Power NetView: a front door, and no session until the second factor i… #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| # Report every leg. A failure on one Python version is information, not a | |
| # reason to stop testing the others. | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.8", "3.10", "3.12"] | |
| # PostgreSQL for the server store tests (Q1: PostgreSQL only). | |
| # | |
| # Without this the store tests SKIP, and a skipped test in CI reads exactly | |
| # like a passing one on the summary page — which is the same | |
| # looks-clean-but-was-never-checked failure the whole product is built to | |
| # avoid. tests/test_server_store.py refuses to skip when CI=true, so a | |
| # service that fails to start is a red build rather than a quiet one. | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_USER: otfleet | |
| # Ephemeral, per-job container reachable only from this runner. | |
| POSTGRES_PASSWORD: ci-throwaway | |
| POSTGRES_DB: otfleet | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U otfleet -d otfleet" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| env: | |
| OT_TEST_DSN: postgresql://otfleet:ci-throwaway@localhost:5432/otfleet | |
| # The terminator test puts deploy/nginx/ot-fleet.conf in front of the | |
| # server in a container and attacks it. GitHub's ubuntu runners have | |
| # Docker, so a skip here means something is wrong with the runner rather | |
| # than with the test — and a skipped test on a summary page is | |
| # indistinguishable from a passing one. tests/test_terminator.py raises | |
| # at import when this is set and Docker is not usable. | |
| OT_TERMINATOR_REQUIRED: "1" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| working-directory: ot_scanner | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install -r requirements-dev.txt | |
| - name: Run tests | |
| working-directory: ot_scanner | |
| run: python -m pytest tests/ -v --tb=short | |
| - name: Confirm the store tests actually ran | |
| working-directory: ot_scanner | |
| # Belt and braces on top of the in-test guard: if the Postgres service | |
| # is unreachable these deselect to zero and the run would otherwise be | |
| # green having tested no SQL at all. | |
| run: | | |
| python -m pytest tests/test_server_store.py -q \ | |
| | tee /tmp/store.txt | |
| grep -qE "[0-9]+ passed" /tmp/store.txt | |
| ! grep -q "skipped" /tmp/store.txt | |
| # The console has its own job because it needs Node, and because the checks | |
| # that matter here are not "does it build" but "does it still refuse to | |
| # build the things it must refuse". OTS-CON-004 is enforced by the type | |
| # checker; a green Python matrix with no Node in it enforces nothing, and | |
| # test_console.py skips silently in exactly that situation. | |
| console: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: npm | |
| cache-dependency-path: console/package-lock.json | |
| - name: Install console dependencies | |
| working-directory: console | |
| run: npm ci | |
| - name: Type-check the console | |
| working-directory: console | |
| # This is the OTS-CON-004 gate. A metric rendered without its coverage | |
| # is a type error, so it fails here rather than reaching an operator as | |
| # a confident-looking tile. | |
| run: npm run typecheck | |
| - name: Build the console | |
| working-directory: console | |
| run: npm run build | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install test dependencies | |
| working-directory: ot_scanner | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install -r requirements-dev.txt | |
| - name: Run the console tests | |
| working-directory: ot_scanner | |
| # OT_CONSOLE_REQUIRED turns a skip into a hard error. Without it these | |
| # tests skip when Node is missing, and a skipped test on the summary | |
| # page reads exactly like a passing one — which would leave OTS-CON-004 | |
| # enforced by nothing while the badge stayed green. | |
| env: | |
| OT_CONSOLE_REQUIRED: "1" | |
| run: python -m pytest tests/test_console.py -v --tb=short | |
| - name: Prove the expect-errors harness still refuses to compile | |
| working-directory: console | |
| # Belt and braces on top of the test above: if this file ever compiles, | |
| # OTS-CON-004 has stopped being structural and has quietly become a | |
| # convention again. | |
| run: | | |
| if npx tsc --noEmit --strict --target ES2022 --module ES2022 --moduleResolution bundler --lib ES2022,DOM src/con004.expect-errors.ts; then | |
| echo "con004.expect-errors.ts COMPILED — OTS-CON-004 is no longer enforced" | |
| exit 1 | |
| fi |