yuqei
a3bb78e06b
Security Quality Gate / npm audit, Bandit, pip-audit, detect-secrets (pull_request) Failing after 16m35s
95 lines
3.2 KiB
YAML
95 lines
3.2 KiB
YAML
name: Release Quality Gate
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
web_base_url:
|
|
description: "V2 web base URL"
|
|
required: false
|
|
default: "http://192.168.3.90:13000"
|
|
contract_api_base:
|
|
description: "Contract API base URL"
|
|
required: false
|
|
default: "http://192.168.3.90:18100"
|
|
ai_api_base:
|
|
description: "AI Platform API base URL"
|
|
required: false
|
|
default: "http://192.168.3.90:18101"
|
|
smoke_summary:
|
|
description: "Optional Docker smoke summary JSON path in the checked-out workspace"
|
|
required: false
|
|
default: ""
|
|
benchmark_summary:
|
|
description: "Optional interface benchmark summary JSON path in the checked-out workspace"
|
|
required: false
|
|
default: ""
|
|
run_benchmark:
|
|
description: "Run interface benchmark before validating the release gate"
|
|
required: false
|
|
default: "false"
|
|
type: choice
|
|
options:
|
|
- "false"
|
|
- "true"
|
|
max_smoke_summary_age_hours:
|
|
description: "Fail if Docker smoke summary is older than this many hours; 0 disables the age check"
|
|
required: false
|
|
default: "0"
|
|
max_benchmark_summary_age_hours:
|
|
description: "Fail if interface benchmark summary is older than this many hours; 0 disables the age check"
|
|
required: false
|
|
default: "0"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
release-quality-gate:
|
|
name: schema-check, Docker smoke summary, interface benchmark
|
|
runs-on: [self-hosted, yuqei-smoke]
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
# The release gate can validate local QA artifacts generated by smoke deploys
|
|
# on the self-hosted smoke runner. Keep ignored project-docs/qa-artifacts files.
|
|
clean: false
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Run release quality gate
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
args=(
|
|
--web-base-url "${{ inputs.web_base_url }}"
|
|
--contract-api-base "${{ inputs.contract_api_base }}"
|
|
--ai-api-base "${{ inputs.ai_api_base }}"
|
|
--artifact-dir "release-quality-gate-artifacts"
|
|
--max-smoke-summary-age-hours "${{ inputs.max_smoke_summary_age_hours }}"
|
|
--max-benchmark-summary-age-hours "${{ inputs.max_benchmark_summary_age_hours }}"
|
|
)
|
|
if [ -n "${{ inputs.smoke_summary }}" ]; then
|
|
args+=(--smoke-summary "${{ inputs.smoke_summary }}")
|
|
fi
|
|
if [ -n "${{ inputs.benchmark_summary }}" ]; then
|
|
args+=(--benchmark-summary "${{ inputs.benchmark_summary }}")
|
|
fi
|
|
if [ "${{ inputs.run_benchmark }}" = "true" ]; then
|
|
args+=(--run-benchmark)
|
|
fi
|
|
python yuqei-infra/scripts/run-release-quality-gate.py "${args[@]}"
|
|
|
|
- name: Upload release quality gate artifacts
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: release-quality-gate
|
|
path: release-quality-gate-artifacts/
|
|
if-no-files-found: warn
|