Merge pull request #195 from Harbduls/test/sep10-auth-flow #41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 0 * * 0' # Weekly scan on Sunday at 00:00 UTC | |
| jobs: | |
| contract: | |
| name: Rust / Soroban contract | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust + wasm32 target | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: wasm32-unknown-unknown | |
| - name: Cache cargo registry | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| contracts/target | |
| key: cargo-${{ hashFiles('contracts/Cargo.lock') }} | |
| - name: Build WASM | |
| working-directory: contracts | |
| run: make build | |
| - name: Run contract tests | |
| working-directory: contracts | |
| run: make test | |
| backend: | |
| name: Node.js backend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 18 | |
| cache: npm | |
| cache-dependency-path: backend/package-lock.json | |
| - name: Install dependencies | |
| working-directory: backend | |
| run: npm ci | |
| - name: Run tests | |
| working-directory: backend | |
| run: npm test | |
| python: | |
| name: Python analytics service | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| cache-dependency-path: python-service/requirements.txt | |
| - name: Install dependencies | |
| working-directory: python-service | |
| run: pip install -r requirements.txt | |
| - name: Run tests | |
| working-directory: python-service | |
| run: pytest | |
| docker: | |
| name: Docker build validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build backend image | |
| run: docker build ./backend -t vaccichain-backend:ci | |
| - name: Build frontend image | |
| run: docker build ./frontend -t vaccichain-frontend:ci | |
| - name: Build python-service image | |
| run: docker build ./python-service -t vaccichain-python:ci | |
| container-scan: | |
| name: Container vulnerability scanning | |
| runs-on: ubuntu-latest | |
| needs: docker | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build backend image | |
| run: docker build ./backend -t vaccichain-backend:ci | |
| - name: Build frontend image | |
| run: docker build ./frontend -t vaccichain-frontend:ci | |
| - name: Build python-service image | |
| run: docker build ./python-service -t vaccichain-python:ci | |
| - name: Run Trivy scan on backend | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: vaccichain-backend:ci | |
| format: sarif | |
| output: backend-trivy.sarif | |
| severity: HIGH,CRITICAL | |
| - name: Run Trivy scan on frontend | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: vaccichain-frontend:ci | |
| format: sarif | |
| output: frontend-trivy.sarif | |
| severity: HIGH,CRITICAL | |
| - name: Run Trivy scan on python-service | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: vaccichain-python:ci | |
| format: sarif | |
| output: python-trivy.sarif | |
| severity: HIGH,CRITICAL | |
| - name: Upload Trivy results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: | | |
| backend-trivy.sarif | |
| frontend-trivy.sarif | |
| python-trivy.sarif | |
| - name: Upload scan artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: trivy-scan-results | |
| path: | | |
| backend-trivy.sarif | |
| frontend-trivy.sarif | |
| python-trivy.sarif | |
| retention-days: 30 | |
| container-scan-scheduled: | |
| name: Weekly container vulnerability scan | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'schedule' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build backend image | |
| run: docker build ./backend -t vaccichain-backend:prod | |
| - name: Build frontend image | |
| run: docker build ./frontend -t vaccichain-frontend:prod | |
| - name: Build python-service image | |
| run: docker build ./python-service -t vaccichain-python:prod | |
| - name: Run Trivy scan on backend | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: vaccichain-backend:prod | |
| format: table | |
| output: backend-scan.txt | |
| - name: Run Trivy scan on frontend | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: vaccichain-frontend:prod | |
| format: table | |
| output: frontend-scan.txt | |
| - name: Run Trivy scan on python-service | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: vaccichain-python:prod | |
| format: table | |
| output: python-scan.txt | |
| - name: Upload scan results | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: weekly-trivy-scans | |
| path: | | |
| backend-scan.txt | |
| frontend-scan.txt | |
| python-scan.txt | |
| retention-days: 90 |