steps.check-deploy.outputs.should-deploy == 'true' && steps.params.outputs['docs-path'] != ''
|
||
uses: actions/download-artifact@v4
|
||
with:
|
||
name: feedser-docs-site
|
||
path: artifacts/docs
|
||
|
||
- name: Install rsync
|
||
if: steps.check-deploy.outputs.should-deploy == 'true'
|
||
run: |
|
||
if command -v rsync >/dev/null 2>&1; then
|
||
exit 0
|
||
fi
|
||
CACHE_DIR="${CI_CACHE_ROOT:-/tmp}/apt"
|
||
mkdir -p "$CACHE_DIR"
|
||
KEY="rsync-$(lsb_release -rs 2>/dev/null || echo unknown)"
|
||
DEB_DIR="$CACHE_DIR/$KEY"
|
||
mkdir -p "$DEB_DIR"
|
||
if ls "$DEB_DIR"/rsync*.deb >/dev/null 2>&1; then
|
||
apt-get update
|
||
apt-get install -y --no-install-recommends "$DEB_DIR"/libpopt0*.deb "$DEB_DIR"/rsync*.deb
|
||
else
|
||
apt-get update
|
||
apt-get download rsync libpopt0
|
||
mv rsync*.deb libpopt0*.deb "$DEB_DIR"/
|
||
dpkg -i "$DEB_DIR"/libpopt0*.deb "$DEB_DIR"/rsync*.deb || apt-get install -f -y
|
||
fi
|
||
|
||
- name: Deploy service bundle
|
||
if: steps.check-deploy.outputs.should-deploy == 'true' && steps.params.outputs.path != ''
|
||
env:
|
||
HOST: ${{ steps.params.outputs.host }}
|
||
USER: ${{ steps.params.outputs.user }}
|
||
TARGET: ${{ steps.params.outputs.path }}
|
||
KEY_FILE: ${{ steps.params.outputs['key-file'] }}
|
||
run: |
|
||
SERVICE_DIR="artifacts/service/feedser-publish"
|
||
if [ ! -d "$SERVICE_DIR" ]; then
|
||
echo "❌ Service artifact directory missing ($SERVICE_DIR)"
|
||
exit 1
|
||
fi
|
||
echo "🚀 Deploying Feedser web service to $HOST:$TARGET"
|
||
rsync -az --delete \
|
||
-e "ssh -i $KEY_FILE -o StrictHostKeyChecking=no" \
|
||
"$SERVICE_DIR"/ \
|
||
"$USER@$HOST:$TARGET/"
|
||
|
||
- name: Deploy documentation bundle
|
||
if: steps.check-deploy.outputs.should-deploy == 'true' && steps.params.outputs['docs-path'] != ''
|
||
env:
|
||
HOST: ${{ steps.params.outputs.host }}
|
||
USER: ${{ steps.params.outputs.user }}
|
||
DOCS_TARGET: ${{ steps.params.outputs['docs-path'] }}
|
||
KEY_FILE: ${{ steps.params.outputs['key-file'] }}
|
||
run: |
|
||
DOCS_DIR="artifacts/docs/feedser-docs-site"
|
||
if [ ! -d "$DOCS_DIR" ]; then
|
||
echo "❌ Documentation artifact directory missing ($DOCS_DIR)"
|
||
exit 1
|
||
fi
|
||
echo "📚 Deploying documentation bundle to $HOST:$DOCS_TARGET"
|
||
rsync -az --delete \
|
||
-e "ssh -i $KEY_FILE -o StrictHostKeyChecking=no" \
|
||
"$DOCS_DIR"/ \
|
||
"$USER@$HOST:$DOCS_TARGET/"
|
||
|
||
- name: Deployment summary
|
||
if: steps.check-deploy.outputs.should-deploy == 'true'
|
||
run: |
|
||
echo "✅ Deployment completed"
|
||
echo " Host: ${{ steps.params.outputs.host }}"
|
||
echo " Service path: ${{ steps.params.outputs.path || '(skipped)' }}"
|
||
echo " Docs path: ${{ steps.params.outputs['docs-path'] || '(skipped)' }}"
|
||
|
||
- name: Deployment skipped summary
|
||
if: steps.check-deploy.outputs.should-deploy != 'true'
|
||
run: |
|
||
echo "ℹ️ Deployment stage skipped"
|
||
echo " Event: ${{ github.event_name }}"
|
||
echo " Ref: ${{ github.ref }}"
|