MailStack/.github/workflows/ci.yml at main · vibtools/MailStack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: CI

"on":
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: mailstack-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  quality-and-security:
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: pip
          cache-dependency-path: mailbox-app/requirements/*.txt

      - name: System build dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y --no-install-recommends \
            default-libmysqlclient-dev \
            build-essential \
            pkg-config

      - name: Python dependencies
        run: |
          python -m pip install --disable-pip-version-check \
            -r mailbox-app/requirements/development.txt
          python -m pip check

      - name: Source safety audit
        run: python scripts/forensic_audit.py --root .

      - name: Documentation and metadata validation
        run: python scripts/check_docs.py

      - name: User documentation synchronization
        run: python scripts/manage_documents.py --root . check

      - name: Documentation system tests
        run: python scripts/test_documents.py

      - name: UI design intake integrity
        run: python scripts/manage_designs.py --root . check

      - name: UI design system tests
        run: python scripts/test_designs.py

      - name: Shared UI foundation contract tests
        run: python scripts/test_ui_foundation.py

      - name: Feature documentation policy
        env:
          DOCUMENTATION_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        run: python scripts/check_documentation_policy.py --head "$GITHUB_SHA"

      - name: Forensic file inventory
        run: python scripts/generate_inventory.py --root . --check

      - name: Deployment template validation
        run: python scripts/validate_templates.py

      - name: Installer contract tests
        run: python scripts/test_installer.py

      - name: Backup and operations contract tests
        run: python scripts/test_operations.py

      - name: Dependency vulnerability audit
        run: python -m pip_audit --no-deps -r mailbox-app/requirements/locked.txt --progress-spinner off

      - name: Ruff
        working-directory: mailbox-app
        run: ruff check .

      - name: Bandit
        working-directory: mailbox-app
        run: bandit -c .bandit -q -r apps config

      - name: Tests and coverage
        working-directory: mailbox-app
        env:
          DJANGO_SETTINGS_MODULE: config.settings.test
          COVERAGE_FILE: ${{ runner.temp }}/mailstack-standalone.coverage
        run: pytest --cov=apps --cov-report=term-missing --cov-fail-under=85

      - name: Contact service tests
        working-directory: public-site/contact_service
        run: python test_contact_app.py

      - name: Contact service Ruff
        run: python -m ruff check --config mailbox-app/pyproject.toml public-site/contact_service/contact_app.py

      - name: Contact service Bandit
        run: python -m bandit -c mailbox-app/.bandit -q public-site/contact_service/contact_app.py

      - name: Django checks
        working-directory: mailbox-app
        run: |
          python manage.py check --settings=config.settings.test
          python manage.py makemigrations --check --dry-run --settings=config.settings.test

      - name: Shell syntax
        run: find . -type f -name '*.sh' -print0 | xargs -0 -r -n1 bash -n

      - name: Full forensic gate
        run: python scripts/forensic_audit.py --root . --full

      - name: Deterministic release build
        run: python scripts/build_release.py --root .

      - name: Release verification
        run: |
          python scripts/verify_release.py \
            dist/mailstack-1.3.0-rc.1-source.zip \
            --checksum dist/mailstack-1.3.0-rc.1-source.zip.sha256