Merge pull request #1209 from arnonrdp/dependabot/npm_and_yarn/webapp… #616
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Required Checks | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - dev | |
| pull_request: | |
| branches: | |
| - main | |
| - staging | |
| workflow_call: | |
| jobs: | |
| security-critical: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Set up PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: 8.4 | |
| extensions: mbstring, xml, ctype, iconv, intl, pdo, zip | |
| tools: composer:v2 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '24' | |
| cache: 'yarn' | |
| cache-dependency-path: webapp/yarn.lock | |
| # Backend security checks | |
| - name: Prepare Laravel directories | |
| working-directory: ./api | |
| run: | | |
| mkdir -p bootstrap/cache | |
| chmod -R 755 bootstrap/cache | |
| mkdir -p storage/logs storage/framework/cache storage/framework/sessions storage/framework/views | |
| chmod -R 755 storage | |
| - name: Install API dependencies | |
| working-directory: ./api | |
| run: composer install --prefer-dist --no-interaction --ignore-platform-reqs | |
| - name: Run Composer security audit | |
| working-directory: ./api | |
| continue-on-error: true | |
| run: | | |
| echo "🔍 Running security audit..." | |
| # Check for vulnerabilities | |
| composer audit --format=table || echo "::warning::Security vulnerabilities found in API dependencies" | |
| echo "✅ Security audit completed (warnings only)" | |
| # Frontend security checks | |
| - name: Install webapp dependencies | |
| working-directory: ./webapp | |
| run: yarn install --frozen-lockfile --prefer-offline | |
| - name: Run Yarn security audit | |
| working-directory: ./webapp | |
| continue-on-error: true | |
| run: | | |
| echo "🔍 Running webapp security audit..." | |
| # Run yarn audit | |
| yarn audit || echo "::warning::Security vulnerabilities found in webapp dependencies" | |
| echo "✅ Security audit completed (warnings only)" | |
| # Check for exposed secrets | |
| - name: Scan for exposed secrets | |
| run: | | |
| echo "🔍 Scanning for exposed secrets..." | |
| # Check for real secrets (exclude Vue/HTML files where :key= is a directive) | |
| EXPOSED_SECRETS=$(grep -r --exclude-dir=node_modules --exclude-dir=vendor --exclude-dir=.git \ | |
| --exclude='*.vue' --exclude='*.html' \ | |
| -E "(password|secret|api_key|api_secret|auth_token)\s*[:=]\s*['\"][^'\"]{20,}" . || echo "") | |
| if [ -n "$EXPOSED_SECRETS" ]; then | |
| echo "❌ CRITICAL: Exposed secrets found in code!" | |
| echo "$EXPOSED_SECRETS" | |
| exit 1 | |
| fi | |
| echo "✅ No exposed secrets detected" | |
| essential-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Set up PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: 8.4 | |
| extensions: mbstring, xml, ctype, iconv, intl, pdo, pdo_mysql, pdo_sqlite, zip, gmp | |
| tools: composer:v2 | |
| - name: Cache composer dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: | | |
| api/vendor | |
| ~/.composer/cache | |
| key: composer-tests-${{ runner.os }}-${{ hashFiles('api/composer.lock') }} | |
| restore-keys: | | |
| composer-tests-${{ runner.os }}- | |
| composer-${{ runner.os }}- | |
| - name: Prepare Laravel directories | |
| working-directory: ./api | |
| run: | | |
| mkdir -p bootstrap/cache | |
| chmod -R 755 bootstrap/cache | |
| mkdir -p storage/logs storage/framework/cache storage/framework/sessions storage/framework/views | |
| chmod -R 755 storage | |
| - name: Install dependencies | |
| working-directory: ./api | |
| run: composer install --prefer-dist --no-interaction --optimize-autoloader --ignore-platform-reqs | |
| - name: Copy .env file | |
| working-directory: ./api | |
| run: cp .env.example .env | |
| - name: Generate encryption key | |
| working-directory: ./api | |
| run: php artisan key:generate --ansi | |
| - name: Directory Permissions | |
| working-directory: ./api | |
| run: chmod -R 755 storage bootstrap/cache | |
| - name: Create SQLite database | |
| working-directory: ./api | |
| run: touch database/database.sqlite | |
| - name: Run essential tests (fast) | |
| working-directory: ./api | |
| run: | | |
| # Run essential tests | |
| php artisan test --stop-on-failure | |
| echo "✅ Essential tests passed" | |
| typescript-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '24' | |
| cache: 'yarn' | |
| cache-dependency-path: webapp/yarn.lock | |
| - name: Install dependencies | |
| working-directory: ./webapp | |
| run: yarn install --frozen-lockfile --prefer-offline | |
| - name: TypeScript check | |
| working-directory: ./webapp | |
| run: | | |
| echo "🔍 Running TypeScript validation..." | |
| yarn type-check | |
| echo "✅ TypeScript validation passed" | |
| - name: Build test | |
| working-directory: ./webapp | |
| run: | | |
| echo "🔍 Testing production build..." | |
| yarn build | |
| echo "✅ Production build successful" | |
| # Summary job | |
| required-checks-summary: | |
| runs-on: ubuntu-latest | |
| needs: [security-critical, essential-tests, typescript-check] | |
| if: always() | |
| steps: | |
| - name: Check all required checks passed | |
| run: | | |
| if [[ "${{ needs.security-critical.result }}" != "success" ]]; then | |
| echo "❌ Security checks failed" | |
| exit 1 | |
| fi | |
| if [[ "${{ needs.essential-tests.result }}" != "success" ]]; then | |
| echo "❌ Essential tests failed" | |
| exit 1 | |
| fi | |
| if [[ "${{ needs.typescript-check.result }}" != "success" ]]; then | |
| echo "❌ TypeScript/Build checks failed" | |
| exit 1 | |
| fi | |
| echo "✅ All required checks passed" |