From 26ca11115378ea211ed2891190a9759b1c5ea2fe Mon Sep 17 00:00:00 2001 From: copilotcoder Date: Wed, 1 Jul 2026 18:41:11 -0400 Subject: [PATCH] ci: run unified source gate via pre-commit --- .gitea/workflows/cicd-source-checks.yaml | 162 ++++++++--------------- 1 file changed, 52 insertions(+), 110 deletions(-) diff --git a/.gitea/workflows/cicd-source-checks.yaml b/.gitea/workflows/cicd-source-checks.yaml index 74d8c0a..c38432d 100644 --- a/.gitea/workflows/cicd-source-checks.yaml +++ b/.gitea/workflows/cicd-source-checks.yaml @@ -128,10 +128,10 @@ jobs: echo "=== Kernel Tail ===" dmesg | tail -n 120 || true - backend-source-checks: - name: Backend Source Checks (format/lint/type) + source-precommit-checks: + name: Source Pre-commit Checks (backend+frontend) runs-on: ubuntu-act - timeout-minutes: 25 + timeout-minutes: 40 needs: setup steps: - name: Identify runner @@ -175,128 +175,70 @@ jobs: echo "Using fetched HEAD_SHA checkout: ${HEAD_SHA}" else git checkout HEAD -- . - echo "Falling back to default branch HEAD for backend source checkout" + echo "Falling back to default branch HEAD for source checks checkout" fi + test -f .pre-commit-config.yaml || { + echo "❌ Missing .pre-commit-config.yaml after checkout" + exit 1 + } + test -f backend/pyproject.toml || { echo "❌ Missing backend/pyproject.toml after checkout" - find . -maxdepth 3 -type f | sort | head -n 80 exit 1 } - # Ensure containerized checks can read workspace even under rootless/remapped Docker. - chmod -R a+rX backend - - - name: Run backend format/lint/type checks - run: | - set -e - echo "Verifying backend workspace before container run" - ls -la backend | head -n 40 - test -f README.md || { - echo "❌ Missing repository README.md required by backend build metadata" - exit 1 - } - - echo "Packaging backend source for container execution" - tar -czf /tmp/backend-src.tgz README.md backend - - echo "Running backend checks in python:3.14-slim via streamed source archive" - docker run --rm -i python:3.14-slim sh -euxc ' - mkdir -p /workspace - tar -xzf - -C /workspace - cd /workspace/backend - test -f pyproject.toml - apt-get update -qq - apt-get install -y -qq --no-install-recommends libatomic1 - python -m pip install --disable-pip-version-check --no-cache-dir uv - uv sync --dev - uv run ruff format --check . - uv run ruff check . - uv run pyright . - ' < /tmp/backend-src.tgz - - - *failure_diagnostics_step - - frontend-source-checks: - name: Frontend Source Checks (format/lint/type) - runs-on: ubuntu-act - timeout-minutes: 25 - needs: setup - steps: - - name: Identify runner - run: | - echo "=== Runner Identity ===" - echo "runner_name=${RUNNER_NAME:-}" - echo "runner_name_hint=${GITEA_RUNNER_NAME:-${ACT_RUNNER_NAME:-${RUNNER_NAME:-unknown}}}" - echo "runner_hostname_env=${HOSTNAME:-unknown}" - echo "runner_uname_n=$(uname -n 2>/dev/null || echo unknown)" - echo "runner_etc_hostname=$(cat /etc/hostname 2>/dev/null || echo unknown)" - echo "runner_os=${RUNNER_OS:-unknown}" - echo "runner_arch=${RUNNER_ARCH:-unknown}" - echo "timestamp_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)" - - - name: Configure registry host resolution - run: | - if ! grep -q "${GITEA_REGISTRY_HOST}" /etc/hosts; then - echo "${GITEA_REGISTRY_IP} ${GITEA_REGISTRY_HOST}" >> /etc/hosts - fi - - - name: Checkout source snapshot - env: - SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }} - HEAD_SHA: ${{ needs.setup.outputs.head_sha }} - run: | - set -e - umask 022 - trap 'rm -f ~/.ssh/id_rsa' EXIT - - mkdir -p ~/.ssh - echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa - chmod 600 ~/.ssh/id_rsa - ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null - - GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \ - git clone --depth 1 --no-checkout "${GITEA_REPO_SSH_URL}" . - - if GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \ - git fetch --depth 1 origin "${HEAD_SHA}" >/dev/null 2>&1; then - git checkout FETCH_HEAD -- . - echo "Using fetched HEAD_SHA checkout: ${HEAD_SHA}" - else - git checkout HEAD -- . - echo "Falling back to default branch HEAD for frontend source checkout" - fi - test -f frontend/package.json || { echo "❌ Missing frontend/package.json after checkout" find . -maxdepth 3 -type f | sort | head -n 80 exit 1 } - # Ensure containerized checks can read workspace even under rootless/remapped Docker. - chmod -R a+rX frontend - - - name: Run frontend format/lint/type checks + - name: Bootstrap source-check toolchain run: | - set -e - echo "Verifying frontend workspace before container run" - ls -la frontend | head -n 40 + set -euo pipefail - echo "Packaging frontend source for container execution" - tar -czf /tmp/frontend-src.tgz -C frontend . + if ! command -v curl >/dev/null 2>&1; then + apt-get update -qq + apt-get install -y -qq curl ca-certificates + fi - echo "Running frontend checks in node:24-bullseye via streamed source archive" - docker run --rm -i node:24-bullseye sh -euxc ' - mkdir -p /workspace/frontend - tar -xzf - -C /workspace/frontend - cd /workspace/frontend - test -f package.json - corepack enable - yarn install --immutable || yarn install - yarn prettier --check src/ - yarn lint - yarn type-check - ' < /tmp/frontend-src.tgz + # Install uv if missing and expose it for subsequent steps. + if ! command -v uv >/dev/null 2>&1; then + curl -LsSf https://astral.sh/uv/install.sh | sh + fi + export PATH="$HOME/.local/bin:$PATH" + echo "$HOME/.local/bin" >> "$GITHUB_PATH" + + # Ensure node/corepack is available for frontend and pre-commit hooks. + if ! command -v node >/dev/null 2>&1; then + apt-get update -qq + apt-get install -y -qq nodejs npm + fi + if ! command -v corepack >/dev/null 2>&1; then + npm install -g corepack + fi + + corepack enable + + - name: Install backend and frontend dependencies + run: | + set -euo pipefail + export PATH="$HOME/.local/bin:$PATH" + + cd backend + uv sync --dev + cd ../frontend + yarn install --immutable || yarn install + + - name: Run pre-commit source checks + env: + CI: "true" + run: | + set -euo pipefail + export PATH="$HOME/.local/bin:$PATH" + cd backend + uv run pre-commit run --all-files --config ../.pre-commit-config.yaml - *failure_diagnostics_step @@ -304,7 +246,7 @@ jobs: name: Dispatch Downstream Build runs-on: ubuntu-act timeout-minutes: 10 - needs: [setup, backend-source-checks, frontend-source-checks] + needs: [setup, source-precommit-checks] steps: - name: Identify runner run: |