eho/atomic-design-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

perf(ci): path-filter jobs by which side changed (WP-30 #3)

Browse Source 
New `changes` job (dorny/paths-filter, pinned to SHA) computes frontend/
backend outputs; every downstream job gates its real steps on the relevant
output(s) instead of being skipped as a whole job. Conservative "skip steps,
not jobs" variant: every job still runs and reports a status (checkout always
executes) even when its side is untouched, so a required-status-check never
waits on a job that never started — the tradeoff the WP itself flagged as the
open risk of this item. e2e/semgrep/api-client-drift gate on either side
(they exercise both). `.github/workflows/**` counts as both sides, so a CI
change always gets a full run. Validated with `actionlint` (0 issues) and a
local YAML parse; the actual skip behavior can only be confirmed on a real
Gitea PR run.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
eho
2026-07-30 09:28:55 +02:00
co-authored by Claude Sonnet 5
parent e02e8ce058
commit e7db69d8a9
1 changed files with 96 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+96 -18
View File
@@ -16,62 +16,111 @@ concurrency:
cancel-in-progress: true cancel-in-progress: true
jobs: jobs:
# WP-30: computes which side changed so the jobs below can skip their real work on a
# narrow PR. Deliberately conservative ("skip steps, not jobs" — see each job's `if:`):
# every job below still runs and reports a status even when its side is untouched, just
# with checkout as its only step. This avoids a required-status-check ever waiting on a
# job that never started, at the cost of still paying job-startup overhead on a skip.
# `.github/workflows/**` counts as BOTH sides, so a CI change itself always gets a full run.
changes:
runs-on: ubuntu-latest
timeout-minutes: 5
outputs:
frontend: ${{ steps.filter.outputs.frontend }}
backend: ${{ steps.filter.outputs.backend }}
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
id: filter
with:
filters: |
frontend:
- 'src/**'
- 'public/**'
- 'e2e/**'
- 'scripts/**'
- 'angular.json'
- 'package*.json'
- 'tsconfig*.json'
- '.storybook/**'
- 'eslint.config.mjs'
- '.dependency-cruiser.js'
- '.github/workflows/**'
backend:
- 'backend/**'
- '.github/workflows/**'
# WP-30: split out of `frontend` so lint/format/token failures report in ~1 min instead of # WP-30: split out of `frontend` so lint/format/token failures report in ~1 min instead of
# waiting on the full test:coverage/ng build below — depends on the node_modules cache # waiting on the full test:coverage/ng build below — depends on the node_modules cache
# above landing first, else this duplicates a full npm ci for no reason. # above landing first, else this duplicates a full npm ci for no reason.
lint: lint:
needs: changes
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 5 timeout-minutes: 5
steps: steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 - if: needs.changes.outputs.frontend == 'true'
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: 24 node-version: 24
cache: npm cache: npm
- id: node-modules-cache - id: node-modules-cache
if: needs.changes.outputs.frontend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: node_modules path: node_modules
key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }} key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
- run: npm ci --prefer-offline --no-audit --no-fund - run: npm ci --prefer-offline --no-audit --no-fund
if: steps.node-modules-cache.outputs.cache-hit != 'true' if: needs.changes.outputs.frontend == 'true' && steps.node-modules-cache.outputs.cache-hit != 'true'
- run: npm run lint - run: npm run lint
if: needs.changes.outputs.frontend == 'true'
- run: npm run format:check - run: npm run format:check
if: needs.changes.outputs.frontend == 'true'
- run: npm run check:tokens - run: npm run check:tokens
if: needs.changes.outputs.frontend == 'true'
frontend: frontend:
needs: changes
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 15 timeout-minutes: 15
steps: steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 - if: needs.changes.outputs.frontend == 'true'
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: 24 node-version: 24
cache: npm cache: npm
# WP-30: on a hit, npm ci is skipped entirely (not just faster) — caching node_modules # WP-30: on a hit, npm ci is skipped entirely (not just faster) — caching node_modules
# alone doesn't help since npm ci always deletes-then-reinstalls unconditionally. # alone doesn't help since npm ci always deletes-then-reinstalls unconditionally.
- id: node-modules-cache - id: node-modules-cache
if: needs.changes.outputs.frontend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: node_modules path: node_modules
key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }} key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
- run: npm ci --prefer-offline --no-audit --no-fund - run: npm ci --prefer-offline --no-audit --no-fund
if: steps.node-modules-cache.outputs.cache-hit != 'true' if: needs.changes.outputs.frontend == 'true' && steps.node-modules-cache.outputs.cache-hit != 'true'
# Bounded-context + atomic-layer boundaries (WP-38, dependency-cruiser). # Bounded-context + atomic-layer boundaries (WP-38, dependency-cruiser).
- run: npm run dep:check - run: npm run dep:check
if: needs.changes.outputs.frontend == 'true'
# Showcase snippets must match their real source regions (WP-39, no drift). # Showcase snippets must match their real source regions (WP-39, no drift).
- run: npm run gen:snippets && git diff --exit-code src/app/showcase/snippets.generated.ts - run: npm run gen:snippets && git diff --exit-code src/app/showcase/snippets.generated.ts
if: needs.changes.outputs.frontend == 'true'
# Runs the full suite AND reports coverage (WP-46, report-only — no thresholds, so # Runs the full suite AND reports coverage (WP-46, report-only — no thresholds, so
# it can't fail on coverage; it still fails on a failing test, like `npm test` did). # it can't fail on coverage; it still fails on a failing test, like `npm test` did).
- run: npm run test:coverage - run: npm run test:coverage
if: needs.changes.outputs.frontend == 'true'
# --localize builds every configured locale (nl + en, angular.json's i18n # --localize builds every configured locale (nl + en, angular.json's i18n
# block) in one pass; i18nMissingTranslation:"error" (angular.json) fails # block) in one pass; i18nMissingTranslation:"error" (angular.json) fails
# this step if messages.en.xlf is missing a unit the source (WP-20) gains. # this step if messages.en.xlf is missing a unit the source (WP-20) gains.
- run: npx ng build --localize - run: npx ng build --localize
if: needs.changes.outputs.frontend == 'true'
# The shipped bundle must stay clean; dev-only advisories are excluded. # The shipped bundle must stay clean; dev-only advisories are excluded.
- run: npm audit --omit=dev - run: npm audit --omit=dev
if: needs.changes.outputs.frontend == 'true'
storybook-a11y: storybook-a11y:
needs: changes
# Axe runs against every story in the static build; a violation fails the build. # Axe runs against every story in the static build; a violation fails the build.
runs-on: ubuntu-latest runs-on: ubuntu-latest
# Hard resource ceiling so a runaway test-storybook (one headless Chromium per Jest # Hard resource ceiling so a runaway test-storybook (one headless Chromium per Jest
@@ -91,46 +140,58 @@ jobs:
timeout-minutes: 15 timeout-minutes: 15
steps: steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 - if: needs.changes.outputs.frontend == 'true'
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: 24 node-version: 24
cache: npm cache: npm
- id: node-modules-cache - id: node-modules-cache
if: needs.changes.outputs.frontend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: node_modules path: node_modules
key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }} key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
- run: npm ci --prefer-offline --no-audit --no-fund - run: npm ci --prefer-offline --no-audit --no-fund
if: steps.node-modules-cache.outputs.cache-hit != 'true' if: needs.changes.outputs.frontend == 'true' && steps.node-modules-cache.outputs.cache-hit != 'true'
# Cache the chromium download across runs; `install --with-deps` then only # Cache the chromium download across runs; `install --with-deps` then only
# runs the (fast, idempotent) apt deps check on a hit. # runs the (fast, idempotent) apt deps check on a hit.
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 - if: needs.changes.outputs.frontend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: ~/.cache/ms-playwright path: ~/.cache/ms-playwright
key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }} key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
- run: npx playwright install --with-deps chromium - run: npx playwright install --with-deps chromium
if: needs.changes.outputs.frontend == 'true'
- run: npm run build-storybook - run: npm run build-storybook
if: needs.changes.outputs.frontend == 'true'
- run: npm run test-storybook:ci - run: npm run test-storybook:ci
if: needs.changes.outputs.frontend == 'true'
backend: backend:
needs: changes
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 15 timeout-minutes: 15
steps: steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 - if: needs.changes.outputs.backend == 'true'
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
with: with:
dotnet-version: 10.0.x dotnet-version: 10.0.x
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 - if: needs.changes.outputs.backend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: ~/.nuget/packages path: ~/.nuget/packages
key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
restore-keys: nuget-${{ runner.os }}- restore-keys: nuget-${{ runner.os }}-
- run: dotnet format backend/BigRegister.slnx --verify-no-changes - run: dotnet format backend/BigRegister.slnx --verify-no-changes
if: needs.changes.outputs.backend == 'true'
# Category=Integration (WP-54, OpenZaakIntegrationTests) needs a live OpenZaak — opt-in, # Category=Integration (WP-54, OpenZaakIntegrationTests) needs a live OpenZaak — opt-in,
# run manually against backend/openzaak/ (see its README), never in CI. # run manually against backend/openzaak/ (see its README), never in CI.
- run: dotnet test backend/BigRegister.slnx --filter "Category!=Integration" - run: dotnet test backend/BigRegister.slnx --filter "Category!=Integration"
if: needs.changes.outputs.backend == 'true'
e2e: e2e:
needs: changes
# Smoke-level Playwright run against the REAL FE+backend (WP-19) — a fresh # Smoke-level Playwright run against the REAL FE+backend (WP-19) — a fresh
# runner checkout per run, so there's no bigregister.db (WP-22, gitignored) # runner checkout per run, so there's no bigregister.db (WP-22, gitignored)
# left over from a prior run to leak state in; the backend creates + migrates # left over from a prior run to leak state in; the backend creates + migrates
@@ -144,33 +205,41 @@ jobs:
timeout-minutes: 15 timeout-minutes: 15
steps: steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 - if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: 24 node-version: 24
cache: npm cache: npm
- uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 - if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
with: with:
dotnet-version: 10.0.x dotnet-version: 10.0.x
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 - if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: ~/.nuget/packages path: ~/.nuget/packages
key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
restore-keys: nuget-${{ runner.os }}- restore-keys: nuget-${{ runner.os }}-
- id: node-modules-cache - id: node-modules-cache
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: node_modules path: node_modules
key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }} key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
- run: npm ci --prefer-offline --no-audit --no-fund - run: npm ci --prefer-offline --no-audit --no-fund
if: steps.node-modules-cache.outputs.cache-hit != 'true' if: (needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true') && steps.node-modules-cache.outputs.cache-hit != 'true'
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 - if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: ~/.cache/ms-playwright path: ~/.cache/ms-playwright
key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }} key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
- run: npx playwright install --with-deps chromium - run: npx playwright install --with-deps chromium
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
- run: npm run e2e - run: npm run e2e
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
semgrep: semgrep:
needs: changes
# SAST for both sides — replaces CodeQL, which is GitHub-only (its analyze step uploads # SAST for both sides — replaces CodeQL, which is GitHub-only (its analyze step uploads
# SARIF to GitHub's code-scanning API) and can't run on this Gitea instance. Semgrep OSS # SARIF to GitHub's code-scanning API) and can't run on this Gitea instance. Semgrep OSS
# is a plain CLI: no account, no external platform API. Findings print in the job log. # is a plain CLI: no account, no external platform API. Findings print in the job log.
@@ -189,38 +258,47 @@ jobs:
steps: steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- run: python3 -m pip install --break-system-packages --ignore-installed semgrep - run: python3 -m pip install --break-system-packages --ignore-installed semgrep
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
# p/default = curated cross-language security (covers JS/TS); p/csharp = the backend. # p/default = curated cross-language security (covers JS/TS); p/csharp = the backend.
# Anonymous registry fetch; --metrics=off disables telemetry (not `auto`, which uploads # Anonymous registry fetch; --metrics=off disables telemetry (not `auto`, which uploads
# project metadata). # project metadata).
- run: semgrep scan --config p/default --config p/csharp --metrics=off --error - run: semgrep scan --config p/default --config p/csharp --metrics=off --error
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
api-client-drift: api-client-drift:
needs: changes
# The committed typed client must match the backend OpenAPI doc. # The committed typed client must match the backend OpenAPI doc.
runs-on: ubuntu-latest runs-on: ubuntu-latest
timeout-minutes: 15 timeout-minutes: 15
steps: steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 - if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with: with:
node-version: 24 node-version: 24
cache: npm cache: npm
- uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1 - if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
with: with:
# 8.0 for the bundled NSwag runtime, 10.0 to build/emit the spec. # 8.0 for the bundled NSwag runtime, 10.0 to build/emit the spec.
dotnet-version: | dotnet-version: |
8.0.x 8.0.x
10.0.x 10.0.x
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 - if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: ~/.nuget/packages path: ~/.nuget/packages
key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }}
restore-keys: nuget-${{ runner.os }}- restore-keys: nuget-${{ runner.os }}-
- id: node-modules-cache - id: node-modules-cache
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with: with:
path: node_modules path: node_modules
key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }} key: node-modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
- run: npm ci --prefer-offline --no-audit --no-fund - run: npm ci --prefer-offline --no-audit --no-fund
if: steps.node-modules-cache.outputs.cache-hit != 'true' if: (needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true') && steps.node-modules-cache.outputs.cache-hit != 'true'
- run: npm run gen:api - run: npm run gen:api
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'
- run: git diff --exit-code src/app/shared/infrastructure/api-client.ts backend/swagger.json - run: git diff --exit-code src/app/shared/infrastructure/api-client.ts backend/swagger.json
if: needs.changes.outputs.frontend == 'true' || needs.changes.outputs.backend == 'true'