truetype
12d2018ac5
- Dockerfile: build-arg REQUIREMENTS_CHECKSUM verifica lo sha256 del lockfile (fallisce la build se non coincide; vuoto = skip locale) - docker-compose.yml: default = hash corrente del lock - CI: nuovo job checksum.yml che fallisce se il pin non coincide - Fix YAML preesistente in ci.yml (name: con ':' non quotati) - Docs: README, .env.example, review aggiornati
94 lines
2.9 KiB
YAML
94 lines
2.9 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
name: pytest (3.12)
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install deps (lock)
|
|
run: |
|
|
python -m venv .venv
|
|
.venv/bin/pip install --upgrade pip
|
|
.venv/bin/pip install -r requirements.lock pytest
|
|
|
|
- name: Run tests
|
|
run: |
|
|
.venv/bin/python -m pytest tests/ -v
|
|
|
|
docker:
|
|
runs-on: ubuntu-latest
|
|
needs: test
|
|
name: Docker smoke test
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Prepare env
|
|
run: |
|
|
cp .env.example .env
|
|
# secret di prova per il container (DEBUG=false in Docker)
|
|
sed -i 's/^BOOKISH_SECRET=.*/BOOKISH_SECRET=ci-test-secret-long-enough/' .env
|
|
|
|
- name: Build image
|
|
run: docker compose build
|
|
|
|
- name: Start stack
|
|
run: docker compose up -d
|
|
|
|
- name: Wait for health
|
|
run: |
|
|
for i in $(seq 1 30); do
|
|
if curl -sf http://127.0.0.1:5000/healthz >/dev/null; then
|
|
echo "healthz OK dopo ${i} tentativi"
|
|
exit 0
|
|
fi
|
|
sleep 2
|
|
done
|
|
echo "healthz non risponde"
|
|
docker compose logs bookish
|
|
exit 1
|
|
|
|
- name: "Smoke: upload epub -> epub (conversione, SSE)"
|
|
run: |
|
|
# finto epub (zip minimo vuoto accettato per estensione; la conversione
|
|
# può fallire per formato, ma l'upload deve tornare 200 con task_id)
|
|
printf 'PK\x03\x04 x' > /tmp/sample.epub
|
|
RESP=$(curl -s -F "file=@/tmp/sample.epub" -F "output_format=epub" http://127.0.0.1:5000/upload)
|
|
echo "$RESP"
|
|
echo "$RESP" | grep -q '"task_id"' || { echo "task_id mancante"; exit 1; }
|
|
|
|
- name: "Smoke: CSP header presente"
|
|
run: |
|
|
curl -sI http://127.0.0.1:5000/ | grep -q "Content-Security-Policy" || { echo "CSP assente"; exit 1; }
|
|
|
|
- name: "Smoke: auth opzionale funziona (override)"
|
|
run: |
|
|
cat > /tmp/override.yml << 'EOF'
|
|
services:
|
|
bookish:
|
|
environment:
|
|
BOOKISH_AUTH_USERNAME: ci
|
|
BOOKISH_AUTH_PASSWORD: ci-pass
|
|
EOF
|
|
docker compose -f docker-compose.yml -f /tmp/override.yml up -d
|
|
sleep 6
|
|
CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/)
|
|
[ "$CODE" = "401" ] || { echo "atteso 401, ottenuto $CODE"; exit 1; }
|
|
CODE=$(curl -s -o /dev/null -w "%{http_code}" -u ci:ci-pass http://127.0.0.1:5000/)
|
|
[ "$CODE" = "200" ] || { echo "atteso 200 con credenziali, ottenuto $CODE"; exit 1; }
|
|
echo "auth OK"
|
|
docker compose up -d # torna al default (senza auth)
|
|
|
|
- name: Cleanup
|
|
if: always()
|
|
run: docker compose down --remove-orphans --volumes |