Skip to content

Commit 1cfd73d

Browse files
VirmasaloAVirmasaloA
committed
Restore build.yml codeql.yml
1 parent fd3ebe9 commit 1cfd73d

File tree

2 files changed

+259
-0
lines changed

2 files changed

+259
-0
lines changed

‎.github/workflows/build.yml‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
# SPDX-FileCopyrightText: 2024 The members of the EXAM Consortium
2+
#
3+
# SPDX-License-Identifier: EUPL-1.2
4+
5+
name: Build
6+
7+
on: [push]
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
13+
services:
14+
postgres:
15+
image: postgres
16+
env:
17+
POSTGRES_DB: exam_test
18+
POSTGRES_USER: exam
19+
POSTGRES_PASSWORD: exam
20+
options: >-
21+
--health-cmd pg_isready
22+
--health-interval 10s
23+
--health-timeout 5s
24+
--health-retries 5
25+
ports:
26+
- 5432:5432
27+
28+
steps:
29+
- name: Checkout
30+
uses: actions/checkout@v4
31+
32+
- name: Set up JDK
33+
uses: actions/setup-java@v4
34+
with:
35+
java-version: 25
36+
distribution: temurin
37+
cache: sbt
38+
39+
- name: Set up SBT
40+
uses: sbt/setup-sbt@v1
41+
42+
- name: Set up Node
43+
uses: actions/setup-node@v4
44+
with:
45+
node-version: 24.x
46+
47+
- name: Check REUSE compliance
48+
uses: fsfe/reuse-action@v4
49+
50+
- name: Build UI and run tests
51+
run: |
52+
npm ci --ignore-scripts
53+
npm run check-format
54+
npm run check-lint
55+
npm run build
56+
npm test -- --no-watch --browsers=ChromeHeadlessCI
57+
58+
- name: Build backend and run tests
59+
run: |
60+
sed -i 's/\/var\/log\/exam/logs/g' $GITHUB_WORKSPACE/conf/logback.xml
61+
sbt test
62+
63+
docker-build:
64+
runs-on: ubuntu-latest
65+
needs: build
66+
timeout-minutes: 20
67+
68+
steps:
69+
- name: Checkout
70+
uses: actions/checkout@v4
71+
72+
- name: Set up Docker Buildx
73+
uses: docker/setup-buildx-action@v3
74+
75+
- name: Build Docker images
76+
run: docker compose build
77+
78+
- name: Start containers
79+
env:
80+
NGINX_CONFIG: nginx.conf # Use HTTP config (no SSL certs in CI)
81+
run: |
82+
docker compose up -d
83+
echo "Containers starting..."
84+
sleep 5
85+
docker compose ps
86+
87+
- name: Wait for postgres to be healthy
88+
run: |
89+
echo "Waiting for postgres..."
90+
timeout 60 bash -c 'until docker compose exec -T postgres pg_isready -U exam; do sleep 2; done'
91+
echo "✓ Postgres is ready"
92+
93+
- name: Wait for exam backend to be healthy
94+
run: |
95+
echo "Waiting for exam backend..."
96+
timeout 120 bash -c 'until [ "$(docker inspect --format="{{.State.Health.Status}}" exam-app)" == "healthy" ]; do sleep 5; echo "Still waiting..."; done'
97+
echo "✓ Backend is ready"
98+
99+
- name: Start and wait for nginx
100+
run: |
101+
echo "Starting nginx (depends on exam being healthy)..."
102+
docker compose up -d nginx
103+
104+
echo "Waiting for nginx container to start..."
105+
timeout 30 bash -c 'until docker compose ps nginx | grep -q "Up"; do sleep 2; echo "Still waiting for nginx..."; done'
106+
echo "✓ Nginx container is up"
107+
108+
echo "Waiting for nginx to be ready (testing endpoint)..."
109+
timeout 60 bash -c 'until curl -f -s http://localhost/ > /dev/null 2>&1; do echo "Nginx not ready yet..."; sleep 5; done'
110+
echo "✓ Nginx is responding"
111+
112+
- name: Test application endpoints
113+
run: |
114+
echo "Testing root endpoint..."
115+
curl -f http://localhost/ || (echo "Failed to access root endpoint" && docker compose logs nginx && exit 1)
116+
echo "✓ Root endpoint works"
117+
118+
echo "Testing API health check..."
119+
curl -f http://localhost/app/attributes || exit 1
120+
echo "✓ API endpoint works"
121+
122+
echo "Testing CSRF token..."
123+
curl -v http://localhost/ 2>&1 | grep -q "XSRF-TOKEN" || exit 1
124+
echo "✓ CSRF token is set"
125+
126+
echo "✓ All endpoint tests passed!"
127+
128+
- name: Show container status
129+
if: always()
130+
run: docker compose ps
131+
132+
- name: Show logs on failure
133+
if: failure()
134+
run: |
135+
echo "=== Postgres logs ==="
136+
docker compose logs postgres
137+
echo "=== Exam logs ==="
138+
docker compose logs exam
139+
echo "=== Nginx logs ==="
140+
docker compose logs nginx
141+
142+
- name: Cleanup
143+
if: always()
144+
run: docker compose down -v

‎.github/workflows/codeql.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
# SPDX-FileCopyrightText: 2024 The members of the EXAM Consortium
2+
#
3+
# SPDX-License-Identifier: EUPL-1.2
4+
5+
# For most projects, this workflow file will not need changing; you simply need
6+
# to commit it to your repository.
7+
#
8+
# You may wish to alter this file to override the set of languages analyzed,
9+
# or to provide custom queries or build logic.
10+
#
11+
# ******** NOTE ********
12+
# We have attempted to detect the languages in your repository. Please check
13+
# the `language` matrix defined below to confirm you have the correct set of
14+
# supported CodeQL languages.
15+
#
16+
name: "CodeQL"
17+
18+
on:
19+
push:
20+
branches: ["master", "dev"]
21+
pull_request:
22+
branches: ["master", "dev"]
23+
schedule:
24+
- cron: "23 1 * * 0"
25+
26+
jobs:
27+
analyze:
28+
name: Analyze (${{ matrix.language }})
29+
# Runner size impacts CodeQL analysis time. To learn more, please see:
30+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
31+
# - https://gh.io/supported-runners-and-hardware-resources
32+
# - https://gh.io/using-larger-runners (GitHub.com only)
33+
# Consider using larger runners or machines with greater resources for possible analysis time improvements.
34+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
35+
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
36+
permissions:
37+
# required for all workflows
38+
security-events: write
39+
40+
# required to fetch internal or private CodeQL packs
41+
packages: read
42+
43+
# only required for workflows in private repositories
44+
actions: read
45+
contents: read
46+
47+
strategy:
48+
fail-fast: false
49+
matrix:
50+
include:
51+
- language: javascript
52+
build-mode: none
53+
- language: python
54+
build-mode: none
55+
# CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
56+
# Use `c-cpp` to analyze code written in C, C++ or both
57+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
58+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
59+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
60+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
61+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
62+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
63+
steps:
64+
- name: Checkout repository
65+
uses: actions/checkout@v4
66+
67+
# Initializes the CodeQL tools for scanning.
68+
- name: Initialize CodeQL
69+
uses: github/codeql-action/init@v3
70+
with:
71+
languages: ${{ matrix.language }}
72+
build-mode: ${{ matrix.build-mode }}
73+
# If you wish to specify custom queries, you can do so here or in a config file.
74+
# By default, queries listed here will override any specified in a config file.
75+
# Prefix the list here with "+" to use these queries and those in the config file.
76+
77+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
78+
# queries: security-extended,security-and-quality
79+
80+
# If the analyze step fails for one of the languages you are analyzing with
81+
# "We were unable to automatically build your code", modify the matrix above
82+
# to set the build mode to "manual" for that language. Then modify this step
83+
# to build your code.
84+
# ℹ️ Command-line programs to run using the OS shell.
85+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
86+
- if: matrix.build-mode == 'manual'
87+
shell: bash
88+
run: |
89+
echo 'If you are using a "manual" build mode for one or more of the' \
90+
'languages you are analyzing, replace this with the commands to build' \
91+
'your code, for example:'
92+
echo ' make bootstrap'
93+
echo ' make release'
94+
exit 1
95+
96+
- name: Perform CodeQL Analysis
97+
uses: github/codeql-action/analyze@v3
98+
with:
99+
category: "/language:${{matrix.language}}"
100+
upload: false # disable the upload here - we will upload in a different action
101+
output: sarif-results
102+
103+
- name: Filter SARIF
104+
uses: advanced-security/filter-sarif@v1
105+
with:
106+
# filter out all vendor component directories
107+
patterns: |
108+
-ui/src/assets/components/vendor/**/*
109+
input: sarif-results/${{ matrix.language }}.sarif
110+
output: sarif-results/${{ matrix.language }}.sarif
111+
112+
- name: Upload SARIF
113+
uses: github/codeql-action/upload-sarif@v3
114+
with:
115+
sarif_file: sarif-results/${{ matrix.language }}.sarif

0 commit comments

Comments
 (0)