apf_portal/.gitea/workflows/ci.yml

# Per ADR-0015 (CI/CD on Gitea Actions).
# Thin YAML — orchestration lives in package.json scripts (ci:check,
# ci:audit, ci:commits, ci:perf) and Nx targets. Any change to gate
# behaviour belongs in those scripts, not in this file.
#
# `cache: 'pnpm'` is intentionally NOT enabled on actions/setup-node
# below: act_runner's built-in GitHub-Actions-cache server is bound on
# the runner container and is unreachable from job containers (which
# run on Docker's default network, not the runners' compose network).
# Each request burns a ~2 min ETIMEDOUT on restore + another on save,
# for zero hit rate. Once the runner network/cache config is fixed
# (tracked in infra/README.md "Cache server"), re-add `cache: 'pnpm'`
# here.

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  check:
    runs-on: [self-hosted, on-prem]
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      # Derive NX_BASE / NX_HEAD for `nx affected`. Replaces
      # nrwl/nx-set-shas@v4, which is GitHub-only (it queries the GitHub
      # API to find the last successful workflow run, returning 404 on
      # Gitea). HEAD~1 is a reasonable approximation for push events on
      # a squash-merge trunk; pull_request uses the merge-base with the
      # target branch.
      - name: Derive Nx affected base and head
        shell: bash
        run: |
          # `actions/checkout@v4` with fetch-depth: 0 already pulls every
          # branch and tag, so origin/<base_ref> is present locally — no
          # extra `git fetch` is needed (and `--depth=0` is invalid: git
          # requires a positive integer).
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            echo "NX_BASE=$(git merge-base HEAD origin/${{ github.base_ref }})" >> "$GITHUB_ENV"
          else
            echo "NX_BASE=HEAD~1" >> "$GITHUB_ENV"
          fi
          echo "NX_HEAD=HEAD" >> "$GITHUB_ENV"
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
      - run: pnpm install --frozen-lockfile
      - run: pnpm ci:check

  scan:
    runs-on: [self-hosted, on-prem]
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
      - run: pnpm install --frozen-lockfile
      - run: pnpm ci:audit
      # Dependency vulnerability scan (binary tool, invoked via official
      # action — Trivy is a Go binary, not an npm package, so it cannot
      # live in package.json scripts as cleanly as audit/lint do).
      #
      # On cache miss (the act_runner cache server is currently
      # unreachable from job containers — see infra/README.md "Cache
      # server (deferred)"), the action falls back to `git clone
      # https://github.com/aquasecurity/trivy` to fetch its install
      # script. Without auth that hits github.com's 60 req/h anonymous
      # rate limit and `git fetch` fails with "could not read Username".
      # GITHUBCOM_TOKEN is the same zero-scope github.com PAT we use
      # for Renovate (per docs/development.md "Dependency updates").
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          ignore-unfixed: true
          skip-dirs: node_modules
          exit-code: '1'
          severity: 'CRITICAL,HIGH'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUBCOM_TOKEN }}
      # Secret scan, same reasoning (gitleaks is a Go binary).
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  commits:
    # PRs opened by Renovate (apf-portal-bot) carry commit messages
    # generated from a vetted Conventional-Commits template — running
    # commitlint on them is tautological. Per ADR-0017 amendment.
    if: github.event_name == 'pull_request' && github.event.pull_request.user.login != 'apf-portal-bot'
    runs-on: [self-hosted, on-prem]
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
      - run: pnpm install --frozen-lockfile
      - run: COMMIT_LINT_FROM=origin/main pnpm ci:commits

  perf:
    # Skip the Lighthouse run on PRs opened by Renovate (apf-portal-bot):
    # the per-PR perf signal on a dep bump is essentially zero (no
    # routes yet, bundle is the static placeholder), and the Lighthouse
    # round-trip burns several minutes per PR. Push events on `main`
    # still run perf — we catch regressions immediately post-merge,
    # not pre-merge. Per ADR-0017 amendment.
    if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'apf-portal-bot'
    runs-on: [self-hosted, on-prem]
    # Lighthouse CI drives a real Chrome instance; the default act runner
    # image (catthehacker/ubuntu:act-22.04) ships without one. The :full
    # variant adds Chrome, Firefox, and the GUI-test toolchain — pinned
    # to the same Ubuntu 22.04 base as the default labels for parity.
    container:
      image: catthehacker/ubuntu:full-22.04
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
      - run: pnpm install --frozen-lockfile
      - run: pnpm ci:perf
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: lighthouseci-report
          path: .lighthouseci/
          retention-days: 30

  a11y:
    runs-on: [self-hosted, on-prem]
    steps:
      - uses: actions/checkout@v6
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
      - run: pnpm install --frozen-lockfile
      # Placeholder until the e2e a11y suite (axe-core via Playwright,
      # per ADR-0016) is wired with the first real screens. The job
      # exists so branch protection can require it from day one - it
      # currently no-ops with a clear message.
      - run: echo "a11y gate placeholder - axe-core via Playwright wires up with the first real screens (ADR-0016)."