raptr/.github/workflows/ci.yml at main · CompassSecurity/raptr · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: CI

on:
  workflow_dispatch:
  pull_request:
    branches: [ "main" ]
    paths-ignore:
      - 'docs/**'
      - '.github/**'
      - 'README.md'

permissions: {}

jobs:
  backend-checks:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    defaults:
      run:
        working-directory: ./backend

    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Set up Python 3.14
      uses: actions/setup-python@v5
      with:
        python-version: "3.14"

    - name: Install uv
      run: curl -LsSf https://astral.sh/uv/install.sh | sh

    - name: Install dependencies
      run: uv sync --frozen

    - name: Lint with Ruff
      run: uv run ruff check .

    - name: Format check with Ruff
      run: uv run ruff format --check .

    - name: Run tests
      run: uv run pytest

  frontend-checks:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    defaults:
      run:
        working-directory: ./frontend

    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Set up Bun
      uses: oven-sh/setup-bun@v2

    - name: Install dependencies
      run: bun install --frozen-lockfile

    - name: Lint and format check
      run: bun run lint

    - name: Type check and build
      run: bun run build

  security-scan:
    name: Security Scan (zizmor)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false
    - name: Run zizmor
      uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d
      with:
        inputs: .

  docker-build-check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
    - uses: actions/checkout@v4
      with:
        persist-credentials: false

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build Docker Image (Dry Run)
      uses: docker/build-push-action@v5
      with:
        context: .
        file: Dockerfile
        push: false
        tags: raptr:test