cortex/.github/workflows/ci.yaml at main · rossoctl/cortex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
# CI - Lint, test, and build for all modules
#
# Runs on PRs and pushes to main/release branches.
# Covers the AuthProxy Go module and Python tests.
#
name: CI

on:
  pull_request:
    branches:
      - main
      - "release-*"
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  pre-commit:
    name: Pre-commit Checks
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
        with:
          go-version-file: authbridge/authlib/go.mod

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: '3.12'

      - name: Run pre-commit
        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
        # TODO: Remove continue-on-error after fixing pre-existing style issues repo-wide
        continue-on-error: true
        env:
          SKIP: ai-assisted-by-trailer

  go-ci-authlib:
    name: Go CI (authlib)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: authbridge/authlib
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
        with:
          go-version-file: authbridge/authlib/go.mod
          cache-dependency-path: authbridge/authlib/go.sum

      - name: Lint
        run: |
          go fmt ./...
          go vet ./...

      - name: Build
        run: go build -v ./...

      - name: Test
        run: go test -v -race -cover ./...

  go-ci-authbridge-cmd:
    name: Go CI (authbridge ${{ matrix.binary }})
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        binary:
          - authbridge-proxy
          - authbridge-envoy
    defaults:
      run:
        working-directory: authbridge/cmd/${{ matrix.binary }}
    env:
      # Disable go.work so each cmd/* module resolves authlib via its own
      # `replace` directive in go.mod (the workspace would otherwise pull
      # all sibling modules in and slow down CI).
      GOWORK: "off"
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
        with:
          go-version-file: authbridge/cmd/${{ matrix.binary }}/go.mod
          cache-dependency-path: authbridge/cmd/${{ matrix.binary }}/go.sum

      - name: Lint
        run: |
          go fmt ./...
          go vet ./...

      - name: Build
        run: go build -v ./...

      # The authbridge-lite image is this same authbridge-proxy binary built
      # with exclude_plugin_* tags (only jwt-validation + token-exchange).
      # Build AND test that tag set on every PR — build.yaml only exercises
      # it on tag/main pushes, and this guards against lite-only regressions.
      - name: Build + test lite variant (exclude_plugin_* tags)
        if: matrix.binary == 'authbridge-proxy'
        run: |
          TAGS="exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser"
          TAGS="$TAGS,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker"
          go build -v -tags "$TAGS" ./...
          go test -v -race -cover -tags "$TAGS" ./...

      - name: Test
        run: go test -v -race -cover ./...

  python-test:
    name: Python Tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: |
          pip install pytest==8.* python-keycloak==5.3.1 pyjwt==2.10.1 pyyaml==6.*

      - name: Run tests
        run: pytest tests/ -v -x --ignore=tests/e2e