Repository navigation
[pull] main from mhdzumair:main #247
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Least-privilege default: all jobs get read-only token unless overridden below. | |
| permissions: | |
| contents: read | |
| jobs: | |
| # ── Detect which parts of the codebase changed ─────────────────────────── | |
| changes: | |
| name: Detect Changes | |
| runs-on: ubuntu-latest | |
| outputs: | |
| rust: ${{ steps.filter.outputs.rust }} | |
| frontend: ${{ steps.filter.outputs.frontend }} | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3 | |
| id: filter | |
| with: | |
| filters: | | |
| rust: | |
| - 'backend/**' | |
| frontend: | |
| - 'clients/frontend/**' | |
| # ── Frontend ────────────────────────────────────────────────────────────── | |
| frontend-lint: | |
| name: Frontend Lint | |
| needs: changes | |
| if: needs.changes.outputs.frontend == 'true' | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: clients/frontend | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Set up Node | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "20" | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Get pnpm store directory | |
| id: pnpm-cache | |
| run: echo "store=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" | |
| - name: Cache pnpm store | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: ${{ steps.pnpm-cache.outputs.store }} | |
| key: ${{ runner.os }}-pnpm-${{ hashFiles('clients/frontend/pnpm-lock.yaml') }} | |
| restore-keys: ${{ runner.os }}-pnpm- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: ESLint | |
| run: pnpm exec eslint . | |
| frontend-format: | |
| name: Frontend Format | |
| needs: changes | |
| if: needs.changes.outputs.frontend == 'true' | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: clients/frontend | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Set up Node | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "20" | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Get pnpm store directory | |
| id: pnpm-cache | |
| run: echo "store=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" | |
| - name: Cache pnpm store | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: ${{ steps.pnpm-cache.outputs.store }} | |
| key: ${{ runner.os }}-pnpm-${{ hashFiles('clients/frontend/pnpm-lock.yaml') }} | |
| restore-keys: ${{ runner.os }}-pnpm- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Prettier check | |
| run: pnpm exec prettier --check "src/**/*.{ts,tsx,css,json}" | |
| frontend-build: | |
| name: Frontend Build | |
| needs: changes | |
| if: needs.changes.outputs.frontend == 'true' | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: clients/frontend | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Set up Node | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: "20" | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0 | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Get pnpm store directory | |
| id: pnpm-cache | |
| run: echo "store=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" | |
| - name: Cache pnpm store | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: ${{ steps.pnpm-cache.outputs.store }} | |
| key: ${{ runner.os }}-pnpm-${{ hashFiles('clients/frontend/pnpm-lock.yaml') }} | |
| restore-keys: ${{ runner.os }}-pnpm- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Build | |
| run: pnpm run build | |
| # ── Rust ────────────────────────────────────────────────────────────────── | |
| rust-fmt: | |
| name: Rust Format | |
| needs: changes | |
| if: needs.changes.outputs.rust == 'true' | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable | |
| with: | |
| toolchain: stable | |
| components: rustfmt | |
| - name: Rustfmt check | |
| run: cargo fmt --check | |
| rust-lint: | |
| name: Rust Lint | |
| needs: changes | |
| if: needs.changes.outputs.rust == 'true' | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable | |
| with: | |
| toolchain: stable | |
| components: clippy | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| workspaces: backend | |
| - name: Clippy | |
| run: cargo clippy --all-targets -- -D warnings | |
| rust-build: | |
| name: Rust Build | |
| needs: changes | |
| if: needs.changes.outputs.rust == 'true' | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: backend | |
| services: | |
| postgres: | |
| image: postgres:17-alpine | |
| env: | |
| POSTGRES_USER: mediafusion | |
| POSTGRES_PASSWORD: mediafusion | |
| POSTGRES_DB: mediafusion | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd="pg_isready -U mediafusion" | |
| --health-interval=5s | |
| --health-timeout=5s | |
| --health-retries=10 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # stable | |
| with: | |
| toolchain: stable | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| with: | |
| workspaces: backend | |
| - name: Install cargo-audit and sqlx-cli | |
| run: | | |
| cargo install cargo-audit --locked | |
| cargo install sqlx-cli --locked --no-default-features --features postgres,native-tls | |
| - name: Security audit | |
| # RUSTSEC-2023-0071 (rsa Marvin Attack) has no upstream fix; it is pulled | |
| # in by sqlx-mysql but MediaFusion uses Postgres only — never exercised at runtime. | |
| run: cargo audit --ignore RUSTSEC-2023-0071 | |
| - name: Run migrations | |
| env: | |
| DATABASE_URL: postgresql://mediafusion:mediafusion@localhost:5432/mediafusion | |
| run: cargo sqlx migrate run | |
| - name: Validate sqlx query cache | |
| # Ensures .sqlx/ offline cache matches the real schema. | |
| # Fails if a query! macro was changed without running `cargo sqlx prepare`. | |
| # See AGENTS.md for the required developer workflow. | |
| env: | |
| DATABASE_URL: postgresql://mediafusion:mediafusion@localhost:5432/mediafusion | |
| run: cargo sqlx prepare --check | |
| - name: Build (release) | |
| env: | |
| SQLX_OFFLINE: "true" | |
| run: cargo build --release --bin mediafusion-api --bin mediafusion-worker | |
| - name: Test | |
| env: | |
| SQLX_OFFLINE: "true" | |
| TEST_DATABASE_URL: postgresql://mediafusion:mediafusion@localhost:5432/mediafusion | |
| run: cargo test |