chore(tracker): mark Phase 1 complete (Step 1.10 → ✅; log PRs #71, #72) #172
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Detect which paths changed so downstream jobs can be skipped when | |
| # irrelevant files are touched. Always runs — no path filter here. | |
| # --------------------------------------------------------------------------- | |
| changes: | |
| name: Detect changed paths | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| python: ${{ steps.filter.outputs.python }} | |
| infra: ${{ steps.filter.outputs.infra }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| python: | |
| - 'packages/**' | |
| - 'apps/**' | |
| - 'tests/**' | |
| - 'scripts/**' | |
| - 'pyproject.toml' | |
| - 'uv.lock' | |
| infra: | |
| - 'infra/terraform/**' | |
| - 'infra/helm/**' | |
| # --------------------------------------------------------------------------- | |
| # Lint + type-check + unit tests (Ubuntu + macOS + Windows) | |
| # Cross-platform requirement: every step must pass on all three OSes. | |
| # --------------------------------------------------------------------------- | |
| lint-test: | |
| name: Lint & Test (${{ matrix.os }}) | |
| needs: changes | |
| if: needs.changes.outputs.python == 'true' | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-22.04, macos-14, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - name: Set up Python 3.12 | |
| run: uv python install 3.12 | |
| - name: Install Python dependencies | |
| run: uv sync --all-packages | |
| - name: Ruff lint | |
| run: uv run ruff check . | |
| - name: Ruff format check | |
| run: uv run ruff format --check . | |
| - name: RAG001 — logging policy check | |
| run: uv run python scripts/check_logging.py | |
| - name: Mypy (strict) | |
| run: uv run mypy packages/ apps/gateway/ | |
| - name: Pytest | |
| run: uv run pytest tests/ packages/ -x -q --tb=short | |
| # --------------------------------------------------------------------------- | |
| # Secrets scan — blocks if a real credential is planted in a PR. | |
| # Intentionally has no path filter: always run on every push/PR. | |
| # --------------------------------------------------------------------------- | |
| secrets-scan: | |
| name: Secrets scan (gitleaks) | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install gitleaks | |
| run: | | |
| curl -sSfL \ | |
| https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \ | |
| | tar -xz gitleaks | |
| sudo mv gitleaks /usr/local/bin/gitleaks | |
| - name: Run gitleaks | |
| run: gitleaks detect --source . --redact --exit-code 1 | |
| # --------------------------------------------------------------------------- | |
| # Schema-drift gate — regenerates dist/schemas/ and fails if anything in the | |
| # tracked schema artifacts is modified, staged, or untracked. Catches both | |
| # "forgot to regenerate" and "forgot to git add" mistakes. | |
| # --------------------------------------------------------------------------- | |
| schema-drift: | |
| name: Schema drift (dist/schemas/) | |
| needs: changes | |
| if: needs.changes.outputs.python == 'true' | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - run: uv sync --all-packages | |
| - name: Regenerate JSON schemas | |
| env: | |
| PYTHONPATH: packages/core/src | |
| run: uv run python -m rag_core.gen_schemas dist/schemas/ | |
| - name: Verify no drift | |
| run: uv run python scripts/check_schema_drift.py | |
| # --------------------------------------------------------------------------- | |
| # Logging gates — schema + PII + event-registry (activated in Step 0.7b) | |
| # --------------------------------------------------------------------------- | |
| log-gates: | |
| name: Log schema + PII gates | |
| needs: changes | |
| if: needs.changes.outputs.python == 'true' | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - run: uv sync --all-packages | |
| - run: uv run pytest tests/logs/ -v | |
| # --------------------------------------------------------------------------- | |
| # IaC validation — terraform validate + helm lint (no live cluster needed) | |
| # --------------------------------------------------------------------------- | |
| iac: | |
| name: IaC validate (terraform + helm) | |
| needs: changes | |
| if: needs.changes.outputs.infra == 'true' | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v3 | |
| with: | |
| terraform_version: "~1.9" | |
| - name: Setup Helm | |
| uses: azure/setup-helm@v4 | |
| with: | |
| version: "latest" | |
| - name: Terraform validate — dev | |
| working-directory: infra/terraform/environments/dev | |
| run: | | |
| terraform init -backend=false | |
| terraform validate | |
| - name: Terraform validate — prod | |
| working-directory: infra/terraform/environments/prod | |
| run: | | |
| terraform init -backend=false | |
| terraform validate | |
| - name: Helm lint — rag-platform | |
| run: helm lint infra/helm/rag-platform/ | |
| - name: Helm template — dry run | |
| run: helm template rag-platform infra/helm/rag-platform/ > /dev/null | |
| # --------------------------------------------------------------------------- | |
| # Dependency CVE audit | |
| # --------------------------------------------------------------------------- | |
| audit: | |
| name: pip-audit | |
| needs: changes | |
| if: needs.changes.outputs.python == 'true' | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| cache-dependency-glob: "uv.lock" | |
| - run: uv sync --all-packages | |
| - run: uv run pip-audit | |
| # --------------------------------------------------------------------------- | |
| # Required status-check gate. | |
| # Always runs; fails only if a real job failed (skipped jobs are OK). | |
| # Configure "CI passed" as the required branch-protection check in GitHub. | |
| # --------------------------------------------------------------------------- | |
| ci-pass: | |
| name: CI passed | |
| needs: [lint-test, secrets-scan, schema-drift, log-gates, audit, iac] | |
| if: always() | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Check job results | |
| run: | | |
| results='${{ toJSON(needs.*.result) }}' | |
| echo "Job results: $results" | |
| if echo "$results" | grep -q '"failure"'; then | |
| echo "One or more jobs failed." | |
| exit 1 | |
| fi | |
| echo "All jobs passed or were skipped." |