ci: add CI gates to release workflows

.github/workflows/release-agent.yml

@@ -14,8 +14,119 @@ permissions:
   contents: write
 
 jobs:
+  prepare:
+    name: Verify sqlx cache
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:18-alpine
+        env:
+          POSTGRES_USER: lynx_ci
+          POSTGRES_PASSWORD: lynx_ci
+          POSTGRES_DB: lynx_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    defaults:
+      run:
+        working-directory: lynx
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
+        with:
+          toolchain: stable
+
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: lynx
+
+      - name: Install sqlx-cli
+        run: cargo install sqlx-cli --no-default-features --features postgres --locked
+
+      - name: Run migrations
+        env:
+          DATABASE_URL: postgres://lynx_ci:lynx_ci@localhost:5432/lynx_ci
+        run: |
+          sqlx migrate run --source agent/migrations
+          sqlx migrate run --source dashboard/server/migrations
+
+      - name: Verify sqlx cache is up-to-date
+        env:
+          DATABASE_URL: postgres://lynx_ci:lynx_ci@localhost:5432/lynx_ci
+        run: cargo sqlx prepare --check --workspace
+
+  ci:
+    name: CI checks
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:18-alpine
+        env:
+          POSTGRES_USER: lynx_ci
+          POSTGRES_PASSWORD: lynx_ci
+          POSTGRES_DB: lynx_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    defaults:
+      run:
+        working-directory: lynx
+
+    env:
+      CARGO_TERM_COLOR: always
+      RUST_BACKTRACE: 1
+      DATABASE_URL: postgres://lynx_ci:lynx_ci@localhost:5432/lynx_ci
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: lynx
+
+      - name: Install sqlx-cli
+        run: cargo install sqlx-cli --no-default-features --features postgres --locked
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run agent migrations
+        run: sqlx migrate run --source agent/migrations
+
+      - name: fmt
+        run: cargo fmt --package lynx-agent -- --check
+
+      - name: clippy
+        run: cargo clippy --package lynx-agent -- -D warnings
+
+      - name: test
+        run: cargo test --package lynx-agent --bin lynx-agent
+
+      - name: audit
+        run: cargo audit --ignore RUSTSEC-2023-0071
+
   build:
     name: Build ${{ matrix.arch }}
+    needs: [prepare, ci]
     runs-on: ubuntu-latest
 
     strategy:
@@ -79,7 +190,7 @@ jobs:
           cp "$BINARY" "$ARTIFACT"
           python3 .github/scripts/sign.py "$RELEASE_SIGN_KEY" "$ARTIFACT"
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: agent-${{ matrix.arch }}
           path: |
@@ -95,7 +206,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           merge-multiple: true
 

.github/workflows/release-dashboard.yml

@@ -20,17 +20,17 @@ jobs:
 
     services:
       postgres:
-        image: postgres:18
+        image: postgres:18-alpine
         env:
-          POSTGRES_DB: lynx_dashboard
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: ci_test
+          POSTGRES_USER: lynx_ci
+          POSTGRES_PASSWORD: lynx_ci
+          POSTGRES_DB: lynx_ci
         ports:
           - 5432:5432
         options: >-
           --health-cmd pg_isready
           --health-interval 5s
-          --health-timeout 3s
+          --health-timeout 5s
           --health-retries 10
 
     defaults:
@@ -53,17 +53,117 @@ jobs:
 
       - name: Run migrations
         env:
-          DATABASE_URL: postgresql://postgres:ci_test@localhost:5432/lynx_dashboard
-        run: sqlx migrate run --source dashboard/server/migrations
+          DATABASE_URL: postgres://lynx_ci:lynx_ci@localhost:5432/lynx_ci
+        run: |
+          sqlx migrate run --source dashboard/server/migrations
+          sqlx migrate run --source agent/migrations
 
       - name: Verify sqlx cache is up-to-date
         env:
-          DATABASE_URL: postgresql://postgres:ci_test@localhost:5432/lynx_dashboard
+          DATABASE_URL: postgres://lynx_ci:lynx_ci@localhost:5432/lynx_ci
         run: cargo sqlx prepare --check --workspace
 
+  ci-server:
+    name: CI server (Rust)
+    runs-on: ubuntu-latest
+
+    services:
+      postgres:
+        image: postgres:18-alpine
+        env:
+          POSTGRES_USER: lynx_ci
+          POSTGRES_PASSWORD: lynx_ci
+          POSTGRES_DB: lynx_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+      redis:
+        image: redis:8-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    defaults:
+      run:
+        working-directory: lynx
+
+    env:
+      CARGO_TERM_COLOR: always
+      RUST_BACKTRACE: 1
+      DATABASE_URL: postgres://lynx_ci:lynx_ci@localhost:5432/lynx_ci
+      REDIS_URL: redis://localhost:6379
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # stable
+        with:
+          toolchain: stable
+          components: rustfmt, clippy
+
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          workspaces: lynx
+
+      - name: Install sqlx-cli
+        run: cargo install sqlx-cli --no-default-features --features postgres --locked
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Run migrations
+        run: sqlx migrate run --source dashboard/server/migrations
+
+      - name: fmt
+        run: cargo fmt --package lynx-dashboard-server -- --check
+
+      - name: clippy
+        run: cargo clippy --package lynx-dashboard-server -- -D warnings
+
+      - name: test
+        run: cargo test --package lynx-dashboard-server -- --test-threads=1
+
+      - name: audit
+        run: cargo audit --ignore RUSTSEC-2023-0071
+
+  ci-ui:
+    name: CI UI (frontend)
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: lynx/dashboard/ui
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: typecheck
+        run: bun run typecheck
+
+      - name: test
+        run: bun run test
+
+      - name: audit
+        run: bun audit --audit-level high
+
   build:
     name: Build ${{ matrix.arch }}
-    needs: prepare
+    needs: [prepare, ci-server, ci-ui]
     runs-on: ubuntu-latest
 
     strategy:
@@ -187,7 +287,7 @@ jobs:
       # --- Upload artifacts ---------------------------------------------------
 
       - name: Upload release artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dashboard-${{ matrix.arch }}
           path: |
@@ -207,7 +307,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           merge-multiple: true