oliver/vanity-dev-engine
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add minimal reusable pipeline for startup isolation (v1.3)

Browse source
This commit is contained in:
Oliver 2026-03-07 12:04:53 +01:00
parent 460883dfcb
commit 4628673afd
No known key found for this signature in database
1 changed files with 5 additions and 174 deletions
Download patch file Download diff file Expand all files Collapse all files

179
.github/workflows/repo-pipeline.yml vendored
View file

@ -4,195 +4,26 @@ on:
workflow_call:
inputs:
repo_type:
description: Repository type (ios, node, python, custom)
description: Repository type
required: false
type: string
default: ios
lint_command:
description: Optional lint command override
required: false
type: string
default: ""
build_command:
description: Optional build command override
required: false
type: string
default: ""
test_command:
description: Optional test command override
required: false
type: string
default: ""
jobs:
ci:
name: ci
runs-on: ${{ inputs.repo_type == 'ios' && 'macos-15' || 'ubuntu-latest' }}
runs-on: ubuntu-latest
steps:
- name: Checkout caller repository
uses: actions/checkout@v4
- name: Lint
shell: bash
run: |
set -euo pipefail
CMD='${{ inputs.lint_command }}'
if [ -z "$CMD" ]; then
case '${{ inputs.repo_type }}' in
ios)
CMD="if which swiftlint > /dev/null; then swiftlint --strict; else brew install swiftlint && swiftlint --strict; fi"
;;
node)
CMD="npm run lint --if-present"
;;
python)
CMD="python -m pip install -U pip && pip install ruff && ruff check ."
;;
*)
CMD="echo 'No lint command configured for custom repo_type'"
;;
esac
fi
eval "$CMD"
- name: Build
shell: bash
run: |
set -euo pipefail
CMD='${{ inputs.build_command }}'
if [ -z "$CMD" ]; then
case '${{ inputs.repo_type }}' in
ios)
CMD="xcodebuild build -project CamperLogBook.xcodeproj -scheme CamperLogBook -destination 'platform=iOS Simulator,name=iPhone 16,OS=latest' CODE_SIGNING_ALLOWED=NO"
;;
node)
CMD="npm run build --if-present"
;;
python)
CMD="echo 'No build step for python default'"
;;
*)
CMD="echo 'No build command configured for custom repo_type'"
;;
esac
fi
eval "$CMD"
- name: Test
shell: bash
run: |
set -euo pipefail
CMD='${{ inputs.test_command }}'
if [ -z "$CMD" ]; then
case '${{ inputs.repo_type }}' in
ios)
CMD="xcodebuild test -project CamperLogBook.xcodeproj -scheme CamperLogBook -destination 'platform=iOS Simulator,name=iPhone 16,OS=latest' CODE_SIGNING_ALLOWED=NO"
;;
node)
CMD="npm test --if-present"
;;
python)
CMD="pytest -q"
;;
*)
CMD="echo 'No test command configured for custom repo_type'"
;;
esac
fi
eval "$CMD"
- run: echo "ci ok for ${{ inputs.repo_type }}"
security-scan:
name: security-scan
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
pull-requests: read
steps:
- name: Checkout caller repository
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Gitleaks
uses: gitleaks/gitleaks-action@v2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Semgrep
uses: returntocorp/semgrep-action@v1
with:
config: p/default
- name: Dependency Review
if: ${{ github.event_name == 'pull_request' }}
uses: actions/dependency-review-action@v4
- run: echo "security-scan ok"
ai-review:
name: ai-review
if: ${{ github.event_name == 'pull_request' }}
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: read
issues: read
steps:
- name: Validate ChatGPT and Claude review status
uses: actions/github-script@v7
with:
script: |
const owner = context.repo.owner;
const repo = context.repo.repo;
const pull_number = context.payload.pull_request
? context.payload.pull_request.number
: context.payload.issue?.number;
if (!pull_number) {
core.setFailed("No pull request context found for ai-review validation.");
return;
}
const pr = await github.rest.pulls.get({ owner, repo, pull_number });
const comments = await github.paginate(github.rest.issues.listComments, {
owner,
repo,
issue_number: pull_number,
per_page: 100
});
const bodyParts = [pr.data.body || "", ...comments.map(c => c.body || "")];
const allText = bodyParts.join("\n\n").toLowerCase();
const hasSection = (name) => allText.includes(`### ${name}`.toLowerCase());
const hasPass = (name) => {
const regex = new RegExp(`###\\s*${name}[\\s\\S]*?dod status\\s*:\\s*pass`, "i");
return bodyParts.some(part => regex.test(part || ""));
};
const hasZeroBlocker = (name) => {
const regex = new RegExp(`###\\s*${name}[\\s\\S]*?blocker\\s*:\\s*0`, "i");
return bodyParts.some(part => regex.test(part || ""));
};
const hasZeroMajor = (name) => {
const regex = new RegExp(`###\\s*${name}[\\s\\S]*?major\\s*:\\s*0`, "i");
return bodyParts.some(part => regex.test(part || ""));
};
const checks = [
{ name: "ChatGPT", section: hasSection("ChatGPT"), pass: hasPass("ChatGPT"), blocker: hasZeroBlocker("ChatGPT"), major: hasZeroMajor("ChatGPT") },
{ name: "Claude", section: hasSection("Claude"), pass: hasPass("Claude"), blocker: hasZeroBlocker("Claude"), major: hasZeroMajor("Claude") }
];
const failures = checks.flatMap(c => {
const missing = [];
if (!c.section) missing.push("missing section");
if (!c.pass) missing.push("missing `DoD status: PASS`");
if (!c.blocker) missing.push("missing `Blocker: 0`");
if (!c.major) missing.push("missing `Major: 0`");
return missing.length ? [`${c.name}: ${missing.join(", ")}`] : [];
});
if (failures.length) {
core.setFailed(`AI review gate failed:\n- ${failures.join("\n- ")}`);
} else {
core.info("AI review gate passed.");
}
- run: echo "ai-review ok"