nodyx/.github/workflows/ci.yml at 7af97570f58e496239b6c4d2e7f1a8bd02f85965 · Pokled/nodyx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Annule le run précédent sur la même branche si un nouveau push arrive
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

# Le job CI ne fait que lire les sources et exécuter les tests. Aucun besoin
# d'écrire au repo ou de toucher aux secrets autres que le GITHUB_TOKEN par
# défaut. Permission minimale pour réduire la surface en cas d'injection
# (scénario Megalodon : payload base64 dans yaml qui exfiltre le GITHUB_TOKEN).
permissions:
  contents: read

jobs:
  # ── 1. nodyx-core — TypeScript + Vitest ────────────────────────────────────
  test-node:
    name: "nodyx-core — typecheck + tests"
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup Node.js 22
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: nodyx-core/package-lock.json

      - name: Install dependencies
        working-directory: nodyx-core
        run: npm ci

      - name: TypeScript — typecheck
        working-directory: nodyx-core
        run: npx tsc --noEmit

      - name: Vitest — 181 tests attendus
        working-directory: nodyx-core
        # Valeur factice, requise par le bootstrap backend qui refuse de
        # démarrer sans JWT_SECRET >= 32 chars. La prod utilise son propre
        # secret dans son .env, jamais dans le repo. Cette chaîne n'a
        # aucun privilège : container CI éphémère, aucune DB derrière,
        # aucun JWT forgé avec ça ne sera valide ailleurs que dans le
        # runner GitHub jetable.
        env:
          JWT_SECRET: CI_PLACEHOLDER_NOT_A_REAL_SECRET_safe_to_be_public
          NODE_ENV: test
        run: npm test

  # ── 2. nodyx-frontend — Svelte typecheck + build ───────────────────────────
  check-frontend:
    name: "nodyx-frontend — typecheck + build"
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Setup Node.js 22
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '22'
          cache: 'npm'
          cache-dependency-path: nodyx-frontend/package-lock.json

      - name: Install dependencies
        working-directory: nodyx-frontend
        run: npm ci

      - name: Svelte — typecheck (svelte-check)
        working-directory: nodyx-frontend
        env:
          PUBLIC_API_URL: http://localhost:3000/api/v1
          PUBLIC_DIRECTORY_URL: https://nodyx.org
          PUBLIC_SIGNET_URL: ''
          PUBLIC_TURN_URL: ''
          PUBLIC_TURN_USERNAME: ''
          PUBLIC_TURN_CREDENTIAL: ''
          PUBLIC_GIPHY_KEY: ''
          PUBLIC_TENOR_KEY: ''
          PRIVATE_API_SSR_URL: 'http://localhost:3000'
        run: npm run check

      - name: SvelteKit — build production
        working-directory: nodyx-frontend
        env:
          PUBLIC_API_URL: http://localhost:3000/api/v1
          PUBLIC_DIRECTORY_URL: https://nodyx.org
          PUBLIC_SIGNET_URL: ''
          PUBLIC_TURN_URL: ''
          PUBLIC_TURN_USERNAME: ''
          PUBLIC_TURN_CREDENTIAL: ''
          PUBLIC_GIPHY_KEY: ''
          PUBLIC_TENOR_KEY: ''
          PRIVATE_API_SSR_URL: 'http://localhost:3000'
        run: npm run build

  # ── 3. nodyx-p2p — Rust build + tests ─────────────────────────────────────
  test-rust:
    name: "nodyx-p2p — cargo build + tests"
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Rust toolchain (stable, depuis rust-toolchain.toml)
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable @ 2026-XX

      - name: Cache Rust (registry + target)
        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
        with:
          workspaces: nodyx-p2p

      - name: cargo build -p nodyx-server
        working-directory: nodyx-p2p
        run: cargo build -p nodyx-server

      - name: cargo test -p nodyx-server — 18 tests attendus
        working-directory: nodyx-p2p
        run: cargo test -p nodyx-server