tcvn-compliance-copilot/.github/workflows/ci.yml at main · aec-platform/tcvn-compliance-copilot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Cancel superseded runs on the same ref to save minutes.
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  # =====================================================================
  # Backend lint + typecheck + unit tests
  # =====================================================================
  api:
    name: api · lint, typecheck, test
    runs-on: ubuntu-latest
    services:
      postgres:
        image: pgvector/pgvector:pg16
        env:
          POSTGRES_USER: tcvn
          POSTGRES_PASSWORD: tcvn
          POSTGRES_DB: tcvn_test
        ports: ["5432:5432"]
        options: >-
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
      redis:
        image: redis:7-alpine
        ports: ["6379:6379"]
        options: >-
          --health-cmd "redis-cli ping"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10

    defaults:
      run:
        working-directory: apps/api

    env:
      DATABASE_URL: postgresql+asyncpg://tcvn:tcvn@localhost:5432/tcvn_test
      REDIS_URL: redis://localhost:6379/0
      CELERY_BROKER_URL: redis://localhost:6379/1
      CELERY_RESULT_BACKEND: redis://localhost:6379/2
      S3_ACCESS_KEY: ci
      S3_SECRET_KEY: ci
      ANTHROPIC_API_KEY: sk-ant-ci
      API_SECRET_KEY: ci-secret-key-with-enough-entropy
      ENVIRONMENT: test

    steps:
      - uses: actions/checkout@v5

      - name: Install uv
        uses: astral-sh/setup-uv@v6
        with:
          version: "0.5.11"

      - name: Set up Python
        run: uv python install 3.11

      - name: Cache uv venv
        uses: actions/cache@v5
        with:
          path: apps/api/.venv
          key: uv-${{ runner.os }}-${{ hashFiles('apps/api/uv.lock', 'apps/api/pyproject.toml') }}

      - name: Install dependencies
        run: uv sync --all-extras

      - name: System deps for tests (tesseract, poppler)
        run: |
          sudo apt-get update
          sudo apt-get install -y tesseract-ocr tesseract-ocr-vie poppler-utils libmagic1

      - name: Ruff lint + format check
        run: |
          uv run ruff check .
          uv run ruff format --check .

      - name: Mypy
        run: uv run mypy src

      - name: Run migrations
        run: uv run alembic upgrade head

      - name: Pytest (unit + integration)
        run: uv run pytest -m "not slow" --cov-report=xml

      - name: Upload coverage
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: api-coverage
          path: apps/api/coverage.xml

  # =====================================================================
  # Web lint + typecheck + tests
  # =====================================================================
  web:
    name: web · lint, typecheck, test
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: apps/web

    steps:
      - uses: actions/checkout@v5

      - uses: pnpm/action-setup@v4
        with:
          version: 9.12.2

      - uses: actions/setup-node@v5
        with:
          node-version: 22
          cache: pnpm
          cache-dependency-path: apps/web/pnpm-lock.yaml

      - run: pnpm install --frozen-lockfile || pnpm install

      - run: pnpm lint
      - run: pnpm typecheck
      - run: pnpm test

  # =====================================================================
  # Container image build (smoke test only; no push)
  # =====================================================================
  build-images:
    name: docker · build images
    runs-on: ubuntu-latest
    needs: [api, web]
    steps:
      - uses: actions/checkout@v5
      - uses: docker/setup-buildx-action@v4
      - name: Build API image
        uses: docker/build-push-action@v7
        with:
          context: apps/api
          target: prod
          push: false
          cache-from: type=gha
          cache-to: type=gha,mode=max
      - name: Build Web image
        uses: docker/build-push-action@v7
        with:
          context: apps/web
          target: prod
          push: false
          cache-from: type=gha
          cache-to: type=gha,mode=max