sharang
8a35942aea
PLATFORM_ARCHITECTURE.md §5c schema, end-to-end:
enums: tenant_status (demo/trial/active/frozen/archived),
tenant_kind (customer/demo), idp_kind (oidc/saml),
tenant_project_status (active/archived)
tables: tenants id/slug/name/status/kind/plan/erp_id/
stripe_id/trial_ends_at/contract_dates/
sales_owner
tenant_projects sub-tenancy (GCP-Project style); opt-in
via product manifest.supports_projects=true
tenant_products tenant ↔ product matrix + JSONB config
tenant_idp_config enterprise SSO (OIDC/SAML metadata)
api_keys argon2 hash + prefix + scopes + revoked_at
audit_log Retraced-compatible; indexed for cross-
product filtering per §8.4
triggers: updated_at auto-bump on every mutable table
fks: ON DELETE CASCADE for owned rows; SET NULL for audit_log
cmd/migrate (new binary): golang-migrate as a library with migrations
embedded via migrations/embed.go; subcommands up/down/version/force.
Ships as a self-contained Orca init container in prod.
Tests (require Docker; gated by -short):
TestMigrate_upDownRoundTrip schema → 6 tables + 4 enums; down→
empty; up-after-down clean
TestSeed_canInsertAndQuery insert across every table; FK cascade;
audit_log SET-NULL keeps the row
TestSlugConstraint regex rejects too-short / leading dash /
trailing dash / uppercase / underscore
Makefile: migrate-up/down/down-all/version/create NAME=...; test-short
to skip integration when Docker isn't around; build-migrate for just
the migrator.
CI: pin golangci-lint to v2.12.2 (Go 1.25-compatible) + bump
golangci-lint-action to v7 (v6 rejects v2.x).
The handler-layer in-memory store is unchanged; M4.2 swaps it for the
pgx-backed implementation against this schema.
Refs: M4.1
120 lines
3.9 KiB
YAML
120 lines
3.9 KiB
YAML
# CI for Go services on Gitea Actions.
|
|
# `shared` always runs; `test` and `image` activate when go.sum lands.
|
|
name: ci
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
shared:
|
|
runs-on: docker
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with: { fetch-depth: 0 }
|
|
|
|
- name: commitlint (PR only)
|
|
if: github.event_name == 'pull_request'
|
|
shell: bash
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
pattern='^(feat|fix|docs|chore|refactor|test|perf|build|ci|revert)(\([a-z0-9_/.-]+\))?!?: .{1,72}$'
|
|
bad=0
|
|
while IFS= read -r subject; do
|
|
if ! [[ "$subject" =~ $pattern ]]; then
|
|
echo "::error::Commit subject does not match Conventional Commits: $subject"
|
|
bad=$((bad+1))
|
|
fi
|
|
done < <(git log --format=%s "${BASE_SHA}..${HEAD_SHA}")
|
|
if [ "$bad" -gt 0 ]; then
|
|
echo "::error::$bad commit(s) failed commitlint."
|
|
exit 1
|
|
fi
|
|
echo "commitlint: OK"
|
|
|
|
- name: gitleaks
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
GL_VERSION=8.18.4
|
|
curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GL_VERSION}/gitleaks_${GL_VERSION}_linux_x64.tar.gz" \
|
|
| tar -xz -C /tmp gitleaks
|
|
/tmp/gitleaks detect --source . --no-banner --redact --verbose --exit-code 1
|
|
|
|
- name: trivy fs scan
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
TRIVY_VERSION=0.70.0
|
|
curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" \
|
|
| tar -xz -C /tmp trivy
|
|
/tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist .
|
|
|
|
test:
|
|
runs-on: docker
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-go@v5
|
|
with: { go-version: '1.24' }
|
|
|
|
- name: fmt
|
|
run: test -z "$(gofmt -l .)"
|
|
|
|
- name: vet
|
|
run: go vet ./...
|
|
|
|
- name: lint
|
|
uses: golangci/golangci-lint-action@v6
|
|
# Pin to a version built on Go 1.25 — the runner's bundled tool
|
|
# is Go 1.24 and refuses to lint a 1.25 module.
|
|
with: { version: v2.12.2 }
|
|
|
|
- name: test
|
|
# Coverage scoped to ./internal/... — cmd/server is the entrypoint
|
|
# with signal-handling + bind that isn't worth unit-testing. When
|
|
# real integration tests land in M4.1, widen this back to ./...
|
|
run: go test -race -coverprofile=cover.out ./internal/...
|
|
|
|
- name: coverage gate
|
|
run: |
|
|
go tool cover -func=cover.out | tail -1 | awk '{ if ($3+0 < 70.0) { print "coverage below 70%"; exit 1 } }'
|
|
|
|
- name: build
|
|
run: go build ./...
|
|
|
|
image:
|
|
needs: [shared, test]
|
|
if: github.event_name == 'push' && github.ref == 'refs/heads/main' && hashFiles('Dockerfile') != ''
|
|
runs-on: docker
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: docker/login-action@v3
|
|
with:
|
|
registry: registry.breakpilot.com
|
|
username: ${{ secrets.REGISTRY_USER }}
|
|
password: ${{ secrets.REGISTRY_PASS }}
|
|
|
|
- uses: docker/build-push-action@v6
|
|
with:
|
|
push: true
|
|
tags: |
|
|
registry.breakpilot.com/${{ github.event.repository.name }}:sha-${{ github.sha }}
|
|
registry.breakpilot.com/${{ github.event.repository.name }}:env-stage
|
|
|
|
- uses: anchore/sbom-action@v0
|
|
with:
|
|
image: registry.breakpilot.com/${{ github.event.repository.name }}:sha-${{ github.sha }}
|
|
|
|
- name: orca deploy stage
|
|
run: orca apply --env=stage --image-tag=sha-${{ github.sha }}
|
|
env:
|
|
ORCA_TOKEN: ${{ secrets.ORCA_STAGE_TOKEN }}
|