chore(deps): bump the production-minor-patch group with 2 updates #54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| issue_comment: | |
| types: [created] | |
| jobs: | |
| validate: | |
| # Run when a maintainer comments /test on a PR (manual trigger for external contributors). | |
| # Dependabot PRs: comment /test to run CI, or add a separate ci-dependabot workflow. | |
| if: | | |
| github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request && | |
| contains(github.event.comment.body, '/test') && | |
| ( | |
| github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'COLLABORATOR' | |
| ) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| statuses: write | |
| services: | |
| postgres: | |
| image: postgres:18.3 | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| # Host port 5632: Metaboost test stack (dev Docker uses 5532; default Postgres is often 5432). | |
| ports: | |
| - 5632:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U postgres" --health-interval 10s | |
| --health-timeout 5s --health-retries 5 | |
| valkey: | |
| image: valkey/valkey:7-alpine | |
| # Host port 6579: Metaboost test Valkey (dev Docker uses 6479; default Redis/Valkey is often 6379). | |
| ports: | |
| - 6579:6379 | |
| options: >- | |
| --health-cmd "valkey-cli ping" --health-interval 10s --health-timeout | |
| 5s --health-retries 5 | |
| env: | |
| DB_HOST: localhost | |
| DB_PORT: 5632 | |
| DB_APP_NAME: metaboost_app_test | |
| DB_APP_MIGRATOR_USER: metaboost_app_migrator | |
| DB_APP_MIGRATOR_PASSWORD: test | |
| DB_APP_READ_USER: metaboost_app_read | |
| DB_APP_READ_PASSWORD: test | |
| DB_APP_READ_WRITE_USER: metaboost_app_read_write | |
| DB_APP_READ_WRITE_PASSWORD: test | |
| DB_MANAGEMENT_NAME: metaboost_management_test | |
| DB_MANAGEMENT_MIGRATOR_USER: metaboost_management_migrator | |
| DB_MANAGEMENT_MIGRATOR_PASSWORD: test | |
| DB_MANAGEMENT_READ_USER: metaboost_management_read | |
| DB_MANAGEMENT_READ_PASSWORD: test | |
| DB_MANAGEMENT_READ_WRITE_USER: metaboost_management_read_write | |
| DB_MANAGEMENT_READ_WRITE_PASSWORD: test | |
| KEYVALDB_HOST: localhost | |
| KEYVALDB_PORT: 6579 | |
| KEYVALDB_PASSWORD: "test" | |
| API_PORT: "3999" | |
| BRAND_NAME: metaboost-api-test | |
| AUTH_JWT_SECRET: "ci-test-jwt-secret-min-32-chars-long-for-validation" | |
| steps: | |
| - name: Add reaction to comment | |
| if: github.event_name == 'issue_comment' | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| await github.rest.reactions.createForIssueComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| comment_id: context.payload.comment.id, | |
| content: 'rocket' | |
| }); | |
| - name: Get PR details | |
| id: pr-comment | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| const pr = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.issue.number | |
| }); | |
| core.setOutput('head_ref', pr.data.head.ref); | |
| core.setOutput('head_sha', pr.data.head.sha); | |
| core.setOutput('pr_number', context.issue.number); | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ steps.pr-comment.outputs.head_sha }} | |
| - name: Validate linear migration files | |
| id: db-verify | |
| run: bash scripts/database/validate-linear-migrations.sh | |
| - name: Verify linear baseline 0003 | |
| id: db-baseline-0003 | |
| run: bash scripts/database/verify-linear-baseline.sh | |
| - name: Validate db init sync | |
| id: db-init-sync | |
| run: make check_k8s_postgres_init_sync | |
| - name: Verify bootstrap init contract in ephemeral Postgres | |
| id: db-bootstrap-contract | |
| run: bash scripts/database/ci-verify-bootstrap-contract.sh | |
| - name: Enforce no runtime CREATE EXTENSION | |
| id: db-runtime-extension-guard | |
| run: bash scripts/database/check-no-runtime-create-extension.sh | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "24" | |
| cache: "npm" | |
| - name: Pin npm version | |
| run: npm install -g npm@11.13.0 | |
| - name: Install dependencies | |
| id: install | |
| run: | | |
| set -euo pipefail | |
| for attempt in 1 2 3 4 5; do | |
| if npm ci; then | |
| break | |
| fi | |
| echo "npm ci failed (attempt $attempt/5); retrying in 15s..." >&2 | |
| sleep 15 | |
| if [[ "$attempt" -eq 5 ]]; then | |
| exit 1 | |
| fi | |
| done | |
| - name: Build packages | |
| id: build-packages | |
| run: npm run build:packages | |
| - name: Lint | |
| id: lint | |
| run: npm run lint | |
| - name: Build apps | |
| id: build-apps | |
| run: npm run build:apps | |
| - name: i18n validate | |
| id: i18n-validate | |
| run: npm run i18n:validate | |
| - name: Type-check | |
| id: type-check | |
| run: npm run type-check | |
| - name: Create test database and run init | |
| id: db-init | |
| env: | |
| PGPASSWORD: postgres | |
| PGHOST: localhost | |
| PGPORT: "5632" | |
| PGUSER: postgres | |
| run: | | |
| psql -c "DROP DATABASE IF EXISTS metaboost_app_test;" | |
| psql -c "CREATE DATABASE metaboost_app_test;" | |
| psql -d postgres -c " | |
| DO \$\$ | |
| BEGIN | |
| IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_app_migrator') THEN | |
| CREATE USER metaboost_app_migrator WITH PASSWORD 'test'; | |
| ELSE | |
| ALTER USER metaboost_app_migrator WITH PASSWORD 'test'; | |
| END IF; | |
| IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_management_migrator') THEN | |
| CREATE USER metaboost_management_migrator WITH PASSWORD 'test'; | |
| ELSE | |
| ALTER USER metaboost_management_migrator WITH PASSWORD 'test'; | |
| END IF; | |
| IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_app_read') THEN | |
| CREATE USER metaboost_app_read WITH PASSWORD 'test'; | |
| END IF; | |
| IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_app_read_write') THEN | |
| CREATE USER metaboost_app_read_write WITH PASSWORD 'test'; | |
| END IF; | |
| IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_management_read') THEN | |
| CREATE USER metaboost_management_read WITH PASSWORD 'test'; | |
| END IF; | |
| IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = 'metaboost_management_read_write') THEN | |
| CREATE USER metaboost_management_read_write WITH PASSWORD 'test'; | |
| END IF; | |
| END \$\$; | |
| " | |
| psql -d metaboost_app_test -c "ALTER DATABASE metaboost_app_test OWNER TO metaboost_app_migrator;" | |
| psql -d metaboost_app_test -c "GRANT CONNECT ON DATABASE metaboost_app_test TO metaboost_app_migrator, metaboost_app_read, metaboost_app_read_write;" | |
| psql -d metaboost_app_test -c "GRANT USAGE, CREATE ON SCHEMA public TO metaboost_app_migrator;" | |
| DB_HOST=localhost DB_PORT=5632 DB_APP_NAME=metaboost_app_test DB_APP_MIGRATOR_USER=metaboost_app_migrator DB_APP_MIGRATOR_PASSWORD=test \ | |
| bash scripts/database/run-linear-migrations.sh --database app | |
| psql -d metaboost_app_test -c " | |
| GRANT CONNECT ON DATABASE metaboost_app_test TO metaboost_app_read, metaboost_app_read_write; | |
| GRANT USAGE ON SCHEMA public TO metaboost_app_read, metaboost_app_read_write; | |
| GRANT SELECT ON ALL TABLES IN SCHEMA public TO metaboost_app_read; | |
| GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO metaboost_app_read; | |
| GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO metaboost_app_read_write; | |
| GRANT SELECT, USAGE, UPDATE ON ALL SEQUENCES IN SCHEMA public TO metaboost_app_read_write; | |
| ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO metaboost_app_read; | |
| ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON SEQUENCES TO metaboost_app_read; | |
| ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO metaboost_app_read_write; | |
| ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, USAGE, UPDATE ON SEQUENCES TO metaboost_app_read_write; | |
| " | |
| psql -c "DROP DATABASE IF EXISTS metaboost_management_test;" | |
| psql -c "CREATE DATABASE metaboost_management_test;" | |
| psql -d metaboost_management_test -c "ALTER DATABASE metaboost_management_test OWNER TO metaboost_management_migrator;" | |
| psql -d metaboost_management_test -c "GRANT CONNECT ON DATABASE metaboost_management_test TO metaboost_management_migrator, metaboost_management_read, metaboost_management_read_write;" | |
| psql -d metaboost_management_test -c "GRANT USAGE, CREATE ON SCHEMA public TO metaboost_management_migrator;" | |
| DB_HOST=localhost DB_PORT=5632 DB_MANAGEMENT_NAME=metaboost_management_test DB_MANAGEMENT_MIGRATOR_USER=metaboost_management_migrator DB_MANAGEMENT_MIGRATOR_PASSWORD=test \ | |
| bash scripts/database/run-linear-migrations.sh --database management | |
| psql -d metaboost_management_test -c " | |
| GRANT CONNECT ON DATABASE metaboost_management_test TO metaboost_management_read, metaboost_management_read_write; | |
| GRANT USAGE ON SCHEMA public TO metaboost_management_read, metaboost_management_read_write; | |
| GRANT SELECT ON ALL TABLES IN SCHEMA public TO metaboost_management_read; | |
| GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO metaboost_management_read; | |
| GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON ALL TABLES IN SCHEMA public TO metaboost_management_read_write; | |
| GRANT SELECT, USAGE, UPDATE ON ALL SEQUENCES IN SCHEMA public TO metaboost_management_read_write; | |
| ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO metaboost_management_read; | |
| ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON SEQUENCES TO metaboost_management_read; | |
| ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON TABLES TO metaboost_management_read_write; | |
| ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, USAGE, UPDATE ON SEQUENCES TO metaboost_management_read_write; | |
| " | |
| - name: Test (skipped in CI; run locally) | |
| id: test | |
| if: always() | |
| run: | | |
| echo "::warning::Tests are intentionally skipped in GitHub Actions for this workflow." | |
| echo "::warning::Run tests locally before merge: make E2E_API_GATE_MODE=on e2e_test (or make E2E_API_GATE_MODE=on e2e_test_report for reports)" | |
| - name: Report success | |
| if: success() | |
| uses: actions/github-script@v9 | |
| env: | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ | |
| github.run_id }} | |
| PR_NUMBER: ${{ steps.pr-comment.outputs.pr_number }} | |
| with: | |
| script: | | |
| const body = [ | |
| '## ✅ CI Passed', | |
| '', | |
| 'All checks completed successfully.', | |
| '', | |
| '| Check | Status |', | |
| '|-------|--------|', | |
| '| Linear migration files valid | ✅ |', | |
| '| Linear baseline 0003 (vs generator) | ✅ |', | |
| '| DB init sync valid | ✅ |', | |
| '| Bootstrap init contract verified | ✅ |', | |
| '| Runtime CREATE EXTENSION guard | ✅ |', | |
| '| Dependencies installed | ✅ |', | |
| '| Build packages | ✅ |', | |
| '| Lint | ✅ |', | |
| '| Build apps | ✅ |', | |
| '| i18n validate | ✅ |', | |
| '| Type-check | ✅ |', | |
| '| Test | ⏭️ Skipped in CI (run locally) |', | |
| '', | |
| '> Reminder: run `make E2E_API_GATE_MODE=on e2e_test` locally before merging (or `make E2E_API_GATE_MODE=on e2e_test_report` for reports).', | |
| '', | |
| `[View full run](${process.env.RUN_URL})` | |
| ].join('\n'); | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: parseInt(process.env.PR_NUMBER), | |
| body: body | |
| }); | |
| - name: Set success commit status | |
| if: success() | |
| uses: actions/github-script@v9 | |
| env: | |
| HEAD_SHA: ${{ steps.pr-comment.outputs.head_sha }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ | |
| github.run_id }} | |
| with: | |
| script: | | |
| await github.rest.repos.createCommitStatus({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| sha: process.env.HEAD_SHA, | |
| state: 'success', | |
| context: 'validate', | |
| description: 'All checks passed', | |
| target_url: process.env.RUN_URL | |
| }); | |
| - name: Report failure | |
| if: failure() | |
| uses: actions/github-script@v9 | |
| env: | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ | |
| github.run_id }} | |
| PR_NUMBER: ${{ steps.pr-comment.outputs.pr_number }} | |
| DB_VERIFY: ${{ steps.db-verify.outcome }} | |
| DB_BASELINE_0003: ${{ steps.db-baseline-0003.outcome }} | |
| DB_INIT_SYNC: ${{ steps.db-init-sync.outcome }} | |
| DB_BOOTSTRAP_CONTRACT: ${{ steps.db-bootstrap-contract.outcome }} | |
| DB_RUNTIME_EXTENSION_GUARD: ${{ steps.db-runtime-extension-guard.outcome }} | |
| INSTALL: ${{ steps.install.outcome }} | |
| BUILD_PACKAGES: ${{ steps.build-packages.outcome }} | |
| LINT: ${{ steps.lint.outcome }} | |
| BUILD_APPS: ${{ steps.build-apps.outcome }} | |
| I18N_VALIDATE: ${{ steps.i18n-validate.outcome }} | |
| TYPE_CHECK: ${{ steps.type-check.outcome }} | |
| with: | |
| script: | | |
| const status = (outcome) => { | |
| if (outcome === 'success') return '✅'; | |
| if (outcome === 'failure') return '❌'; | |
| return '⏭️'; | |
| }; | |
| const baselineFix = | |
| process.env.DB_BASELINE_0003 === 'failure' | |
| ? [ | |
| '', | |
| '**Linear baseline 0003a/0003b:** Regenerate from the repo root, then commit:', | |
| '```', | |
| 'make db_regen_linear_baseline', | |
| 'make db_verify_linear_baseline', | |
| '```', | |
| 'Or: `bash scripts/database/generate-linear-baseline.sh` then verify as above.', | |
| '' | |
| ].join('\n') | |
| : ''; | |
| const body = [ | |
| '## ❌ CI Failed', | |
| '', | |
| 'One or more checks failed. Please review and fix the issues.', | |
| '', | |
| '| Check | Status |', | |
| '|-------|--------|', | |
| `| Linear migration files valid | ${status(process.env.DB_VERIFY)} |`, | |
| `| Linear baseline 0003 (vs generator) | ${status(process.env.DB_BASELINE_0003)} |`, | |
| `| DB init sync valid | ${status(process.env.DB_INIT_SYNC)} |`, | |
| `| Bootstrap init contract verified | ${status(process.env.DB_BOOTSTRAP_CONTRACT)} |`, | |
| `| Runtime CREATE EXTENSION guard | ${status(process.env.DB_RUNTIME_EXTENSION_GUARD)} |`, | |
| `| Dependencies installed | ${status(process.env.INSTALL)} |`, | |
| `| Build packages | ${status(process.env.BUILD_PACKAGES)} |`, | |
| `| Lint | ${status(process.env.LINT)} |`, | |
| `| Build apps | ${status(process.env.BUILD_APPS)} |`, | |
| `| i18n validate | ${status(process.env.I18N_VALIDATE)} |`, | |
| `| Type-check | ${status(process.env.TYPE_CHECK)} |`, | |
| '| Test | ⏭️ Skipped in CI (run locally) |', | |
| '', | |
| 'Legend: ✅ Passed | ❌ Failed | ⏭️ Skipped', | |
| '', | |
| baselineFix, | |
| '> Reminder: run `make E2E_API_GATE_MODE=on e2e_test` locally before merging (or `make E2E_API_GATE_MODE=on e2e_test_report` for reports).', | |
| '', | |
| `[View full run for details](${process.env.RUN_URL})` | |
| ].join('\n'); | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: parseInt(process.env.PR_NUMBER), | |
| body: body | |
| }); | |
| - name: Set failure commit status | |
| if: failure() | |
| uses: actions/github-script@v9 | |
| env: | |
| HEAD_SHA: ${{ steps.pr-comment.outputs.head_sha }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ | |
| github.run_id }} | |
| with: | |
| script: | | |
| await github.rest.repos.createCommitStatus({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| sha: process.env.HEAD_SHA, | |
| state: 'failure', | |
| context: 'validate', | |
| description: 'One or more checks failed', | |
| target_url: process.env.RUN_URL | |
| }); |