CI/CD на GitHub Actions: проверки на каждый pull request

{
  "scripts": {
    "lint": "oxlint --deny-warnings src tests",
    "typecheck": "tsc -p .",
    "test:unit": "vitest run --project unit",
    "test:integration": "vitest run --project integration",
    "test": "vitest run"
  }
}

name: CI

on:
  pull_request:
  push:
    branches: [main]
  workflow_call:

# Least privilege: the token can only read the code
permissions:
  contents: read

# A new push to the same PR cancels the previous, now useless run
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  checks:
    name: Lint and typecheck
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck

  unit:
    name: Unit tests (Node ${{ matrix.node }})
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    strategy:
      fail-fast: false
      matrix:
        node: [22, 24, 26]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      # Node 22 ships npm 10, which rejects a lockfile written by npm 11
      - run: npm install --global npm@11
      - run: npm ci
      - run: npm run test:unit

  integration:
    name: Integration tests
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:17-alpine
        env:
          POSTGRES_PASSWORD: test # a throwaway database: not a secret
          POSTGRES_DB: leads_test
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    env:
      TEST_DATABASE_URL: postgres://postgres:test@localhost:5432/leads_test
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: npm
      - run: npm ci
      - run: npm run test:integration -- --reporter=default --reporter=junit --outputFile.junit=reports/integration.xml
      - name: Upload test report
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: integration-report
          path: reports/
          retention-days: 7

  image:
    name: Docker image
    needs: [checks, unit, integration]
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          push: false
          tags: leads-api:ci

  # The single check to mark as required in branch protection
  ci-ok:
    name: CI passed
    if: ${{ always() }}
    needs: [checks, unit, integration, image]
    runs-on: ubuntu-24.04
    steps:
      - name: Fail if any job failed or was cancelled
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: exit 1

[CI/Unit tests (Node 22)-1] ⭐ Run Main npm ci
[CI/Unit tests (Node 22)-1]   | npm error code EUSAGE
[CI/Unit tests (Node 22)-1]   | npm error `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
[CI/Unit tests (Node 22)-1]   | npm error Missing: msw@2.15.0 from lock file
[CI/Unit tests (Node 22)-1]   | npm error Missing: @mswjs/interceptors@0.41.9 from lock file
…
[CI/Unit tests (Node 22)-1]   ❌  Failure - Main npm ci [4.8119949s]
[CI/Unit tests (Node 22)-1] 🏁  Job failed
…
[CI/Unit tests (Node 24)-2]   ✅  Success - Main npm run test:unit [1.3380536s]
[CI/Unit tests (Node 26)-3]   ✅  Success - Main npm run test:unit [671.0905ms]

name: PR title

on:
  pull_request:
    types: [opened, edited, synchronize, reopened]

permissions: {}

jobs:
  title:
    name: PR title format
    runs-on: ubuntu-24.04
    steps:
      - name: Check PR title
        env:
          TITLE: ${{ github.event.pull_request.title }} # untrusted input: only via env
        run: |
          pattern='^(feat|fix|docs|chore): '
          if [[ ! "$TITLE" =~ $pattern ]]; then
            echo "PR title must start with feat:, fix:, docs: or chore:"
            exit 1
          fi
          echo "PR title is OK"

docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.12

name: CI

on: pull_request

jobs:
  unit:
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        node: [22, 24]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.nodes }}
      - run: echo "Testing ${{ github.event.pull_request.title }}"
      - run: npm ci && npm test

  image:
    needs: [checks]
    runs-on: ubuntu-24.04
    steps:
      - run: docker build .

$ docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.12
.github/workflows/ci.yml:15:29: property "nodes" is not defined in object type {node: number} [expression]
   |
15 |           node-version: ${{ matrix.nodes }}
   |                             ^~~~~~~~~~~~
.github/workflows/ci.yml:16:32: "github.event.pull_request.title" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details [expression]
   |
16 |       - run: echo "Testing ${{ github.event.pull_request.title }}"
   |                                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.github/workflows/ci.yml:19:3: job "image" needs job "checks" which does not exist in this workflow [job-needs]
   |
19 |   image:
   |   ^~~~~~
$ echo $?
1

act pull_request -e pr-event.json \
  -P ubuntu-24.04=catthehacker/ubuntu:act-24.04 \
  --artifact-server-path /tmp/artifacts

$ act pull_request -e pr-event.json \
    -P ubuntu-24.04=catthehacker/ubuntu:act-24.04 \
    --artifact-server-path /tmp/artifacts
…
[CI/Integration tests     ] container health of 966c061c5bbf… (postgres:17-alpine) is healthy
…
[CI/Lint and typecheck    ]   ✅  Success - Main npm run lint [1.144679915s]
[CI/Lint and typecheck    ]   ✅  Success - Main npm run typecheck [1.023296871s]
[CI/Lint and typecheck    ] 🏁  Job succeeded
[CI/Unit tests (Node 22)-1]   |       Tests  9 passed (9)
[CI/Unit tests (Node 22)-1] 🏁  Job succeeded
[CI/Unit tests (Node 26)-3] 🏁  Job succeeded
[CI/Unit tests (Node 24)-2] 🏁  Job succeeded
[CI/Integration tests     ]   |       Tests  10 passed (10)
[CI/Integration tests     ]   | Artifact integration-report has been successfully uploaded! Final size is 750 bytes. Artifact ID is 3500521754
[CI/Integration tests     ] 🏁  Job succeeded
[CI/Docker image          ]   ✅  Success - Main docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc [19.041554739s]
[CI/Docker image          ] 🏁  Job succeeded
[CI/CI passed             ] 🏁  Job succeeded

FROM node:24-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY src ./src
USER node
EXPOSE 3000
CMD ["node", "src/server.ts"]

name: Release

on:
  push:
    tags: ['v*.*.*']

permissions:
  contents: read

# Never run two deployments at once and never cancel one halfway
concurrency:
  group: release-production
  cancel-in-progress: false

jobs:
  ci:
    name: CI
    uses: ./.github/workflows/ci.yml

  publish:
    name: Publish image
    needs: ci
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    permissions:
      contents: read
      packages: write # push to ghcr.io with GITHUB_TOKEN
    outputs:
      digest: ${{ steps.push.outputs.digest }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
      - id: push
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}

  deploy:
    name: Deploy to production
    needs: publish
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    # Environment secrets, required reviewers and allowed tags are set in Settings → Environments
    environment:
      name: production
      url: https://leads.example.com
    steps:
      - name: Trigger the hosting deploy hook
        env:
          DEPLOY_HOOK_URL: ${{ secrets.DEPLOY_HOOK_URL }}
          REPOSITORY: ${{ github.repository }}
          DIGEST: ${{ needs.publish.outputs.digest }}
        run: |
          image="ghcr.io/${REPOSITORY,,}@${DIGEST}"
          echo "Deploying $image"
          curl --fail-with-body --silent --show-error -X POST "$DEPLOY_HOOK_URL" \
            --data-urlencode "image=$image"

git switch main && git pull
git tag -a v1.2.0 -m "Lead source field"
git push origin v1.2.0