diff --git a/.github/workflows/repo-pipeline.yml b/.github/workflows/repo-pipeline.yml index 3f13834..85f06be 100644 --- a/.github/workflows/repo-pipeline.yml +++ b/.github/workflows/repo-pipeline.yml @@ -8,16 +8,6 @@ on: required: false type: string default: ios - xcode_project: - description: Xcode project path for ios repos - required: false - type: string - default: CamperLogBook.xcodeproj - xcode_scheme: - description: Xcode scheme for ios repos - required: false - type: string - default: CamperLogBook lint_command: description: Optional lint command override required: false @@ -37,97 +27,79 @@ on: jobs: ci: name: ci - runs-on: ubuntu-latest + runs-on: ${{ inputs.repo_type == 'ios' && 'macos-15' || 'ubuntu-latest' }} steps: - name: Checkout caller repository uses: actions/checkout@v4 - - name: Resolve commands - id: resolve - shell: bash - run: | - set -euo pipefail - repo_type='${{ inputs.repo_type }}' - lint='${{ inputs.lint_command }}' - build='${{ inputs.build_command }}' - test='${{ inputs.test_command }}' - xcode_project='${{ inputs.xcode_project }}' - xcode_scheme='${{ inputs.xcode_scheme }}' - - if [ -z "$lint" ]; then - case "$repo_type" in - ios) - lint="echo 'No default ios lint command on ubuntu runner. Set lint_command override if needed.'" - ;; - node) - lint="npm run lint --if-present" - ;; - python) - lint="python3 -m pip install -U pip && python3 -m pip install ruff && ruff check ." - ;; - *) - lint="echo 'No lint default for repo_type=$repo_type'" - ;; - esac - fi - - if [ -z "$build" ]; then - case "$repo_type" in - ios) - build="echo 'No default ios build command on ubuntu runner. Use Xcode Cloud or set build_command override.'" - ;; - node) - build="npm run build --if-present" - ;; - python) - build="echo 'No default build step for python'" - ;; - *) - build="echo 'No build default for repo_type=$repo_type'" - ;; - esac - fi - - if [ -z "$test" ]; then - case "$repo_type" in - ios) - test="echo 'No default ios test command on ubuntu runner. Use Xcode Cloud or set test_command override.'" - ;; - node) - test="npm test --if-present" - ;; - python) - test="pytest -q" - ;; - *) - test="echo 'No test default for repo_type=$repo_type'" - ;; - esac - fi - - { - echo "lint=$lint" - echo "build=$build" - echo "test=$test" - } >> "$GITHUB_OUTPUT" - - name: Lint shell: bash run: | set -euo pipefail - eval "${{ steps.resolve.outputs.lint }}" + CMD='${{ inputs.lint_command }}' + if [ -z "$CMD" ]; then + case '${{ inputs.repo_type }}' in + ios) + CMD="if which swiftlint > /dev/null; then swiftlint --strict; else brew install swiftlint && swiftlint --strict; fi" + ;; + node) + CMD="npm run lint --if-present" + ;; + python) + CMD="python -m pip install -U pip && pip install ruff && ruff check ." + ;; + *) + CMD="echo 'No lint command configured for custom repo_type'" + ;; + esac + fi + eval "$CMD" - name: Build shell: bash run: | set -euo pipefail - eval "${{ steps.resolve.outputs.build }}" + CMD='${{ inputs.build_command }}' + if [ -z "$CMD" ]; then + case '${{ inputs.repo_type }}' in + ios) + CMD="xcodebuild build -project CamperLogBook.xcodeproj -scheme CamperLogBook -destination 'platform=iOS Simulator,name=iPhone 16,OS=latest' CODE_SIGNING_ALLOWED=NO" + ;; + node) + CMD="npm run build --if-present" + ;; + python) + CMD="echo 'No build step for python default'" + ;; + *) + CMD="echo 'No build command configured for custom repo_type'" + ;; + esac + fi + eval "$CMD" - name: Test shell: bash run: | set -euo pipefail - eval "${{ steps.resolve.outputs.test }}" + CMD='${{ inputs.test_command }}' + if [ -z "$CMD" ]; then + case '${{ inputs.repo_type }}' in + ios) + CMD="xcodebuild test -project CamperLogBook.xcodeproj -scheme CamperLogBook -destination 'platform=iOS Simulator,name=iPhone 16,OS=latest' CODE_SIGNING_ALLOWED=NO" + ;; + node) + CMD="npm test --if-present" + ;; + python) + CMD="pytest -q" + ;; + *) + CMD="echo 'No test command configured for custom repo_type'" + ;; + esac + fi + eval "$CMD" security-scan: name: security-scan @@ -142,38 +114,18 @@ jobs: with: fetch-depth: 0 - - name: Install gitleaks - shell: bash - run: | - set -euo pipefail - GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep '"tag_name"' | sed -E 's/.*"v([^"]+)".*/\1/') - curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar -xz - sudo mv gitleaks /usr/local/bin/gitleaks - gitleaks version + - name: Gitleaks + uses: gitleaks/gitleaks-action@v2 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Gitleaks scan - shell: bash - run: | - set -euo pipefail - gitleaks detect --source . --no-git --verbose - - - name: Install Semgrep - shell: bash - run: | - set -euo pipefail - python3 -m pip install --upgrade pip - python3 -m pip install semgrep - semgrep --version - - - name: Semgrep scan - shell: bash - run: | - set -euo pipefail - semgrep --config p/default --error + - name: Semgrep + uses: returntocorp/semgrep-action@v1 + with: + config: p/default - name: Dependency Review if: ${{ github.event_name == 'pull_request' }} - continue-on-error: true uses: actions/dependency-review-action@v4 ai-review: @@ -182,104 +134,9 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - pull-requests: write - issues: write + pull-requests: read + issues: read steps: - # Claude review is performed locally by Claude Code before the PR is merged. - # See CLAUDE.md in the repository for the process. - - - name: Generate ChatGPT review - env: - OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} - GITHUB_TOKEN: ${{ github.token }} - PR_NUMBER: ${{ github.event.pull_request.number }} - REPO: ${{ github.repository }} - PR_TITLE: ${{ github.event.pull_request.title }} - run: | - set -euo pipefail - if [ -z "${OPENAI_API_KEY:-}" ]; then - echo "::notice::OPENAI_API_KEY not set – ChatGPT review skipped" - exit 0 - fi - python3 << 'PYEOF' - import os, json, urllib.request - - token = os.environ["GITHUB_TOKEN"] - repo = os.environ["REPO"] - pr_num = os.environ["PR_NUMBER"] - headers_gh = {"Authorization": f"Bearer {token}", "User-Agent": "vanity-dev-engine", - "Accept": "application/vnd.github.v3+json"} - - # Skip if ChatGPT review already exists - req = urllib.request.Request( - f"https://api.github.com/repos/{repo}/issues/{pr_num}/comments?per_page=100", - headers=headers_gh) - with urllib.request.urlopen(req) as r: - comments = json.loads(r.read()) - if any("### ChatGPT" in (c.get("body") or "") for c in comments): - print("ChatGPT review already present – skipping generation.") - raise SystemExit(0) - - # Fetch PR diff - req_diff = urllib.request.Request( - f"https://api.github.com/repos/{repo}/pulls/{pr_num}", - headers={**headers_gh, "Accept": "application/vnd.github.v3.diff"}) - with urllib.request.urlopen(req_diff) as r: - diff = r.read().decode("utf-8", errors="replace")[:12000] - - # Fetch PR body - req_pr = urllib.request.Request( - f"https://api.github.com/repos/{repo}/pulls/{pr_num}", headers=headers_gh) - with urllib.request.urlopen(req_pr) as r: - pr_data = json.loads(r.read()) - pr_body = (pr_data.get("body") or "")[:800] - - prompt = f"""You are a senior iOS Swift developer reviewing a pull request. - Analyse the changes carefully and write a concise code review. - - PR title: {os.environ["PR_TITLE"]} - PR description: {pr_body} - - Git diff (may be truncated): - {diff} - - Reply with EXACTLY this structure – no deviations: - - ### ChatGPT - - DoD status: PASS - Blocker: 0 - Major: 0 - - - - Only set DoD status to FAIL or raise Blocker/Major above 0 when you find - real defects that must be fixed before merging.""" - - payload = json.dumps({ - "model": "gpt-4o", - "max_tokens": 1500, - "messages": [{"role": "user", "content": prompt}] - }).encode() - req_ai = urllib.request.Request( - "https://api.openai.com/v1/chat/completions", data=payload, - headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}", - "content-type": "application/json"}) - with urllib.request.urlopen(req_ai) as r: - review = json.loads(r.read())["choices"][0]["message"]["content"] - - # Post comment - body_payload = json.dumps({"body": review}).encode() - req_post = urllib.request.Request( - f"https://api.github.com/repos/{repo}/issues/{pr_num}/comments", - data=body_payload, - headers={**headers_gh, "Content-Type": "application/json"}) - with urllib.request.urlopen(req_post) as r: - result = json.loads(r.read()) - print(f"ChatGPT review posted: {result['html_url']}") - PYEOF - - name: Validate ChatGPT and Claude review status uses: actions/github-script@v7 with: diff --git a/README.md b/README.md index 2b7e530..d2f18ea 100644 --- a/README.md +++ b/README.md @@ -9,30 +9,19 @@ Use from another repository: ```yaml jobs: use-vanity-dev-engine: - uses: OliverGiertz/vanity-dev-engine/.github/workflows/repo-pipeline.yml@v1.5 + uses: OliverGiertz/vanity-dev-engine/.github/workflows/repo-pipeline.yml@v1.2 + secrets: inherit with: repo_type: ios - xcode_project: CamperLogBook.xcodeproj - xcode_scheme: CamperLogBook ``` -## Inputs +Optional inputs: -- `repo_type`: `ios`, `node`, `python`, `custom` -- `xcode_project`: Xcode project path for iOS repos -- `xcode_scheme`: Xcode scheme for iOS repos -- `lint_command`: optional override -- `build_command`: optional override -- `test_command`: optional override +- `repo_type` (`ios`, `node`, `python`, `custom`) +- `lint_command` +- `build_command` +- `test_command` -## Produced checks +Optional control: -- `use-vanity-dev-engine / ci` -- `use-vanity-dev-engine / security-scan` -- `use-vanity-dev-engine / ai-review` - -## Consumer toggle - -Set repository variable `USE_VANITY_DEV_ENGINE=true` in consumer repos to activate central execution. - -Note: The default CI runner is `ubuntu-latest`. For iOS repositories, provide explicit `build_command` and `test_command` overrides (or use Xcode Cloud for build/test). +- set repository variable `USE_VANITY_DEV_ENGINE=true` in consumer repos.