patrickandClaude Sonnet 5
02d02a9842
check-security-test-coverage.sh + Selbsttest, connect-security-gate-Job in ci.yml. 15 Pakete per Tenant-/Autorisierungsbezug ermittelt. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
131 lines
4.4 KiB
YAML
131 lines
4.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
go-core:
|
|
name: Core-Modul (Build/Vet/Test)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Build, Vet, Test
|
|
run: |
|
|
go build ./...
|
|
go vet ./...
|
|
go test ./... -count=1 -coverprofile=coverage.out
|
|
go tool cover -func=coverage.out | tail -1
|
|
|
|
dms-security-gate:
|
|
name: DMS Security-Test-Gate (AC5, Merge-Gate)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Gate-Selbsttest (beweist, dass fehlende Tests abgelehnt werden)
|
|
working-directory: dms
|
|
run: bash scripts/check-security-test-coverage_selftest.sh
|
|
- name: Gate gegen aktuellen Stand ausfuehren
|
|
working-directory: dms
|
|
run: bash scripts/check-security-test-coverage.sh
|
|
|
|
connect-security-gate:
|
|
name: Connect Security-Test-Gate (QA-01 AC4, Merge-Gate)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Gate-Selbsttest (beweist, dass fehlende Tests abgelehnt werden)
|
|
working-directory: connect
|
|
run: bash scripts/check-security-test-coverage_selftest.sh
|
|
- name: Gate gegen aktuellen Stand ausfuehren
|
|
working-directory: connect
|
|
run: bash scripts/check-security-test-coverage.sh
|
|
|
|
dms-build-test:
|
|
name: DMS-Modul (Lint/Build/Test/Coverage/Artefakt)
|
|
runs-on: ubuntu-latest
|
|
needs: dms-security-gate
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Lint
|
|
working-directory: dms
|
|
run: golangci-lint run ./...
|
|
- name: Testumgebung zuruecksetzen
|
|
working-directory: dms
|
|
env:
|
|
NEXARCH_DMS_TEST_DB_PASSWORD: ${{ secrets.NEXARCH_DMS_TEST_DB_PASSWORD }}
|
|
run: bash scripts/reset-test-env.sh
|
|
- name: Build, Vet, Test mit Testabdeckung
|
|
working-directory: dms
|
|
env:
|
|
NEXARCH_DMS_TEST_DB_PASSWORD: ${{ secrets.NEXARCH_DMS_TEST_DB_PASSWORD }}
|
|
run: |
|
|
go build ./...
|
|
go vet ./...
|
|
go test ./... -p 1 -count=1 -coverprofile=coverage.out
|
|
go tool cover -func=coverage.out | tail -1
|
|
- name: Artefakt bauen (Reproduzierbarkeits-Nachweis)
|
|
working-directory: dms
|
|
run: |
|
|
go build -trimpath -o /tmp/dms-app-artifact-1 ./cmd/app
|
|
go build -trimpath -o /tmp/dms-app-artifact-2 ./cmd/app
|
|
cmp /tmp/dms-app-artifact-1 /tmp/dms-app-artifact-2
|
|
|
|
dms-govulncheck:
|
|
name: DMS-Modul Supply-Chain-Scan (govulncheck)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: govulncheck installieren
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
- name: Schwachstellen-Scan
|
|
working-directory: dms
|
|
run: "$(go env GOPATH)/bin/govulncheck ./..."
|
|
|
|
web:
|
|
name: Web (${{ matrix.app }})
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
app: [shl, dms-browser, pdf-viewer]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Abhaengigkeiten installieren
|
|
working-directory: web/${{ matrix.app }}
|
|
run: npm install
|
|
- name: Typpruefung
|
|
working-directory: web/${{ matrix.app }}
|
|
run: npx tsc --noEmit
|
|
- name: Tests mit Testabdeckung
|
|
working-directory: web/${{ matrix.app }}
|
|
run: npx vitest run --coverage
|
|
- name: Build
|
|
if: matrix.app != 'shl'
|
|
working-directory: web/${{ matrix.app }}
|
|
run: npm run build
|
|
- name: Supply-Chain-Scan (npm audit, kritische Schwachstellen)
|
|
working-directory: web/${{ matrix.app }}
|
|
run: npm audit --audit-level=critical
|
|
|
|
web-a11y:
|
|
name: Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende)
|
|
runs-on: ubuntu-latest
|
|
concurrency:
|
|
group: a11y-audit-testhost
|
|
cancel-in-progress: false
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Barrierefreiheitspruefung (web/a11y-audit/run.sh)
|
|
env:
|
|
NEXARCH_DMS_TEST_DB_PASSWORD: ${{ secrets.NEXARCH_DMS_TEST_DB_PASSWORD }}
|
|
A11Y_CHROME: ${{ vars.A11Y_CHROME }}
|
|
run: |
|
|
export A11Y_DSN="postgres://${TEST_TENANT_ROLE:-nexarch_dms_test}:${NEXARCH_DMS_TEST_DB_PASSWORD}@localhost:5432/${TEST_TENANT_DB:-dms_tenant_test}?sslmode=disable"
|
|
export OUT="$RUNNER_TEMP/a11y-out"
|
|
bash web/a11y-audit/run.sh
|
|
- name: Berichte sichern
|
|
if: always()
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/a11y-out" && ls -la "$RUNNER_TEMP/a11y-out" | head -30
|