1139 lines
45 KiB
JavaScript
1139 lines
45 KiB
JavaScript
#!/usr/bin/env node
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
import {
|
|
CI_RUNNER_LABEL,
|
|
dockerImageTag,
|
|
HOST_OVERRIDE_VALIDATION_PATTERN as INFRA_HOST_OVERRIDE_VALIDATION_PATTERN,
|
|
HOST_OVERRIDE_WRITE_PATTERN as INFRA_HOST_OVERRIDE_WRITE_PATTERN,
|
|
} from "./infra-config.mjs";
|
|
|
|
const WORKFLOW_PATH = ".gitea/workflows/ci.yml";
|
|
const SENTRY_REUSABLE_WORKFLOW_PATH = ".gitea/workflows/_sentry-release.yml";
|
|
const REQUIRED_PNPM_VERSION = "10.33.0";
|
|
const WEB_SOURCEMAPS_ARTIFACT_NAME = "web-client-sourcemaps";
|
|
const WEB_SOURCEMAPS_PATH = "apps/web/build/client";
|
|
const WEB_SOURCEMAPS_VALIDATE_COMMAND = "test -n \"$(find apps/web/build/client -type f -name '*.map' -print -quit)\"";
|
|
const REQUIRED_COMMANDS_IN_ORDER = [
|
|
"pnpm run verify:github-ci-workflow",
|
|
"pnpm run verify:gitea-ci-workflow",
|
|
"pnpm run verify:deploy-workflow",
|
|
"pnpm run verify:deploy-readiness",
|
|
"pnpm run verify:ci-baseline",
|
|
"pnpm run verify:source-health",
|
|
"pnpm run verify:eslint-baseline",
|
|
"pnpm run verify:env-drift",
|
|
"pnpm run verify:health-baseline",
|
|
"pnpm run verify:api-inventory",
|
|
"pnpm run verify:tenant-isolation-report",
|
|
"pnpm run verify:sidebar-routes",
|
|
"pnpm run verify:i18n",
|
|
"pnpm run verify:tenant-auth-baseline",
|
|
"pnpm run verify:onboarding-flow",
|
|
"pnpm run verify:phase-c-boundaries",
|
|
"pnpm run verify:core-build-without-plugins-smoke",
|
|
"pnpm run verify:removed-modules",
|
|
"pnpm run verify:ui-visual",
|
|
"pnpm run test:hot-swap",
|
|
"pnpm run verify:a11y-coverage",
|
|
"pnpm run test:a11y",
|
|
"pnpm run verify:porting-docs-baseline",
|
|
"pnpm run verify:production-docs",
|
|
"pnpm run verify:release-docs",
|
|
"pnpm run verify:docs-links",
|
|
"pnpm typecheck",
|
|
"pnpm lint",
|
|
"pnpm run test:foundation",
|
|
"pnpm run test:packages",
|
|
"pnpm run test:mobile",
|
|
"pnpm test",
|
|
"pnpm run build:ci",
|
|
"pnpm run verify:bundle-size",
|
|
"pnpm run verify:production-seed-artifact",
|
|
];
|
|
const SERVICE_JOB_CONTRACTS = {
|
|
api: {
|
|
label: "api",
|
|
commands: [
|
|
"pnpm run verify:openapi-security",
|
|
"pnpm --filter @toolctrl/api typecheck",
|
|
"pnpm exec vitest run apps/api/src",
|
|
"pnpm --filter @toolctrl/api build",
|
|
],
|
|
},
|
|
worker: {
|
|
label: "worker",
|
|
commands: [
|
|
"pnpm --filter @toolctrl/worker typecheck",
|
|
"pnpm --filter @toolctrl/worker exec vitest run",
|
|
"pnpm run verify:workflow-outbox-native",
|
|
"pnpm --filter @toolctrl/worker build",
|
|
"pnpm --filter @toolctrl/worker health",
|
|
],
|
|
},
|
|
};
|
|
const DATABASE_JOB = "database";
|
|
const DATABASE_STATUS_COMMAND = "pnpm run verify:db-migrate-status:staging";
|
|
const DATABASE_GENERATE_COMMAND = "pnpm run db:generate";
|
|
const STAGING_SSH_HOST_VAR = "${{ vars.COOLIFY_STAGING_SSH_HOST }}";
|
|
const STAGING_SSH_USER_VAR = "${{ vars.COOLIFY_STAGING_SSH_USER }}";
|
|
const STAGING_WEB_RESOURCE_UUID_VAR = "${{ vars.COOLIFY_STAGING_WEB_RESOURCE_UUID }}";
|
|
const STAGING_SSH_KEY_SECRET = "${{ secrets.COOLIFY_STAGING_SSH_KEY }}";
|
|
const FORBIDDEN_DATABASE_MUTATION_PATTERN = /\b(?:prisma\s+migrate\s+deploy|migrate:deploy|db:deploy|db:push|prisma\s+db\s+push|seed)\b/i;
|
|
const DOCKER_SMOKE_JOB = "docker-smoke";
|
|
const DOCKER_SMOKE_NEEDS = ["quality", "api", "worker", "database"];
|
|
const DOCKER_SMOKE_TARGETS = ["web", "api", "worker"];
|
|
const DOCKER_WEB_TAG = dockerImageTag("web");
|
|
const DOCKER_API_TAG = dockerImageTag("api");
|
|
const DOCKER_WORKER_TAG = dockerImageTag("worker");
|
|
const DOCKER_WEB_ARTIFACT_COMMAND = `docker run --rm --entrypoint /bin/sh ${DOCKER_WEB_TAG} -lc 'test -f /myapp/apps/web/build/server/index.js && test -d /myapp/apps/web/build/client && test -f /myapp/build/server-runtime/server.js'`;
|
|
const DOCKER_WEB_RUNTIME_COMMAND = `bash scripts/docker-web-runtime-smoke.sh ${DOCKER_WEB_TAG}`;
|
|
const DOCKER_API_RUNTIME_COMMAND = `bash scripts/docker-api-runtime-smoke.sh ${DOCKER_API_TAG}`;
|
|
const DOCKER_WORKER_RUNTIME_COMMAND = `bash scripts/docker-worker-runtime-smoke.sh ${DOCKER_WORKER_TAG}`;
|
|
const DOCKER_SMOKE_REVISION_ARG_PATTERN = /(?:^|\s)--build-arg(?:=|\s+)APP_REVISION=ci-smoke-revision(?:\s|$)/;
|
|
const REQUIRED_RUNNER = CI_RUNNER_LABEL;
|
|
const FORBIDDEN_E2E_PATTERN = /\b(playwright|cypress|browser|test:e2e|e2e)\b/i;
|
|
const FORBIDDEN_DOCKER_PUBLISH_PATTERN = /\b(?:docker\s+(?:login|push)|docker\s+buildx\s+build[^\n]*--push|docker\s+build[^\n]*--push|publish)\b/i;
|
|
const FORBIDDEN_GITEA_HOST_OVERRIDE_PATTERN = /\bGITEA_HOST_IP\b|\bvars\.GITEA_HOST_IP\b/;
|
|
const HOST_OVERRIDE_WRITE_PATTERN = INFRA_HOST_OVERRIDE_WRITE_PATTERN;
|
|
const HOST_OVERRIDE_VALIDATION_PATTERN = INFRA_HOST_OVERRIDE_VALIDATION_PATTERN;
|
|
|
|
function readWorkflow(rootDir) {
|
|
return fs.readFileSync(path.join(rootDir, WORKFLOW_PATH), "utf8");
|
|
}
|
|
|
|
function readOptionalFile(rootDir, relativePath) {
|
|
const absolutePath = path.join(rootDir, relativePath);
|
|
if (!fs.existsSync(absolutePath)) {
|
|
return null;
|
|
}
|
|
return fs.readFileSync(absolutePath, "utf8");
|
|
}
|
|
|
|
function escapeRegExp(value) {
|
|
return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
|
|
}
|
|
|
|
function includesLineMatching(content, pattern) {
|
|
return content.split(/\r?\n/).some((line) => pattern.test(line));
|
|
}
|
|
|
|
function checkWorkflowExists(rootDir) {
|
|
return fs.existsSync(path.join(rootDir, WORKFLOW_PATH));
|
|
}
|
|
|
|
function getJobSection(content, jobName) {
|
|
const lines = content.split(/\r?\n/);
|
|
const jobStartPattern = new RegExp(`^ ${jobName}:\\s*$`);
|
|
const startIndex = lines.findIndex((line) => jobStartPattern.test(line));
|
|
|
|
if (startIndex === -1) {
|
|
return null;
|
|
}
|
|
|
|
const sectionLines = [lines[startIndex]];
|
|
for (let index = startIndex + 1; index < lines.length; index += 1) {
|
|
const line = lines[index];
|
|
if (/^ [A-Za-z0-9_-]+:\s*$/.test(line)) {
|
|
break;
|
|
}
|
|
sectionLines.push(line);
|
|
}
|
|
|
|
return sectionLines.join("\n");
|
|
}
|
|
|
|
function hasCheckoutStep(section) {
|
|
return /uses:\s*actions\/checkout@v\d+/.test(section);
|
|
}
|
|
|
|
function hasCorepackSetup(section) {
|
|
return /\bcorepack\s+enable\b/i.test(section);
|
|
}
|
|
|
|
function hasPinnedPnpm(section) {
|
|
return new RegExp(`\\bcorepack\\s+prepare\\s+pnpm@${REQUIRED_PNPM_VERSION.replaceAll(".", "\\.")}\\s+--activate\\b`).test(section);
|
|
}
|
|
|
|
function hasFrozenInstall(section) {
|
|
return /pnpm\s+install\s+--frozen-lockfile\b/.test(section);
|
|
}
|
|
|
|
function hasPnpmStoreSetup(section) {
|
|
return /pnpm\s+config\s+set\s+store-dir\b/.test(section) || /path:\s*\.pnpm-store\b/.test(section);
|
|
}
|
|
|
|
function checkWorkflowConcurrency(content) {
|
|
if (
|
|
/^concurrency:\s*$/m.test(content) &&
|
|
/^\s+group:\s*\$\{\{\s*github\.workflow\s*\}\}-\$\{\{\s*github\.event\.pull_request\.number\s*\|\|\s*github\.ref\s*\}\}\s*$/m.test(content) &&
|
|
/^\s+cancel-in-progress:\s*true\s*$/m.test(content)
|
|
) {
|
|
return { passes: [`${WORKFLOW_PATH}: CI concurrency cancels superseded pull request and branch runs`], failures: [], observations: [] };
|
|
}
|
|
return {
|
|
passes: [],
|
|
failures: [`${WORKFLOW_PATH}: CI workflow must define concurrency by workflow plus PR/ref with cancel-in-progress: true`],
|
|
observations: [],
|
|
};
|
|
}
|
|
|
|
function hasNeedsQuality(section) {
|
|
return getNeedsValues(section).includes("quality");
|
|
}
|
|
|
|
function getNeedsValues(section) {
|
|
const inlineNeeds = section.match(/^ needs:\s*\[([^\]]+)\]\s*$/m);
|
|
if (inlineNeeds) {
|
|
return inlineNeeds[1]
|
|
.split(",")
|
|
.map((value) => value.trim().replace(/^['\"]|['\"]$/g, ""))
|
|
.filter(Boolean);
|
|
}
|
|
|
|
const singleNeeds = section.match(/^ needs:\s*([A-Za-z0-9_-]+)\s*$/m);
|
|
if (singleNeeds) {
|
|
return [singleNeeds[1]];
|
|
}
|
|
|
|
const blockNeeds = section.match(/^ needs:\s*\n((?: -\s*[^\n]+\n?)+)/m);
|
|
if (blockNeeds) {
|
|
return blockNeeds[1]
|
|
.split(/\r?\n/)
|
|
.map((line) => line.match(/^ -\s*([^\s#]+)/)?.[1]?.replace(/^['\"]|['\"]$/g, ""))
|
|
.filter(Boolean);
|
|
}
|
|
|
|
return [];
|
|
}
|
|
|
|
function hasDockerBuildxSetup(section) {
|
|
return /uses:\s*docker\/setup-buildx-action@v\d+/.test(section);
|
|
}
|
|
|
|
function getRunCommands(section) {
|
|
const lines = section.split(/\r?\n/);
|
|
const commands = [];
|
|
|
|
for (let index = 0; index < lines.length; index += 1) {
|
|
const runMatch = lines[index].match(/^(\s*)run:\s*(.*)$/);
|
|
if (!runMatch) {
|
|
continue;
|
|
}
|
|
|
|
const runIndent = runMatch[1].length;
|
|
const value = runMatch[2].trim();
|
|
const lineNumber = index + 1;
|
|
|
|
if (/^[|>][+-]?$/.test(value)) {
|
|
const blockLines = [];
|
|
for (let blockIndex = index + 1; blockIndex < lines.length; blockIndex += 1) {
|
|
const blockLine = lines[blockIndex];
|
|
const blockIndent = blockLine.match(/^(\s*)/)?.[1].length ?? 0;
|
|
|
|
if (blockLine.trim() !== "" && blockIndent <= runIndent) {
|
|
break;
|
|
}
|
|
|
|
blockLines.push(blockLine.trim());
|
|
index = blockIndex;
|
|
}
|
|
|
|
commands.push({ lineNumber, command: blockLines.join("\n") });
|
|
continue;
|
|
}
|
|
|
|
commands.push({ lineNumber, command: value });
|
|
}
|
|
|
|
return commands;
|
|
}
|
|
|
|
function stripExecutableShellLine(line) {
|
|
return line.replace(/\s+#.*$/, "").trim();
|
|
}
|
|
|
|
function getExecutableRunCommandEntries(section) {
|
|
return getRunCommands(section).flatMap(({ lineNumber, command }) =>
|
|
command
|
|
.split(/\r?\n/)
|
|
.map((line, offset) => ({ lineNumber: lineNumber + offset, command: stripExecutableShellLine(line) }))
|
|
.filter(({ command }) => command.length > 0 && !command.startsWith("#")),
|
|
);
|
|
}
|
|
|
|
function getExecutableRunCommandBlocks(section) {
|
|
return getRunCommands(section)
|
|
.map(({ command }) =>
|
|
command
|
|
.split(/\r?\n/)
|
|
.map((line) => stripExecutableShellLine(line))
|
|
.filter((line) => line.length > 0 && !line.startsWith("#"))
|
|
.join("\n"),
|
|
)
|
|
.filter(Boolean);
|
|
}
|
|
|
|
function getAllStepBlocks(section) {
|
|
const lines = section.split(/\r?\n/);
|
|
const steps = [];
|
|
|
|
for (let index = 0; index < lines.length; index += 1) {
|
|
const stepMatch = lines[index].match(/^(\s*)-\s+/);
|
|
if (!stepMatch) {
|
|
continue;
|
|
}
|
|
|
|
const stepIndent = stepMatch[1].length;
|
|
const stepLines = [lines[index]];
|
|
for (let inner = index + 1; inner < lines.length; inner += 1) {
|
|
const candidate = lines[inner];
|
|
const indent = candidate.match(/^(\s*)/)?.[1].length ?? 0;
|
|
if (candidate.trim().length > 0 && indent <= stepIndent && /^\s*-\s+/.test(candidate)) {
|
|
break;
|
|
}
|
|
stepLines.push(candidate);
|
|
index = inner;
|
|
}
|
|
|
|
const text = stepLines.join("\n");
|
|
steps.push(text);
|
|
}
|
|
|
|
return steps;
|
|
}
|
|
|
|
function getStepBlocks(section) {
|
|
return getAllStepBlocks(section).filter((step) => /^\s*run:\s*/m.test(step));
|
|
}
|
|
|
|
function getRunTextFromStep(step) {
|
|
const lines = step.split(/\r?\n/);
|
|
|
|
for (let index = 0; index < lines.length; index += 1) {
|
|
const runMatch = lines[index].match(/^(\s*)run:\s*(.*)$/);
|
|
if (!runMatch) {
|
|
continue;
|
|
}
|
|
|
|
const runIndent = runMatch[1].length;
|
|
const value = runMatch[2].trim();
|
|
if (!/^[|>][+-]?$/.test(value)) {
|
|
return value;
|
|
}
|
|
|
|
const commandLines = [];
|
|
for (let inner = index + 1; inner < lines.length; inner += 1) {
|
|
const candidate = lines[inner];
|
|
const indent = candidate.match(/^(\s*)/)?.[1].length ?? 0;
|
|
if (candidate.trim().length > 0 && indent <= runIndent) {
|
|
break;
|
|
}
|
|
commandLines.push(candidate);
|
|
}
|
|
return commandLines.join("\n");
|
|
}
|
|
|
|
return "";
|
|
}
|
|
|
|
function getExecutableShellLines(runText) {
|
|
return runText
|
|
.split(/\r?\n/)
|
|
.map((line) => stripExecutableShellLine(line))
|
|
.filter(Boolean);
|
|
}
|
|
|
|
function getStepForRunCommand(section, predicate) {
|
|
return (
|
|
getStepBlocks(section).find((step) => {
|
|
const lines = getExecutableShellLines(getRunTextFromStep(step));
|
|
const block = lines.join("\n");
|
|
return lines.some((line) => predicate(line)) || predicate(block);
|
|
}) ?? ""
|
|
);
|
|
}
|
|
|
|
function hasUploadSourcemapsArtifactStep(section) {
|
|
return getAllStepBlocks(section).some(
|
|
(step) =>
|
|
/uses:\s*actions\/upload-artifact@v4/i.test(step) &&
|
|
new RegExp(`^\\s*name:\\s*${escapeRegExp(WEB_SOURCEMAPS_ARTIFACT_NAME)}\\s*$`, "m").test(step) &&
|
|
new RegExp(`^\\s*path:\\s*${escapeRegExp(WEB_SOURCEMAPS_PATH)}\\s*$`, "m").test(step) &&
|
|
/^\s*if-no-files-found:\s*error\s*$/m.test(step) &&
|
|
/^\s*retention-days:\s*7\s*$/m.test(step),
|
|
);
|
|
}
|
|
|
|
function hasReusableSourcemapsArtifactContract(content) {
|
|
return (
|
|
/^\s+sourcemaps-artifact:\s*$/m.test(content) &&
|
|
/uses:\s*actions\/download-artifact@v4/i.test(content) &&
|
|
/^\s*if:\s*\$\{\{\s*inputs\.sourcemaps-artifact\s*!=\s*'none'\s*\}\}\s*$/m.test(content) &&
|
|
/^\s*name:\s*\$\{\{\s*inputs\.sourcemaps-artifact\s*\}\}\s*$/m.test(content) &&
|
|
/^\s*path:\s*\$\{\{\s*inputs\.sourcemaps-path\s*\}\}\s*$/m.test(content)
|
|
);
|
|
}
|
|
|
|
function matchesExecutableCommand(executableCommand, expectedCommand) {
|
|
return executableCommand === expectedCommand;
|
|
}
|
|
|
|
function countExecutableCommandOccurrences(section, expectedCommand) {
|
|
return getExecutableRunCommandEntries(section).filter(({ command }) => command === expectedCommand).length;
|
|
}
|
|
|
|
function hasDockerTargetBuild(section, target) {
|
|
return getExecutableRunCommandEntries(section).some(
|
|
({ command }) => /\bdocker\s+(?:buildx\s+build|build)\b/.test(command) && new RegExp(`(?:^|\\s)--target(?:=|\\s+)${target}(?:\\s|$)`).test(command),
|
|
);
|
|
}
|
|
|
|
function getDockerTargetBuild(section, target) {
|
|
return getExecutableRunCommandEntries(section).find(
|
|
({ command }) => /\bdocker\s+(?:buildx\s+build|build)\b/.test(command) && new RegExp(`(?:^|\\s)--target(?:=|\\s+)${target}(?:\\s|$)`).test(command),
|
|
)?.command;
|
|
}
|
|
|
|
function hasDockerComposeConfig(section) {
|
|
return getExecutableRunCommandEntries(section).some(({ command }) => /\bdocker\s+compose\s+config\b/.test(command));
|
|
}
|
|
|
|
function hasWebDockerArtifactValidation(section) {
|
|
return getExecutableRunCommandEntries(section).some(({ command }) => command === DOCKER_WEB_ARTIFACT_COMMAND);
|
|
}
|
|
|
|
function hasWebDockerRuntimeValidation(section) {
|
|
return getExecutableRunCommandEntries(section).some(({ command }) => command === DOCKER_WEB_RUNTIME_COMMAND);
|
|
}
|
|
|
|
function hasApiDockerRuntimeValidation(section) {
|
|
return getExecutableRunCommandEntries(section).some(({ command }) => command === DOCKER_API_RUNTIME_COMMAND);
|
|
}
|
|
|
|
function hasWorkerDockerRuntimeValidation(section) {
|
|
return getExecutableRunCommandEntries(section).some(({ command }) => command === DOCKER_WORKER_RUNTIME_COMMAND);
|
|
}
|
|
|
|
function hasParallelDockerTargetBuilds(section) {
|
|
return getRunCommands(section).some(({ command }) => {
|
|
const hasEveryTarget = DOCKER_SMOKE_TARGETS.every((target) =>
|
|
new RegExp(`\\bdocker\\s+(?:buildx\\s+build|build)\\b[^\\n]*--target(?:=|\\s+)${target}(?:\\s|$)[^\\n]*&`, "u").test(command),
|
|
);
|
|
const capturesEveryPid = DOCKER_SMOKE_TARGETS.every((target) => new RegExp(`\\b${target}_pid=\\$!`, "u").test(command));
|
|
const waitsForEveryPid = DOCKER_SMOKE_TARGETS.every((target) => new RegExp(`\\bwait\\s+"\\$${target}_pid"`, "u").test(command));
|
|
|
|
return hasEveryTarget && capturesEveryPid && waitsForEveryPid;
|
|
});
|
|
}
|
|
|
|
function includesCommand(section, command) {
|
|
return getExecutableRunCommandEntries(section).some(({ command: executableCommand }) => matchesExecutableCommand(executableCommand, command));
|
|
}
|
|
|
|
function getRequiredStepSofteningReason(step) {
|
|
if (!step) {
|
|
return "";
|
|
}
|
|
|
|
if (/^\s*continue-on-error:\s*true\s*$/im.test(step) || /^\s*if:\s*(?:always\(\)|\$\{\{\s*always\(\)\s*\}\})\s*$/im.test(step)) {
|
|
return "continue-on-error or always()";
|
|
}
|
|
|
|
const lines = getExecutableShellLines(getRunTextFromStep(step));
|
|
const block = lines.join("\n");
|
|
const lastLine = lines.at(-1) ?? "";
|
|
if (/\bset\s+(?:\+e|\+o\s+errexit)\b/.test(block)) {
|
|
return "shell success masking";
|
|
}
|
|
if (/(^|[^|])\|\|\s*(?:true|:|exit\s+0)(?:\s|$)/.test(block)) {
|
|
return "shell success masking";
|
|
}
|
|
if (/;\s*(?:true|:|exit\s+0)\s*$/.test(lastLine)) {
|
|
return "shell success masking";
|
|
}
|
|
if (/^(?:true|:|exit\s+0)$/.test(lastLine)) {
|
|
return "shell success masking";
|
|
}
|
|
|
|
return "";
|
|
}
|
|
|
|
function getRequiredCommandSofteningReason(section, command) {
|
|
const step = getStepForRunCommand(section, (line) => line.includes(command));
|
|
return getRequiredStepSofteningReason(step);
|
|
}
|
|
|
|
function getRunCommandLines(section) {
|
|
return getExecutableRunCommandBlocks(section).map((command) => `run: ${command}`);
|
|
}
|
|
|
|
function hasStepLevelEnvValue(section, command, envName, envValue) {
|
|
const lines = section.split(/\r?\n/);
|
|
const commandIndex = lines.findIndex((line) => /^\s*run:\s*/.test(line) && line.includes(command));
|
|
|
|
if (commandIndex === -1) {
|
|
return false;
|
|
}
|
|
|
|
const commandIndent = lines[commandIndex].match(/^(\s*)/)?.[1].length ?? 0;
|
|
const stepIndent = Math.max(commandIndent - 2, 0);
|
|
let nextStepIndex = lines.length;
|
|
|
|
for (let index = commandIndex + 1; index < lines.length; index += 1) {
|
|
const line = lines[index];
|
|
if (new RegExp(`^\\s{${stepIndent}}-\\s+`).test(line)) {
|
|
nextStepIndex = index;
|
|
break;
|
|
}
|
|
}
|
|
|
|
const stepRemainder = lines.slice(commandIndex + 1, nextStepIndex).join("\n");
|
|
const escapedEnvValue = envValue.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
|
|
return new RegExp(`^\\s*${envName}:\\s*${escapedEnvValue}\\s*$`, "m").test(stepRemainder);
|
|
}
|
|
|
|
function hasJobLevelEnvValue(section, envName) {
|
|
const firstStepIndex = section.search(/^ steps:\s*$/m);
|
|
const beforeSteps = firstStepIndex === -1 ? section : section.slice(0, firstStepIndex);
|
|
return new RegExp(`^\\s*${envName}:\\s*`, "m").test(beforeSteps);
|
|
}
|
|
|
|
export function checkWorkflowTriggers(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
|
|
if (includesLineMatching(content, /^\s*push\s*:/m)) {
|
|
failures.push(`${WORKFLOW_PATH}: trigger "push" is forbidden; main pushes are reserved for the deploy workflow`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: trigger "push" is disabled so deploy is not queued behind CI on main`);
|
|
}
|
|
|
|
if (includesLineMatching(content, /^\s*pull_request\s*:/m)) {
|
|
passes.push(`${WORKFLOW_PATH}: trigger "pull_request" is defined`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: missing required trigger "pull_request"`);
|
|
}
|
|
|
|
if (includesLineMatching(content, /^\s*workflow_dispatch\s*:/m)) {
|
|
passes.push(`${WORKFLOW_PATH}: trigger "workflow_dispatch" is defined`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: missing required trigger "workflow_dispatch" for manual CI runs`);
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkPnpmSetup(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
const qualitySection = getJobSection(content, "quality");
|
|
|
|
if (!qualitySection) {
|
|
failures.push(`${WORKFLOW_PATH}: missing required quality job "quality"`);
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
if (hasCorepackSetup(qualitySection)) {
|
|
passes.push(`${WORKFLOW_PATH}: Corepack setup is present`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: missing Corepack setup`);
|
|
}
|
|
|
|
if (hasPinnedPnpm(qualitySection)) {
|
|
passes.push(`${WORKFLOW_PATH}: pnpm@${REQUIRED_PNPM_VERSION} is pinned`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: pnpm must be pinned to pnpm@${REQUIRED_PNPM_VERSION}`);
|
|
}
|
|
|
|
if (hasFrozenInstall(qualitySection)) {
|
|
passes.push(`${WORKFLOW_PATH}: command "pnpm install --frozen-lockfile" is present`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: missing required command "pnpm install --frozen-lockfile"`);
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkOrderedQualityGates(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
const qualitySection = getJobSection(content, "quality") ?? content;
|
|
const executableCommands = getExecutableRunCommandEntries(qualitySection);
|
|
let previousIndex = -1;
|
|
|
|
for (const command of REQUIRED_COMMANDS_IN_ORDER) {
|
|
const commandIndex = executableCommands.findIndex((entry) => matchesExecutableCommand(entry.command, command));
|
|
const commandOccurrences = countExecutableCommandOccurrences(qualitySection, command);
|
|
const softeningReason = getRequiredCommandSofteningReason(qualitySection, command);
|
|
|
|
if (commandIndex === -1) {
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: command "${command}" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: missing required command "${command}"`);
|
|
}
|
|
continue;
|
|
}
|
|
|
|
if (commandOccurrences > 1) {
|
|
failures.push(`${WORKFLOW_PATH}: command "${command}" must run exactly once to avoid redundant CI gates`);
|
|
continue;
|
|
}
|
|
|
|
if (commandIndex < previousIndex) {
|
|
failures.push(`${WORKFLOW_PATH}: command "${command}" must run after previous quality gates`);
|
|
continue;
|
|
}
|
|
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: command "${command}" must not use ${softeningReason}`);
|
|
continue;
|
|
}
|
|
|
|
passes.push(`${WORKFLOW_PATH}: command "${command}" is ordered`);
|
|
previousIndex = commandIndex;
|
|
}
|
|
|
|
const sourcemapsValidationStep = getStepForRunCommand(qualitySection, (line) => line === WEB_SOURCEMAPS_VALIDATE_COMMAND);
|
|
if (sourcemapsValidationStep) {
|
|
const softeningReason = getRequiredStepSofteningReason(sourcemapsValidationStep);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: web source-map validation must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: web source-map files are validated before Sentry artifact upload`);
|
|
}
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: missing web source-map validation before Sentry artifact upload`);
|
|
}
|
|
|
|
if (hasUploadSourcemapsArtifactStep(qualitySection)) {
|
|
passes.push(`${WORKFLOW_PATH}: web source maps are uploaded as artifact "${WEB_SOURCEMAPS_ARTIFACT_NAME}"`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: must upload ${WEB_SOURCEMAPS_PATH} as artifact "${WEB_SOURCEMAPS_ARTIFACT_NAME}" with if-no-files-found: error`);
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkSentrySourcemapWorkflow(rootDir, content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
const sentryReusableContent = readOptionalFile(rootDir, SENTRY_REUSABLE_WORKFLOW_PATH);
|
|
|
|
if (!sentryReusableContent) {
|
|
failures.push(`${SENTRY_REUSABLE_WORKFLOW_PATH}: missing reusable Sentry release workflow`);
|
|
} else if (hasReusableSourcemapsArtifactContract(sentryReusableContent)) {
|
|
passes.push(`${SENTRY_REUSABLE_WORKFLOW_PATH}: reusable workflow downloads requested source-map artifacts before upload`);
|
|
} else {
|
|
failures.push(`${SENTRY_REUSABLE_WORKFLOW_PATH}: reusable workflow must accept sourcemaps-artifact and download it to inputs.sourcemaps-path`);
|
|
}
|
|
|
|
const sentryWebSection = getJobSection(content, "sentry-release-web");
|
|
if (!sentryWebSection) {
|
|
failures.push(`${WORKFLOW_PATH}: missing Sentry web release job "sentry-release-web"`);
|
|
} else if (
|
|
new RegExp(`^\\s*sourcemaps-path:\\s*${escapeRegExp(WEB_SOURCEMAPS_PATH)}\\s*$`, "m").test(sentryWebSection) &&
|
|
new RegExp(`^\\s*sourcemaps-artifact:\\s*${escapeRegExp(WEB_SOURCEMAPS_ARTIFACT_NAME)}\\s*$`, "m").test(sentryWebSection)
|
|
) {
|
|
passes.push(`${WORKFLOW_PATH}: Sentry web release consumes artifact "${WEB_SOURCEMAPS_ARTIFACT_NAME}"`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Sentry web release must pass sourcemaps-path ${WEB_SOURCEMAPS_PATH} and sourcemaps-artifact ${WEB_SOURCEMAPS_ARTIFACT_NAME}`);
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkServiceJobs(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
|
|
for (const [jobName, contract] of Object.entries(SERVICE_JOB_CONTRACTS)) {
|
|
const section = getJobSection(content, jobName);
|
|
|
|
if (!section) {
|
|
failures.push(`${WORKFLOW_PATH}: missing required service job "${jobName}"`);
|
|
continue;
|
|
}
|
|
|
|
passes.push(`${WORKFLOW_PATH}: service job "${jobName}" is defined`);
|
|
|
|
if (hasNeedsQuality(section)) {
|
|
failures.push(`${WORKFLOW_PATH}: service job "${jobName}" must not wait for "quality"; scoped service checks should run in parallel`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: service job "${jobName}" runs independently of "quality"`);
|
|
}
|
|
|
|
if (hasCheckoutStep(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: service job "${jobName}" checks out the repository`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: service job "${jobName}" missing checkout step`);
|
|
}
|
|
|
|
if (hasCorepackSetup(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: service job "${jobName}" enables Corepack`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: service job "${jobName}" missing Corepack setup`);
|
|
}
|
|
|
|
if (hasPinnedPnpm(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: service job "${jobName}" pins pnpm@${REQUIRED_PNPM_VERSION}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: service job "${jobName}" must pin pnpm@${REQUIRED_PNPM_VERSION}`);
|
|
}
|
|
|
|
if (hasFrozenInstall(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: service job "${jobName}" installs with frozen lockfile`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: service job "${jobName}" missing command "pnpm install --frozen-lockfile"`);
|
|
}
|
|
|
|
for (const command of contract.commands) {
|
|
if (includesCommand(section, command)) {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, command);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: service job "${jobName}" command "${command}" must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: service job "${jobName}" includes scoped command "${command}"`);
|
|
}
|
|
} else {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, command);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: service job "${jobName}" command "${command}" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: service job "${jobName}" missing scoped command "${command}"`);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkDatabaseJob(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
const section = getJobSection(content, DATABASE_JOB);
|
|
|
|
if (!section) {
|
|
return {
|
|
passes,
|
|
failures: [`${WORKFLOW_PATH}: missing required database job "${DATABASE_JOB}"`],
|
|
observations: [],
|
|
};
|
|
}
|
|
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" is defined`);
|
|
|
|
if (hasNeedsQuality(section)) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" must not wait for "quality"; database verification should run in parallel`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" runs independently of "quality"`);
|
|
}
|
|
|
|
if (hasCheckoutStep(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" checks out the repository`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" missing checkout step`);
|
|
}
|
|
|
|
if (hasCorepackSetup(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" enables Corepack`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" missing Corepack setup`);
|
|
}
|
|
|
|
if (hasPinnedPnpm(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" pins pnpm@${REQUIRED_PNPM_VERSION}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" must pin pnpm@${REQUIRED_PNPM_VERSION}`);
|
|
}
|
|
|
|
if (hasFrozenInstall(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" installs with frozen lockfile`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" missing command "pnpm install --frozen-lockfile"`);
|
|
}
|
|
|
|
if (includesCommand(section, DATABASE_GENERATE_COMMAND)) {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DATABASE_GENERATE_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" command "${DATABASE_GENERATE_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" includes command "${DATABASE_GENERATE_COMMAND}"`);
|
|
}
|
|
} else {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DATABASE_GENERATE_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" command "${DATABASE_GENERATE_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" missing command "${DATABASE_GENERATE_COMMAND}"`);
|
|
}
|
|
}
|
|
|
|
if (includesCommand(section, DATABASE_STATUS_COMMAND)) {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DATABASE_STATUS_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" command "${DATABASE_STATUS_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" includes command "${DATABASE_STATUS_COMMAND}"`);
|
|
}
|
|
} else {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DATABASE_STATUS_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" command "${DATABASE_STATUS_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" missing command "${DATABASE_STATUS_COMMAND}"`);
|
|
}
|
|
}
|
|
|
|
if (hasStepLevelEnvValue(section, DATABASE_STATUS_COMMAND, "COOLIFY_STAGING_SSH_HOST", STAGING_SSH_HOST_VAR)) {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" scopes staging SSH host to the migrate-status step`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" must set COOLIFY_STAGING_SSH_HOST: \${{ vars.COOLIFY_STAGING_SSH_HOST }} on the migrate-status step`);
|
|
}
|
|
|
|
if (hasStepLevelEnvValue(section, DATABASE_STATUS_COMMAND, "COOLIFY_STAGING_SSH_USER", STAGING_SSH_USER_VAR)) {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" scopes staging SSH user to the migrate-status step`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" must set COOLIFY_STAGING_SSH_USER: \${{ vars.COOLIFY_STAGING_SSH_USER }} on the migrate-status step`);
|
|
}
|
|
|
|
if (hasStepLevelEnvValue(section, DATABASE_STATUS_COMMAND, "COOLIFY_STAGING_WEB_RESOURCE_UUID", STAGING_WEB_RESOURCE_UUID_VAR)) {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" scopes staging web resource UUID to the migrate-status step`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" must set COOLIFY_STAGING_WEB_RESOURCE_UUID: \${{ vars.COOLIFY_STAGING_WEB_RESOURCE_UUID }} on the migrate-status step`);
|
|
}
|
|
|
|
if (hasStepLevelEnvValue(section, DATABASE_STATUS_COMMAND, "COOLIFY_STAGING_SSH_KEY", STAGING_SSH_KEY_SECRET)) {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" scopes staging SSH key to the migrate-status step`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" must set COOLIFY_STAGING_SSH_KEY: \${{ secrets.COOLIFY_STAGING_SSH_KEY }} on the migrate-status step`);
|
|
}
|
|
|
|
if (section.includes("secrets.DATABASE_URL")) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" must not require direct DATABASE_URL access to private Coolify databases`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" verifies private Coolify databases without exposing DATABASE_URL`);
|
|
}
|
|
|
|
if (hasJobLevelEnvValue(section, "DATABASE_URL")) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" must not set DATABASE_URL at job scope`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" does not expose DATABASE_URL at job scope`);
|
|
}
|
|
|
|
const forbiddenMutationLine = getRunCommandLines(section).find((line) => FORBIDDEN_DATABASE_MUTATION_PATTERN.test(line));
|
|
if (forbiddenMutationLine) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" contains forbidden deploy/seed/schema mutation command: ${forbiddenMutationLine.trim()}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" contains no deploy/seed/schema mutation commands`);
|
|
}
|
|
|
|
const forbiddenE2eLine = getRunCommandLines(section).find((line) => FORBIDDEN_E2E_PATTERN.test(line));
|
|
if (forbiddenE2eLine) {
|
|
failures.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" contains forbidden E2E/browser command: ${forbiddenE2eLine.trim()}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: database job "${DATABASE_JOB}" contains no E2E/browser commands`);
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkDockerSmokeJob(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
const section = getJobSection(content, DOCKER_SMOKE_JOB);
|
|
|
|
if (!section) {
|
|
return {
|
|
passes,
|
|
failures: [`${WORKFLOW_PATH}: missing required Docker smoke job "${DOCKER_SMOKE_JOB}"`],
|
|
observations: [],
|
|
};
|
|
}
|
|
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" is defined`);
|
|
|
|
const needs = getNeedsValues(section);
|
|
for (const requiredNeed of DOCKER_SMOKE_NEEDS) {
|
|
if (needs.includes(requiredNeed)) {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" needs "${requiredNeed}"`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" must declare needs including "${requiredNeed}"`);
|
|
}
|
|
}
|
|
|
|
if (hasCheckoutStep(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" checks out the repository`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" missing checkout step`);
|
|
}
|
|
|
|
if (hasCorepackSetup(section)) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" must not run Corepack setup`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" does not run Corepack setup`);
|
|
}
|
|
|
|
if (hasPinnedPnpm(section)) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" must not run "corepack prepare pnpm@${REQUIRED_PNPM_VERSION}"`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" does not run "corepack prepare pnpm@${REQUIRED_PNPM_VERSION}"`);
|
|
}
|
|
|
|
if (hasPnpmStoreSetup(section)) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" must not configure or cache the pnpm store`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" does not configure or cache the pnpm store`);
|
|
}
|
|
|
|
if (hasFrozenInstall(section)) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" must not run "pnpm install --frozen-lockfile"`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" does not run "pnpm install --frozen-lockfile"`);
|
|
}
|
|
|
|
if (hasDockerBuildxSetup(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" sets up Docker Buildx`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" missing Docker Buildx setup`);
|
|
}
|
|
|
|
for (const target of DOCKER_SMOKE_TARGETS) {
|
|
if (hasDockerTargetBuild(section, target)) {
|
|
const targetBuild = getDockerTargetBuild(section, target) ?? "";
|
|
const targetBuildPattern = (line) => /\bdocker\s+(?:buildx\s+build|build)\b/.test(line) && new RegExp(`(?:^|\\s)--target(?:=|\\s+)${target}(?:\\s|$)`).test(line);
|
|
const softeningReason = getRequiredStepSofteningReason(getStepForRunCommand(section, targetBuildPattern));
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" build for target "${target}" must not use ${softeningReason}`);
|
|
} else if (!DOCKER_SMOKE_REVISION_ARG_PATTERN.test(targetBuild)) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" build for target "${target}" must pass --build-arg APP_REVISION=ci-smoke-revision`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" builds Docker target "${target}"`);
|
|
}
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" missing Docker build for target "${target}"`);
|
|
}
|
|
}
|
|
|
|
if (hasParallelDockerTargetBuilds(section)) {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" builds Docker targets in parallel`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" must build web, api, and worker Docker targets in one parallel bash step`);
|
|
}
|
|
|
|
if (hasDockerComposeConfig(section)) {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, "docker compose config");
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "docker compose config" must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" validates Docker Compose config`);
|
|
}
|
|
} else {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, "docker compose config");
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "docker compose config" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" missing command "docker compose config"`);
|
|
}
|
|
}
|
|
|
|
if (hasWebDockerArtifactValidation(section)) {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DOCKER_WEB_ARTIFACT_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "${DOCKER_WEB_ARTIFACT_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" validates web Docker artifacts`);
|
|
}
|
|
} else {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DOCKER_WEB_ARTIFACT_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "${DOCKER_WEB_ARTIFACT_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" missing command "${DOCKER_WEB_ARTIFACT_COMMAND}"`);
|
|
}
|
|
}
|
|
|
|
if (hasWebDockerRuntimeValidation(section)) {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DOCKER_WEB_RUNTIME_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "${DOCKER_WEB_RUNTIME_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" validates web Docker runtime`);
|
|
}
|
|
} else {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DOCKER_WEB_RUNTIME_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "${DOCKER_WEB_RUNTIME_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" missing command "${DOCKER_WEB_RUNTIME_COMMAND}"`);
|
|
}
|
|
}
|
|
|
|
if (hasApiDockerRuntimeValidation(section)) {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DOCKER_API_RUNTIME_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "${DOCKER_API_RUNTIME_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" validates API Docker runtime`);
|
|
}
|
|
} else {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DOCKER_API_RUNTIME_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "${DOCKER_API_RUNTIME_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" missing command "${DOCKER_API_RUNTIME_COMMAND}"`);
|
|
}
|
|
}
|
|
|
|
if (hasWorkerDockerRuntimeValidation(section)) {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DOCKER_WORKER_RUNTIME_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "${DOCKER_WORKER_RUNTIME_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" validates worker Docker runtime`);
|
|
}
|
|
} else {
|
|
const softeningReason = getRequiredCommandSofteningReason(section, DOCKER_WORKER_RUNTIME_COMMAND);
|
|
if (softeningReason) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" command "${DOCKER_WORKER_RUNTIME_COMMAND}" must not use ${softeningReason}`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" missing command "${DOCKER_WORKER_RUNTIME_COMMAND}"`);
|
|
}
|
|
}
|
|
|
|
const forbiddenLine = getRunCommandLines(section).find((line) => FORBIDDEN_DOCKER_PUBLISH_PATTERN.test(line));
|
|
if (forbiddenLine) {
|
|
failures.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" contains forbidden publish command: ${forbiddenLine.trim()}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: Docker smoke job "${DOCKER_SMOKE_JOB}" contains no registry login/push/publish commands`);
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkWorkflowRunners(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
const runnerLines = content
|
|
.split(/\r?\n/)
|
|
.map((line, index) => ({ line, lineNumber: index + 1 }))
|
|
.filter(({ line }) => /^\s*runs-on:\s*/.test(line));
|
|
|
|
if (runnerLines.length === 0) {
|
|
failures.push(`${WORKFLOW_PATH}: missing required runs-on declarations`);
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
for (const { line, lineNumber } of runnerLines) {
|
|
const runner = line.replace(/^\s*runs-on:\s*/, "").trim().replace(/^['\"]|['\"]$/g, "");
|
|
if (runner === REQUIRED_RUNNER) {
|
|
passes.push(`${WORKFLOW_PATH}:${lineNumber}: runner is "${REQUIRED_RUNNER}"`);
|
|
} else {
|
|
failures.push(`${WORKFLOW_PATH}:${lineNumber}: runs-on must be "${REQUIRED_RUNNER}" but found "${runner}"`);
|
|
}
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkForbiddenE2eCommands(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
const forbiddenLine = getRunCommandLines(content).find((line) => FORBIDDEN_E2E_PATTERN.test(line));
|
|
|
|
if (forbiddenLine) {
|
|
failures.push(`${WORKFLOW_PATH}: forbidden E2E/browser command found: ${forbiddenLine.trim()}`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: no forbidden E2E/browser commands are present`);
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function checkGiteaVariableNames(content) {
|
|
const passes = [];
|
|
const failures = [];
|
|
|
|
if (FORBIDDEN_GITEA_HOST_OVERRIDE_PATTERN.test(content)) {
|
|
failures.push(`${WORKFLOW_PATH}: GITEA_HOST_IP is forbidden because Gitea reserves the GITEA_ variable prefix; use TOOLCTRL_GITEA_HOST_IP`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: internal host override avoids the reserved GITEA_ variable prefix`);
|
|
}
|
|
|
|
const hostWrites = [...content.matchAll(HOST_OVERRIDE_WRITE_PATTERN)].length;
|
|
const validations = [...content.matchAll(HOST_OVERRIDE_VALIDATION_PATTERN)].length;
|
|
if (hostWrites > validations) {
|
|
failures.push(`${WORKFLOW_PATH}: TOOLCTRL_GITEA_HOST_IP must be validated before writing to /etc/hosts`);
|
|
} else {
|
|
passes.push(`${WORKFLOW_PATH}: internal host override validates TOOLCTRL_GITEA_HOST_IP before /etc/hosts writes`);
|
|
}
|
|
|
|
return { passes, failures, observations: [] };
|
|
}
|
|
|
|
export function verifyGiteaCiWorkflow(rootDir = process.cwd()) {
|
|
if (!checkWorkflowExists(rootDir)) {
|
|
return { passes: [], failures: [`${WORKFLOW_PATH}: missing required Gitea CI workflow file`], observations: [] };
|
|
}
|
|
|
|
let content;
|
|
try {
|
|
content = readWorkflow(rootDir);
|
|
} catch (error) {
|
|
return { passes: [], failures: [`${WORKFLOW_PATH}: failed to read workflow: ${error.message}`], observations: [] };
|
|
}
|
|
|
|
const checks = [
|
|
checkWorkflowTriggers(content),
|
|
checkWorkflowConcurrency(content),
|
|
checkPnpmSetup(content),
|
|
checkWorkflowRunners(content),
|
|
checkOrderedQualityGates(content),
|
|
checkServiceJobs(content),
|
|
checkDatabaseJob(content),
|
|
checkDockerSmokeJob(content),
|
|
checkSentrySourcemapWorkflow(rootDir, content),
|
|
checkForbiddenE2eCommands(content),
|
|
checkGiteaVariableNames(content),
|
|
];
|
|
|
|
return checks.reduce(
|
|
(result, check) => ({
|
|
passes: [...result.passes, ...check.passes],
|
|
failures: [...result.failures, ...check.failures],
|
|
observations: [...result.observations, ...check.observations],
|
|
}),
|
|
{ passes: [], failures: [], observations: [] },
|
|
);
|
|
}
|
|
|
|
export function formatGiteaCiWorkflowResult(result) {
|
|
const status = result.failures.length > 0 ? "FAIL" : "PASS";
|
|
return [
|
|
`${status} Gitea CI workflow verification`,
|
|
...result.passes.map((pass) => `PASS ${pass}`),
|
|
...result.observations.map((observation) => `OBSERVE ${observation}`),
|
|
...result.failures.map((failure) => `FAIL ${failure}`),
|
|
`Summary: ${result.passes.length} passed, ${result.observations.length} observed, ${result.failures.length} failed`,
|
|
"",
|
|
].join("\n");
|
|
}
|
|
|
|
const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
|
|
|
|
if (isCli) {
|
|
const result = verifyGiteaCiWorkflow(process.cwd());
|
|
const output = formatGiteaCiWorkflowResult(result);
|
|
|
|
if (result.failures.length > 0) {
|
|
process.stderr.write(output);
|
|
process.exitCode = 1;
|
|
} else {
|
|
process.stdout.write(output);
|
|
}
|
|
}
|