cesnimda
9088dcffb9
- site image: multi-stage node build -> unprivileged nginx (non-root, read-only) - nginx: CSP + security headers, immutable asset caching, revalidated HTML, canonical trailing slash, preserved /Linkedin 301, legacy-WP 410s, custom 404 - externalise theme-init so CSP uses script-src 'self' (no inline hash) - prod + dev compose; .env.example; relay Dockerfile fixed (image ships app user) - Gitea Actions: quality, e2e, lighthouse budgets, relay build, image push on main - verified: both images build; relay healthz 200; site serves EN/NO with CSP + redirect Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
86 lines
2.5 KiB
YAML
86 lines
2.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
env:
|
|
ASTRO_TELEMETRY_DISABLED: '1'
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: pnpm/action-setup@v4
|
|
with: { version: 9 }
|
|
- uses: actions/setup-node@v4
|
|
with: { node-version: 22, cache: pnpm, cache-dependency-path: site/pnpm-lock.yaml }
|
|
- run: pnpm -C site install --frozen-lockfile
|
|
- run: pnpm -C site lint
|
|
- run: pnpm -C site check
|
|
- run: pnpm -C site test
|
|
- run: pnpm -C site build
|
|
|
|
e2e:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: pnpm/action-setup@v4
|
|
with: { version: 9 }
|
|
- uses: actions/setup-node@v4
|
|
with: { node-version: 22, cache: pnpm }
|
|
- run: pnpm -C site install --frozen-lockfile
|
|
- run: pnpm -C tests install --frozen-lockfile
|
|
- run: pnpm -C tests exec playwright install --with-deps chromium
|
|
- run: pnpm -C tests test:e2e
|
|
|
|
lighthouse:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: pnpm/action-setup@v4
|
|
with: { version: 9 }
|
|
- uses: actions/setup-node@v4
|
|
with: { node-version: 22, cache: pnpm }
|
|
- run: pnpm -C site install --frozen-lockfile
|
|
- run: pnpm -C site build
|
|
- run: pnpm dlx @lhci/cli@0.14.x autorun --config=site/lighthouserc.json
|
|
|
|
relay:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-dotnet@v4
|
|
with: { dotnet-version: '9.0.x' }
|
|
- run: dotnet build relay/ContactRelay.csproj -c Release
|
|
|
|
images:
|
|
needs: [quality, e2e, relay]
|
|
if: github.ref == 'refs/heads/main'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: git.cesnimda.uk
|
|
username: ${{ secrets.REGISTRY_USER }}
|
|
password: ${{ secrets.REGISTRY_TOKEN }}
|
|
- name: Build & push site image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ./site
|
|
push: true
|
|
tags: |
|
|
git.cesnimda.uk/cesnimda/resumesite-site:latest
|
|
git.cesnimda.uk/cesnimda/resumesite-site:${{ github.sha }}
|
|
- name: Build & push relay image
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ./relay
|
|
push: true
|
|
tags: |
|
|
git.cesnimda.uk/cesnimda/resumesite-relay:latest
|
|
git.cesnimda.uk/cesnimda/resumesite-relay:${{ github.sha }}
|