PiWorker-OS/.github/workflows/ci.yml at main · AIX-Format/PiWorker-OS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
name: PiWorker-OS Sovereign CI

on:
  push:
    branches: ["main", "release/**"]
  pull_request:
    branches: ["main", "release/**"]

permissions:
  contents: read

jobs:
  changes:
    name: Detect API/proto changes
    runs-on: ubuntu-latest
    outputs:
      api_or_proto_changed: ${{ steps.filter.outputs.api_or_proto }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Filter paths
        id: filter
        uses: dorny/paths-filter@v3
        with:
          filters: |
            api_or_proto:
              - 'api/**'
              - '**/*.proto'
              - 'sidecar/sovereign-engine/pkg/pb/**'

  build:
    name: Build & Security Audit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22.x"

      - name: Install dependencies
        run: npm install --ignore-scripts --no-audit --no-fund --legacy-peer-deps

      - name: Enforce npm audit policy (fail on high/critical)
        run: npm audit --audit-level=high --omit=dev

      - name: Targeted Performance SLO Profiling
        run: npm run profile:slo

      - name: Contract Sync Validation
        run: npm run contracts:check

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.25.10"
          cache-dependency-path: go.sum

      - name: Verify Go module integrity
        run: go mod verify

      - name: Enforce Go vulnerability policy
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck ./...

      - name: Typecheck (Node)
        run: npm run typecheck

      - name: Build (Node)
        run: npm run build:sovereign

      - name: Build (Go CLI)
        run: npm run build:cli

      - name: Build Sovereign Engine (Go)
        run: |
          chmod +x scripts/build-sovereign-engine.sh
          ./scripts/build-sovereign-engine.sh

      - name: Secret scan (Secretlint)
        run: npx secretlint "**/*"

      - name: Static scan (Semgrep)
        run: |
          python -m pip install --upgrade pip
          pip install semgrep
          semgrep --config p/owasp-top-ten --error

      - name: Vulnerability scan (Trivy)
        uses: aquasecurity/trivy-action@v0.24.0
        with:
          scan-type: fs
          scan-ref: .
          severity: CRITICAL,HIGH
          ignore-unfixed: true
          format: table
          exit-code: 1

      - name: Artifact sanity checks
        run: |
          test -s bin/piworker-cli
          test -s bin/sovereign-engine
          test -f sidecar/sovereign-engine/Dockerfile

      - name: Generate release checklist
        run: |
          cat > release-checklist.md <<'EOF2'
          # Release Checklist

          ## Build & verification matrix
          - Node typecheck
          - Go build (CLI + sovereign engine)
          - Security scans (Secretlint + Semgrep + Trivy + govulncheck + npm audit)
          - Targeted Performance SLO Profiling
          - Contract Sync Validation
          - Artifact sanity checks

          ## Deployment
          - Managed outside GitHub Actions; no deploy secrets enforced here.
          EOF2

      - name: Upload release checklist artifact
        uses: actions/upload-artifact@v4
        with:
          name: release-checklist
          path: release-checklist.md
          if-no-files-found: error

  contract-tests:
    name: Contract tests for API/proto changes
    needs: changes
    if: needs.changes.outputs.api_or_proto_changed == 'true'
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22.x"
      - name: Install dependencies
        run: npm install --ignore-scripts --no-audit --no-fund --legacy-peer-deps
      - name: Contract sync check
        run: npm run contracts:check
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: "1.25.10"
          cache-dependency-path: go.sum
      - name: API package tests
        run: go test ./api/...