Niek Otten
4d07285dcd
make verify-notifications brings the stack up, seeds a published BIG zaaktype, and asserts a zaak-create notification is delivered to a webhook-sink abonnement. The sink + driver run as containers inside the compose network and reach OpenZaak/NRC by container IP (the runner can't reach published ports, and a single-label host isn't URL-valid). The sink enforces a bearer token because NRC refuses an unauthenticated callback. New 'notifications' Gitea Actions job runs it (Docker-only). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
110 lines
4.2 KiB
YAML
110 lines
4.2 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
# Self-hosted runner — see docs/runbooks/ci.md for the runner setup.
|
|
# `uses:` are absolute, tag-pinned URLs (CLAUDE.md §8.7 / §15).
|
|
|
|
# Each job calls a `make` target — the same one developers run locally
|
|
# (`make ci`). The Makefile is the single source of truth; see docs/runbooks/ci.md.
|
|
|
|
jobs:
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
- uses: https://github.com/actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
- run: make lint
|
|
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
- uses: https://github.com/actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
- run: make build
|
|
|
|
unit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
- uses: https://github.com/actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
- run: make unit
|
|
|
|
mutation:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
- uses: https://github.com/actions/setup-dotnet@v4
|
|
with:
|
|
dotnet-version: '10.0.x'
|
|
- run: make mutation
|
|
# Publish the Stryker HTML report. `if: always()` uploads it even when the
|
|
# ratchet fails — that is exactly when you want to inspect the survivors.
|
|
# Glob handles Stryker's non-deterministic StrykerOutput/<timestamp>/ dir.
|
|
# Pinned to @v3 deliberately: @v4 refuses to run on Gitea (GHES guard) —
|
|
# see docs/runbooks/gitea-actions-gotchas.md §4.
|
|
- uses: https://github.com/actions/upload-artifact@v3
|
|
if: always()
|
|
with:
|
|
name: acl-mutation-report
|
|
path: services/acl/StrykerOutput/**/reports/mutation-report.html
|
|
if-no-files-found: warn
|
|
|
|
integration:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
# No setup-dotnet: `make integration` runs the seed and the test as containers
|
|
# *inside* the OpenZaak compose network (reaching it by container IP), so dotnet
|
|
# lives in the test image and the runner needs only Docker. This sidesteps the
|
|
# runner being unable to reach published ports (gitea-actions-gotchas.md §5).
|
|
# Needs egress to pull base images + nuget + selectielijst.openzaak.nl.
|
|
- run: make integration
|
|
- name: dump OpenZaak logs on failure
|
|
if: failure()
|
|
run: docker compose -f infra/openzaak/docker-compose.yml logs --no-color --tail=80 oz-init openzaak 2>&1 || true
|
|
- name: tear down on failure
|
|
if: failure()
|
|
run: docker compose -f infra/openzaak/docker-compose.yml down --volumes 2>&1 || true
|
|
|
|
notifications:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
# `make verify-notifications` brings up OpenZaak + NRC, seeds, and asserts a
|
|
# zaak-create notification is delivered to a subscriber — all via containers on
|
|
# the compose network (the runner can't reach published ports; §5). Needs only
|
|
# Docker + egress (base images, selectielijst.openzaak.nl).
|
|
- run: make verify-notifications
|
|
- name: dump OpenZaak/NRC logs on failure
|
|
if: failure()
|
|
run: docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat 2>&1 || true
|
|
- name: tear down on failure
|
|
if: failure()
|
|
run: docker compose -f infra/openzaak/docker-compose.yml -f infra/opennotificaties/docker-compose.yml down --volumes 2>&1 || true
|
|
|
|
compose-smoke:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@v4
|
|
- run: make smoke
|
|
- name: dump container logs on failure
|
|
if: failure()
|
|
run: docker compose -f infra/docker-compose.yml logs --no-color --tail=80 oz-init openzaak nrc-init nrc-web flowable-init keycloak acl bff 2>&1 || true
|
|
- name: tear down on failure
|
|
if: failure()
|
|
run: docker compose -f infra/docker-compose.yml down --volumes 2>&1 || true
|