From 708d4c2308c88dcaa779128df2098c51e1d0ab06 Mon Sep 17 00:00:00 2001 From: Edwin van den Houdt Date: Tue, 21 Jul 2026 20:28:19 +0200 Subject: [PATCH] ci: speed up pipeline + shrink demo web image MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI (Gitea Actions, .github/workflows/ci.yml): - CodeQL off the PR critical path: runs on push-to-main + a weekly cron only (`if: github.event_name != 'pull_request'`, `schedule: Mondays 03:00 UTC`). The 2-language 20-min matrix was the slowest thing on every PR; code is still scanned on main + weekly. - Cache Playwright browsers (~/.cache/ms-playwright) in the storybook-a11y + e2e jobs — skips the chromium download on a hit; `install --with-deps` then only does the fast apt deps check. - Cache NuGet (~/.nuget/packages, keyed on **/*.csproj — no packages.lock.json) in the backend / e2e / api-client-drift / codeql-csharp jobs. - `npm ci --prefer-offline --no-audit --no-fund` in the 4 npm jobs. Demo (docker-compose.yml, local only — NOT used by CI): web image node:24 → node:24-slim (~1.1GB → 232MB verified). The container only runs `npm ci && ng serve` and the native deps ship prebuilt glibc binaries, so slim needs no toolchain — verified: npm ci clean, ng serve boots, app returns 200. Note: CI timing/behaviour can only be confirmed on the Gitea runner (not observable locally). Every change here is independently revertable. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/ci.yml | 45 ++++++++++++++++++++++++++++++++++++---- docker-compose.yml | 5 ++++- 2 files changed, 45 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8f9052e..e32ad17 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,6 +5,9 @@ on: branches: [main] tags: ['v*'] pull_request: + # CodeQL runs on main + this weekly cron only (not on PRs) — see the codeql job's `if`. + schedule: + - cron: '0 3 * * 1' # Mondays 03:00 UTC # Least privilege by default; the CodeQL job widens its own scope locally. permissions: @@ -25,7 +28,7 @@ jobs: with: node-version: 24 cache: npm - - run: npm ci + - run: npm ci --prefer-offline --no-audit --no-fund - run: npm run lint - run: npm run format:check - run: npm run check:tokens @@ -47,7 +50,13 @@ jobs: with: node-version: 24 cache: npm - - run: npm ci + - run: npm ci --prefer-offline --no-audit --no-fund + # Cache the chromium download across runs; `install --with-deps` then only + # runs the (fast, idempotent) apt deps check on a hit. + - uses: actions/cache@v4 + with: + path: ~/.cache/ms-playwright + key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }} - run: npx playwright install --with-deps chromium - run: npm run build-storybook - run: npm run test-storybook:ci @@ -60,6 +69,11 @@ jobs: - uses: actions/setup-dotnet@v4 with: dotnet-version: 10.0.x + - uses: actions/cache@v4 + with: + path: ~/.nuget/packages + key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} + restore-keys: nuget-${{ runner.os }}- - run: dotnet format backend/BigRegister.slnx --verify-no-changes - run: dotnet test backend/BigRegister.slnx @@ -84,12 +98,24 @@ jobs: - uses: actions/setup-dotnet@v4 with: dotnet-version: 10.0.x - - run: npm ci + - uses: actions/cache@v4 + with: + path: ~/.nuget/packages + key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} + restore-keys: nuget-${{ runner.os }}- + - run: npm ci --prefer-offline --no-audit --no-fund + - uses: actions/cache@v4 + with: + path: ~/.cache/ms-playwright + key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }} - run: npx playwright install --with-deps chromium - run: npm run e2e codeql: # Static analysis (SAST) for both sides; results appear under the Security tab. + # Off the PR path (slow 2-language matrix) — runs on push-to-main + the weekly + # cron only, so PR feedback isn't bottlenecked on it. + if: github.event_name != 'pull_request' runs-on: ubuntu-latest timeout-minutes: 20 permissions: @@ -106,6 +132,12 @@ jobs: uses: actions/setup-dotnet@v4 with: dotnet-version: 10.0.x + - if: matrix.language == 'csharp' + uses: actions/cache@v4 + with: + path: ~/.nuget/packages + key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} + restore-keys: nuget-${{ runner.os }}- - uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} @@ -128,6 +160,11 @@ jobs: dotnet-version: | 8.0.x 10.0.x - - run: npm ci + - uses: actions/cache@v4 + with: + path: ~/.nuget/packages + key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} + restore-keys: nuget-${{ runner.os }}- + - run: npm ci --prefer-offline --no-audit --no-fund - run: npm run gen:api - run: git diff --exit-code src/app/shared/infrastructure/api-client.ts backend/swagger.json diff --git a/docker-compose.yml b/docker-compose.yml index 174d535..6eedd7e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -25,7 +25,10 @@ services: - '5000:5000' web: - image: node:24 + # slim (Debian/glibc, ~220MB vs ~1.1GB for the full tag): the container only runs + # `npm ci && ng serve`, and the native deps (esbuild, lmdb, @parcel/watcher, + # msgpackr-extract) ship prebuilt glibc binaries, so no build toolchain is needed. + image: node:24-slim working_dir: /app # Uses the committed generated client (no codegen at startup); proxies /api → api container. # ponytail: `--no-fund --loglevel=error` silences npm 11's startup noise (deprecation +