ci: deploy docs via Ddraig SSG (#48) #236
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | ||
| permissions: | ||
| contents: read | ||
| name: CI Extended (RSR Compliance) | ||
| on: | ||
| push: | ||
| branches: [main, develop, claude/**] | ||
| pull_request: | ||
| branches: [main, develop] | ||
| schedule: | ||
| - cron: '0 0 * * 0' # Weekly on Sunday | ||
| jobs: | ||
| rsr-compliance: | ||
| name: RSR Framework Verification | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Setup Deno | ||
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v1 | ||
| with: | ||
| deno-version: v1.x | ||
| - name: Check RSR Compliance | ||
| run: deno run --allow-read scripts/rsr-score.ts | ||
| - name: Verify Required Files | ||
| run: | | ||
| files=( | ||
| "SECURITY.md" | ||
| "CODE_OF_CONDUCT.md" | ||
| "MAINTAINERS.md" | ||
| ".well-known/security.txt" | ||
| ".well-known/ai.txt" | ||
| ".well-known/humans.txt" | ||
| "PALIMPSEST-LICENSE.txt" | ||
| ) | ||
| for file in "${files[@]}"; do | ||
| if [ ! -f "$file" ]; then | ||
| echo "❌ Missing required file: $file" | ||
| exit 1 | ||
| else | ||
| echo "✅ Found: $file" | ||
| fi | ||
| done | ||
| test-matrix: | ||
| name: Test on ${{ matrix.os }} - Deno ${{ matrix.deno }} | ||
| runs-on: ${{ matrix.os }} | ||
| timeout-minutes: 15 | ||
| strategy: | ||
| matrix: | ||
| os: [ubuntu-latest, macos-latest, windows-latest] | ||
| deno: ['1.x', 'canary'] | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Setup Deno | ||
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v1 | ||
| with: | ||
| deno-version: ${{ matrix.deno }} | ||
| - name: Cache Dependencies | ||
| run: deno cache src/deps.ts | ||
| - name: Run Tests | ||
| run: deno test --allow-all | ||
| security-audit: | ||
| name: Security Audit | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Setup Deno | ||
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v1 | ||
| - name: Generate SBOM | ||
| run: | | ||
| deno info --json src/deps.ts > sbom.json | ||
| cat sbom.json | ||
| - name: Secret Scanning | ||
| uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Upload SBOM | ||
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | ||
| with: | ||
| name: sbom | ||
| path: sbom.json | ||
| offline-first-test: | ||
| name: Offline-First Verification | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Setup Deno | ||
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v1 | ||
| - name: Test Offline Mode | ||
| run: | | ||
| # Disable network | ||
| sudo iptables -I INPUT -j DROP | ||
| sudo iptables -I OUTPUT -j DROP | ||
| # Run offline tests | ||
| deno test --allow-all tests/offline.test.ts || true | ||
| # Re-enable network | ||
| sudo iptables -F | ||
| nix-build: | ||
| name: Nix Reproducible Build | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Install Nix | ||
| uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 | ||
| with: | ||
| nix_path: nixpkgs=channel:nixos-unstable | ||
| - name: Build with Nix | ||
| run: nix build | ||
| - name: Run Nix Checks | ||
| run: nix flake check | ||
| documentation: | ||
| name: Build Documentation | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Setup Node | ||
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | ||
| with: | ||
| node-version: '20' | ||
| - name: Install TypeDoc | ||
| run: npm install -g typedoc | ||
| - name: Generate API Docs | ||
| run: typedoc | ||
| - name: Deploy to GitHub Pages | ||
| if: github.ref == 'refs/heads/main' | ||
| uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 | ||
| with: | ||
| github_token: ${{ secrets.GITHUB_TOKEN }} | ||
| publish_dir: ./docs/api | ||
| benchmark: | ||
| name: Performance Benchmarks | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Setup Deno | ||
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v1 | ||
| - name: Run Benchmarks | ||
| run: deno bench --allow-all benches/ | ||
| slsa-provenance: | ||
| name: SLSA Provenance | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Setup Deno | ||
| uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v1 | ||
| - name: Build | ||
| run: deno run --allow-all build.ts | ||
| - name: Generate Provenance | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 | ||
| with: | ||
| artifacts: dist/ | ||
| container-scan: | ||
| name: Container Security Scan | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| - name: Build Docker Image | ||
| run: docker build -t preference-injector:${{ github.sha }} . | ||
| - name: Run Trivy Scanner | ||
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # master | ||
| with: | ||
| image-ref: preference-injector:${{ github.sha }} | ||
| format: 'sarif' | ||
| output: 'trivy-results.sarif' | ||
| - name: Upload Trivy Results | ||
| uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v3 | ||
| with: | ||
| sarif_file: 'trivy-results.sarif' | ||
