From da4250c1027a3725eb947a29fc97e49c0526234f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 10 May 2026 00:52:29 +0000
Subject: [PATCH 01/13] chore: converge workflows to deterministic ci
architecture
Agent-Logs-Url: https://github.com/SMSDAO/TradeOS/sessions/3c2458ad-668b-49fc-9f9e-5bf4a0fdb2f1
Co-authored-by: SMSDAO <144380926+SMSDAO@users.noreply.github.com>
---
.github/workflows/auto-label.yml | 127 ----
.../workflows/autonomous-oracle-pipeline.yml | 75 ---
.github/workflows/ci.yml | 588 ++----------------
.github/workflows/codeql-analysis.yml | 98 ---
.../complete-production-pipeline.yml | 371 -----------
.github/workflows/deploy-preview.yml | 197 ------
.github/workflows/deploy-railway-preview.yml | 358 -----------
.github/workflows/deploy-railway.yml | 230 -------
.github/workflows/deploy.yml | 67 ++
.github/workflows/docker-build.yml | 142 -----
.github/workflows/failed-job-handler.yml | 204 ------
.github/workflows/gxq-master-ci.yml | 314 ----------
.github/workflows/gxq-pr-check.yml | 153 -----
.github/workflows/gxq-scheduled-health.yml | 193 ------
.github/workflows/performance-monitoring.yml | 157 -----
.../workflows/powershell-merge-automation.yml | 298 ---------
.github/workflows/rename-vercel-hosts.yml | 109 ----
.github/workflows/security.yml | 55 ++
.github/workflows/self-heal.yml | 29 +
.github/workflows/self-optimize.yml | 582 -----------------
.github/workflows/sync-railway-secrets.yml | 274 --------
docs/branch-protection.md | 34 +
docs/ci-audit.md | 87 +++
package.json | 7 +-
scripts/converge.sh | 162 +++++
scripts/doctor.ts | 383 ++++++++++++
26 files changed, 880 insertions(+), 4414 deletions(-)
delete mode 100644 .github/workflows/auto-label.yml
delete mode 100644 .github/workflows/autonomous-oracle-pipeline.yml
delete mode 100644 .github/workflows/codeql-analysis.yml
delete mode 100644 .github/workflows/complete-production-pipeline.yml
delete mode 100644 .github/workflows/deploy-preview.yml
delete mode 100644 .github/workflows/deploy-railway-preview.yml
delete mode 100644 .github/workflows/deploy-railway.yml
create mode 100644 .github/workflows/deploy.yml
delete mode 100644 .github/workflows/docker-build.yml
delete mode 100644 .github/workflows/failed-job-handler.yml
delete mode 100644 .github/workflows/gxq-master-ci.yml
delete mode 100644 .github/workflows/gxq-pr-check.yml
delete mode 100644 .github/workflows/gxq-scheduled-health.yml
delete mode 100644 .github/workflows/performance-monitoring.yml
delete mode 100644 .github/workflows/powershell-merge-automation.yml
delete mode 100644 .github/workflows/rename-vercel-hosts.yml
create mode 100644 .github/workflows/security.yml
create mode 100644 .github/workflows/self-heal.yml
delete mode 100644 .github/workflows/self-optimize.yml
delete mode 100644 .github/workflows/sync-railway-secrets.yml
create mode 100644 docs/branch-protection.md
create mode 100644 docs/ci-audit.md
create mode 100755 scripts/converge.sh
create mode 100644 scripts/doctor.ts
diff --git a/.github/workflows/auto-label.yml b/.github/workflows/auto-label.yml
deleted file mode 100644
index 3641889e..00000000
--- a/.github/workflows/auto-label.yml
+++ /dev/null
@@ -1,127 +0,0 @@
-name: Auto-label PRs
-
-on:
- pull_request:
- types: [opened, reopened, synchronize]
- workflow_dispatch:
- inputs:
- apply_to_all_open_prs:
- description: "Also apply labels to all open PRs"
- type: boolean
- default: false
-
-permissions:
- contents: read
- issues: write
- pull-requests: write
-
-jobs:
- label-single:
- if: github.event_name == 'pull_request'
- runs-on: ubuntu-latest
- steps:
- - name: Ensure labels exist
- uses: actions/github-script@v9
- with:
- script: |
- const labels = [
- { name: "auto-merge", color: "2ecc71", description: "Enable auto-merge when checks pass" },
- { name: "skip-deployment", color: "b31f45", description: "Skip deployment checks" },
- ];
- for (const l of labels) {
- try {
- await github.rest.issues.getLabel({
- owner: context.repo.owner,
- repo: context.repo.repo,
- name: l.name,
- });
- } catch (e) {
- if (e.status === 404) {
- await github.rest.issues.createLabel({
- owner: context.repo.owner,
- repo: context.repo.repo,
- name: l.name,
- color: l.color,
- description: l.description,
- });
- } else {
- throw e;
- }
- }
- }
- - name: Add labels to this PR
- uses: actions/github-script@v9
- with:
- script: |
- const number = context.payload.pull_request.number;
- await github.rest.issues.addLabels({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: number,
- labels: ["auto-merge", "skip-deployment"],
- });
-
- label-all-open:
- if: github.event_name == 'workflow_dispatch' && inputs.apply_to_all_open_prs == true
- runs-on: ubuntu-latest
- steps:
- - name: Ensure labels exist
- uses: actions/github-script@v9
- with:
- script: |
- const labels = [
- { name: "auto-merge", color: "2ecc71", description: "Enable auto-merge when checks pass" },
- { name: "skip-deployment", color: "b31f45", description: "Skip deployment checks" },
- ];
- for (const l of labels) {
- try {
- await github.rest.issues.getLabel({
- owner: context.repo.owner,
- repo: context.repo.repo,
- name: l.name,
- });
- } catch (e) {
- if (e.status === 404) {
- await github.rest.issues.createLabel({
- owner: context.repo.owner,
- repo: context.repo.repo,
- name: l.name,
- color: l.color,
- description: l.description,
- });
- } else {
- throw e;
- }
- }
- }
- - name: Add labels to all open PRs
- uses: actions/github-script@v9
- with:
- script: |
- async function paginateAllOpenPRs() {
- const results = [];
- let page = 1;
- while (true) {
- const { data } = await github.rest.pulls.list({
- owner: context.repo.owner,
- repo: context.repo.repo,
- state: "open",
- per_page: 100,
- page,
- });
- results.push(...data);
- if (data.length < 100) break;
- page++;
- }
- return results;
- }
-
- const prs = await paginateAllOpenPRs();
- for (const pr of prs) {
- await github.rest.issues.addLabels({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: pr.number,
- labels: ["auto-merge", "skip-deployment"],
- });
- }
diff --git a/.github/workflows/autonomous-oracle-pipeline.yml b/.github/workflows/autonomous-oracle-pipeline.yml
deleted file mode 100644
index 112bebe3..00000000
--- a/.github/workflows/autonomous-oracle-pipeline.yml
+++ /dev/null
@@ -1,75 +0,0 @@
-name: Autonomous Oracle CI/CD
-
-on:
- push:
- branches: [ main, develop ]
- pull_request:
- branches: [ main, develop ]
- workflow_dispatch:
-
-permissions:
- contents: write
- pull-requests: write
- checks: write
- statuses: write
-
-jobs:
- oracle-analysis:
- name: Oracle Analysis & Fix
- runs-on: ubuntu-latest
- steps:
- - name: Checkout Code
- uses: actions/checkout@v6
- with:
- fetch-depth: 0
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Install Dependencies
- run: npm ci
-
- - name: Run GXQ Autonomous Oracle
- id: oracle
- env:
- ADMIN_TOKEN: ${{ secrets.GXQ_ADMIN_TOKEN }}
- ADMIN_API_URL: ${{ secrets.GXQ_ADMIN_API_URL }}
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- run: npx ts-node scripts/autonomous-oracle.ts
-
- - name: Commit Auto-Fixes
- if: always()
- run: |
- git config user.name "GXQ Oracle Bot"
- git config user.email "oracle@gxq.studio"
- git add .
- if ! git diff --staged --quiet; then
- git commit -m "chore: autonomous oracle auto-fix [skip ci]"
- git push origin HEAD:${{ github.head_ref || github.ref_name }}
- fi
-
- deployment-gateway:
- name: Deployment Gateway
- needs: oracle-analysis
- if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
- runs-on: ubuntu-latest
- steps:
- - name: Checkout
- uses: actions/checkout@v6
-
- - name: Deploy to Vercel
- uses: amondnet/vercel-action@v42
- with:
- vercel-token: ${{ secrets.VERCEL_TOKEN }}
- vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
- vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
- vercel-args: ${{ github.ref == 'refs/heads/main' && '--prod' || '' }}
-
- - name: Post-Deploy Health Check
- run: |
- URL=${{ github.ref == 'refs/heads/main' && 'https://gxq.studio' || 'https://dev.gxq.studio' }}
- echo "Checking health of $URL..."
- curl -f "$URL/api/admin/status" || (echo "Health check failed!" && exit 1)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b394dbab..ed2c7c7f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,559 +1,87 @@
-name: CI - Comprehensive Pipeline
+name: ci
on:
pull_request:
- branches:
- - main
- - develop
- - dev
push:
branches:
- main
- - develop
- - dev
workflow_dispatch:
concurrency:
- group: ${{ github.workflow }}-${{ github.ref }}
+ group: ci-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
- checks: write
- pull-requests: write
jobs:
- install:
- name: Install Dependencies
- runs-on: ubuntu-latest
- timeout-minutes: 10
- strategy:
- fail-fast: false
- matrix:
- node-version: [24]
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v6
- with:
- node-version: ${{ matrix.node-version }}
- cache: 'npm'
-
- - name: Install backend dependencies
- run: npm ci
-
- - name: Cache backend node_modules
- uses: actions/cache@v5
- with:
- path: node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-backend-${{ hashFiles('package-lock.json') }}
-
- - name: Install webapp dependencies
- working-directory: ./webapp
- run: npm ci
-
- - name: Cache webapp node_modules
- uses: actions/cache@v5
- with:
- path: webapp/node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-webapp-${{ hashFiles('webapp/package-lock.json') }}
-
lint:
- name: Lint (Node ${{ matrix.node-version }})
+ name: lint
runs-on: ubuntu-latest
- needs: install
- timeout-minutes: 10
- strategy:
- fail-fast: false
- matrix:
- node-version: [24]
-
+ timeout-minutes: 20
steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v6
- with:
- node-version: ${{ matrix.node-version }}
- cache: 'npm'
-
- - name: Restore backend cache
- uses: actions/cache@v5
- with:
- path: node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-backend-${{ hashFiles('package-lock.json') }}
-
- - name: Install backend dependencies (if cache miss)
- run: npm ci --prefer-offline || npm ci
-
- - name: Run backend ESLint
- run: npm run lint
- # TODO: Remove continue-on-error once lint issues are fixed (see issue #TBD)
- # Currently 122 linting problems (17 errors, 105 warnings) exist in the codebase
- continue-on-error: true
-
- - name: Restore webapp cache
- uses: actions/cache@v5
- with:
- path: webapp/node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-webapp-${{ hashFiles('webapp/package-lock.json') }}
-
- - name: Install webapp dependencies (if cache miss)
- working-directory: ./webapp
- run: npm ci --prefer-offline || npm ci
-
- - name: Run webapp ESLint
- run: npm run lint:webapp
- # TODO: Remove continue-on-error once lint issues are fixed (see issue #TBD)
- # Currently has linting warnings that need to be addressed
- continue-on-error: true
+ - uses: actions/checkout@v6
+ - uses: actions/setup-node@v6
+ with:
+ node-version-file: .nvmrc
+ cache: npm
+ cache-dependency-path: |
+ package-lock.json
+ webapp/package-lock.json
+ - run: npm ci --no-audit --no-fund
+ - run: npm --prefix webapp ci --no-audit --no-fund
+ - run: npm run lint
+ - run: npm run lint:webapp
typecheck:
- name: Type Check (Node ${{ matrix.node-version }})
- runs-on: ubuntu-latest
- needs: install
- timeout-minutes: 10
- strategy:
- fail-fast: false
- matrix:
- node-version: [24]
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v6
- with:
- node-version: ${{ matrix.node-version }}
- cache: 'npm'
-
- - name: Restore backend cache
- uses: actions/cache@v5
- with:
- path: node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-backend-${{ hashFiles('package-lock.json') }}
-
- - name: Install backend dependencies (if cache miss)
- run: npm ci --prefer-offline || npm ci
-
- - name: Run backend type check
- run: npm run type-check
-
- - name: Restore webapp cache
- uses: actions/cache@v5
- with:
- path: webapp/node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-webapp-${{ hashFiles('webapp/package-lock.json') }}
-
- - name: Install webapp dependencies (if cache miss)
- working-directory: ./webapp
- run: npm ci --prefer-offline || npm ci
-
- - name: Run webapp type check
- run: npm run type-check:webapp
-
- unit-tests-backend:
- name: Backend Tests (Node ${{ matrix.node-version }})
- runs-on: ubuntu-latest
- needs: [lint, typecheck]
- timeout-minutes: 15
- strategy:
- fail-fast: false
- matrix:
- node-version: [24]
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v6
- with:
- node-version: ${{ matrix.node-version }}
- cache: 'npm'
-
- - name: Restore backend cache
- uses: actions/cache@v5
- with:
- path: node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-backend-${{ hashFiles('package-lock.json') }}
-
- - name: Install backend dependencies (if cache miss)
- run: npm ci --prefer-offline || npm ci
-
- - name: Run backend tests
- run: npm test
- env:
- NODE_ENV: test
- JEST_TIMEOUT: 30000
-
- - name: Upload backend coverage
- uses: actions/upload-artifact@v7
- if: matrix.node-version == 24
- with:
- name: backend-coverage
- path: coverage/
- retention-days: 7
- if-no-files-found: ignore
-
- - name: Upload test results
- if: always()
- uses: actions/upload-artifact@v7
- with:
- name: backend-test-results-node-${{ matrix.node-version }}
- path: |
- coverage/
- test-results/
- retention-days: 7
- if-no-files-found: ignore
-
- unit-tests-webapp:
- name: Webapp Tests (Node ${{ matrix.node-version }})
- runs-on: ubuntu-latest
- needs: [lint, typecheck]
- timeout-minutes: 15
- strategy:
- fail-fast: false
- matrix:
- node-version: [24]
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v6
- with:
- node-version: ${{ matrix.node-version }}
- cache: 'npm'
- cache-dependency-path: webapp/package-lock.json
-
- - name: Restore webapp cache
- uses: actions/cache@v5
- with:
- path: webapp/node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-webapp-${{ hashFiles('webapp/package-lock.json') }}
-
- - name: Install webapp dependencies (if cache miss)
- working-directory: ./webapp
- run: npm ci --prefer-offline || npm ci
-
- - name: Run webapp tests
- run: npm run test:webapp
- continue-on-error: true
- env:
- NODE_ENV: test
-
- - name: Upload webapp coverage
- uses: actions/upload-artifact@v7
- if: matrix.node-version == 24
- with:
- name: webapp-coverage
- path: webapp/coverage/
- retention-days: 7
- if-no-files-found: ignore
-
- coverage-merge:
- name: Merge Coverage & Upload
+ name: typecheck
runs-on: ubuntu-latest
- needs: [unit-tests-backend, unit-tests-webapp]
- if: always()
- timeout-minutes: 10
-
+ timeout-minutes: 20
steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
-
- - name: Download backend coverage
- uses: actions/download-artifact@v8
- with:
- name: backend-coverage
- path: coverage/
- continue-on-error: true
-
- - name: Download webapp coverage
- uses: actions/download-artifact@v8
- with:
- name: webapp-coverage
- path: webapp/coverage/
- continue-on-error: true
-
- - name: Merge coverage reports
- run: bash scripts/merge-coverage.sh
- continue-on-error: true
-
- - name: Upload to Codecov
- uses: codecov/codecov-action@v6
- with:
- token: ${{ secrets.CODECOV_TOKEN }}
- files: ./coverage/merged/lcov.info,./coverage/lcov.info
- flags: unittests
- name: codecov-umbrella
- fail_ci_if_error: false
- verbose: true
- continue-on-error: true
+ - uses: actions/checkout@v6
+ - uses: actions/setup-node@v6
+ with:
+ node-version-file: .nvmrc
+ cache: npm
+ cache-dependency-path: |
+ package-lock.json
+ webapp/package-lock.json
+ - run: npm ci --no-audit --no-fund
+ - run: npm --prefix webapp ci --no-audit --no-fund
+ - run: npm run type-check
+ - run: npm run type-check:webapp
- health-check:
- name: Health Check Tests (Node ${{ matrix.node-version }})
+ test:
+ name: test
runs-on: ubuntu-latest
- needs: [build]
- timeout-minutes: 10
- strategy:
- fail-fast: false
- matrix:
- node-version: [24]
-
+ timeout-minutes: 30
steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v6
- with:
- node-version: ${{ matrix.node-version }}
- cache: 'npm'
-
- - name: Restore backend cache
- uses: actions/cache@v5
- with:
- path: node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-backend-${{ hashFiles('package-lock.json') }}
-
- - name: Install backend dependencies (if cache miss)
- run: npm ci --prefer-offline || npm ci
-
- - name: Download backend build artifacts
- uses: actions/download-artifact@v8
- with:
- name: backend-dist
- path: dist/
-
- - name: Restore webapp cache
- uses: actions/cache@v5
- with:
- path: webapp/node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-webapp-${{ hashFiles('webapp/package-lock.json') }}
-
- - name: Install webapp dependencies (if cache miss)
- working-directory: ./webapp
- run: npm ci --prefer-offline || npm ci
-
- - name: Download webapp build artifacts
- uses: actions/download-artifact@v8
- with:
- name: webapp-build
- path: webapp/.next/
- continue-on-error: true
-
- - name: Validate build artifacts
- run: bash scripts/validate-build.sh
-
- - name: Test environment configuration
- run: bash scripts/env-sync-check.sh
- continue-on-error: true
-
- - name: Verify health check script
- run: |
- # Create minimal .env for testing
- cat > .env << EOF
- SOLANA_RPC_URL=https://api.mainnet-beta.solana.com
- WALLET_PRIVATE_KEY=test_key_placeholder_not_real
- JWT_SECRET=test_jwt_secret_for_ci_only
- ADMIN_USERNAME=admin
- ADMIN_PASSWORD=test_password
- EOF
-
- # Run health check in dry-run mode
- bash scripts/health-check.sh || echo "Health check completed with warnings (expected in CI)"
-
- security-scan:
- name: Security Scan (Node ${{ matrix.node-version }})
- runs-on: ubuntu-latest
- needs: install
- timeout-minutes: 10
- strategy:
- fail-fast: false
- matrix:
- node-version: [24]
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v6
- with:
- node-version: ${{ matrix.node-version }}
- cache: 'npm'
-
- - name: Restore backend cache
- uses: actions/cache@v5
- with:
- path: node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-backend-${{ hashFiles('package-lock.json') }}
-
- - name: Install backend dependencies (if cache miss)
- run: npm ci --prefer-offline || npm ci
-
- - name: Run npm audit (backend)
- run: npm audit --audit-level=high || echo "⚠️ Security vulnerabilities found - review required"
- continue-on-error: true
-
- - name: Restore webapp cache
- uses: actions/cache@v5
- with:
- path: webapp/node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-webapp-${{ hashFiles('webapp/package-lock.json') }}
-
- - name: Install webapp dependencies (if cache miss)
- working-directory: ./webapp
- run: npm ci --prefer-offline || npm ci
-
- - name: Run npm audit (webapp)
- working-directory: ./webapp
- run: npm audit --audit-level=high || echo "⚠️ Security vulnerabilities found - review required"
- continue-on-error: true
+ - uses: actions/checkout@v6
+ - uses: actions/setup-node@v6
+ with:
+ node-version-file: .nvmrc
+ cache: npm
+ cache-dependency-path: |
+ package-lock.json
+ webapp/package-lock.json
+ - run: npm ci --no-audit --no-fund
+ - run: npm --prefix webapp ci --no-audit --no-fund
+ - run: npm test
+ - run: npm run test:webapp
build:
- name: Build (Node ${{ matrix.node-version }})
+ name: build
runs-on: ubuntu-latest
- needs: [lint, typecheck]
- timeout-minutes: 15
- strategy:
- fail-fast: false
- matrix:
- node-version: [24]
-
+ timeout-minutes: 30
steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js ${{ matrix.node-version }}
- uses: actions/setup-node@v6
- with:
- node-version: ${{ matrix.node-version }}
- cache: 'npm'
-
- - name: Restore backend cache
- uses: actions/cache@v5
- with:
- path: node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-backend-${{ hashFiles('package-lock.json') }}
-
- - name: Install backend dependencies (if cache miss)
- run: npm ci --prefer-offline || npm ci
-
- - name: Build backend
- run: npm run build:backend
-
- - name: Upload backend build artifacts
- uses: actions/upload-artifact@v7
- if: matrix.node-version == 24
- with:
- name: backend-dist
- path: dist/
- retention-days: 3
-
- - name: Restore webapp cache
- uses: actions/cache@v5
- with:
- path: webapp/node_modules
- key: ${{ runner.os }}-node-${{ matrix.node-version }}-webapp-${{ hashFiles('webapp/package-lock.json') }}
-
- - name: Install webapp dependencies (if cache miss)
- working-directory: ./webapp
- run: npm ci --prefer-offline || npm ci
-
- - name: Build webapp
- run: npm run build:webapp
- env:
- NEXT_PUBLIC_RPC_URL: ${{ secrets.NEXT_PUBLIC_RPC_URL || 'https://api.mainnet-beta.solana.com' }}
-
- - name: Upload webapp build artifacts
- uses: actions/upload-artifact@v7
- if: matrix.node-version == 24
- with:
- name: webapp-build
- path: webapp/.next/
- retention-days: 3
- if-no-files-found: ignore
-
- ci-summary:
- name: CI Summary
- runs-on: ubuntu-latest
- needs:
- - lint
- - typecheck
- - unit-tests-backend
- - unit-tests-webapp
- - coverage-merge
- - security-scan
- - build
- - health-check
- if: always()
-
- steps:
- - name: Check CI status
- run: |
- echo "## CI Pipeline Results" >> $GITHUB_STEP_SUMMARY
- echo "" >> $GITHUB_STEP_SUMMARY
- echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY
- echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
- echo "| Lint | ${{ needs.lint.result }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Type Check | ${{ needs.typecheck.result }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Backend Tests | ${{ needs.unit-tests-backend.result }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Webapp Tests | ${{ needs.unit-tests-webapp.result }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Coverage Merge | ${{ needs.coverage-merge.result }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Security Scan | ${{ needs.security-scan.result }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Build | ${{ needs.build.result }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Health Check | ${{ needs.health-check.result }} |" >> $GITHUB_STEP_SUMMARY
- echo "" >> $GITHUB_STEP_SUMMARY
-
- if [[ "${{ needs.lint.result }}" == "failure" ]] || \
- [[ "${{ needs.typecheck.result }}" == "failure" ]] || \
- [[ "${{ needs.unit-tests-backend.result }}" == "failure" ]] || \
- [[ "${{ needs.build.result }}" == "failure" ]] || \
- [[ "${{ needs.health-check.result }}" == "failure" ]]; then
- echo "❌ CI checks failed!" >> $GITHUB_STEP_SUMMARY
- exit 1
- else
- echo "✅ All CI checks passed!" >> $GITHUB_STEP_SUMMARY
- fi
-
- - name: Comment on PR
- if: github.event_name == 'pull_request'
- uses: actions/github-script@v9
- with:
- script: |
- const summary = `## 🔍 CI Pipeline Results
-
- | Job | Status |
- |-----|--------|
- | Lint | ${{ needs.lint.result == 'success' ? '✅' : '❌' }} |
- | Type Check | ${{ needs.typecheck.result == 'success' ? '✅' : '❌' }} |
- | Backend Tests | ${{ needs.unit-tests-backend.result == 'success' ? '✅' : '❌' }} |
- | Webapp Tests | ${{ needs.unit-tests-webapp.result == 'success' ? '✅' : '⚠️' }} |
- | Coverage | ${{ needs.coverage-merge.result == 'success' ? '✅' : '⚠️' }} |
- | Security Scan | ${{ needs.security-scan.result == 'success' ? '✅' : '⚠️' }} |
- | Build | ${{ needs.build.result == 'success' ? '✅' : '❌' }} |
- | Health Check | ${{ needs.health-check.result == 'success' ? '✅' : '❌' }} |
-
- ${needs.lint.result == 'failure' || needs.typecheck.result == 'failure' || needs.unit-tests-backend.result == 'failure' || needs.build.result == 'failure' || needs.health-check.result == 'failure' ? '❌ **CI checks failed!** Please review the errors above.' : '✅ **All CI checks passed!**'}
- `;
-
- github.rest.issues.createComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number,
- body: summary
- });
+ - uses: actions/checkout@v6
+ - uses: actions/setup-node@v6
+ with:
+ node-version-file: .nvmrc
+ cache: npm
+ cache-dependency-path: |
+ package-lock.json
+ webapp/package-lock.json
+ - run: npm ci --no-audit --no-fund
+ - run: npm --prefix webapp ci --no-audit --no-fund
+ - run: npm run build
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
deleted file mode 100644
index 9e5ee632..00000000
--- a/.github/workflows/codeql-analysis.yml
+++ /dev/null
@@ -1,98 +0,0 @@
-name: CodeQL Security Analysis
-
-on:
- push:
- branches:
- - main
- - develop
- pull_request:
- branches:
- - main
- - develop
- schedule:
- # Run at 02:00 UTC every Monday
- - cron: '0 2 * * 1'
- workflow_dispatch:
-
-permissions:
- actions: read
- contents: read
- security-events: write
-
-jobs:
- analyze:
- name: CodeQL Analysis
- runs-on: ubuntu-latest
- timeout-minutes: 30
-
- strategy:
- fail-fast: false
- matrix:
- language: ['javascript']
- # CodeQL supports: 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift'
- # Learn more: https://aka.ms/codeql-docs/language-support
-
- steps:
- - name: Checkout repository
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Initialize CodeQL
- uses: github/codeql-action/init@v4
- with:
- languages: ${{ matrix.language }}
- # If you want to specify custom queries, you can do so here
- # queries: security-extended,security-and-quality
- config-file: ./.github/codeql-config.yml
-
- - name: Install dependencies (for better analysis)
- run: |
- npm ci || echo "Dependency install failed, continuing with available code"
- cd webapp && npm ci || echo "Webapp dependency install failed"
- continue-on-error: true
-
- # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
- # For JavaScript/TypeScript, autobuild will install dependencies and build if a build script exists
- - name: Autobuild
- uses: github/codeql-action/autobuild@v4
- continue-on-error: true
-
- - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@v4
- with:
- category: "/language:${{ matrix.language }}"
- upload: true
-
- - name: Upload SARIF results
- if: always()
- uses: github/codeql-action/upload-sarif@v4
- with:
- sarif_file: ../results
- continue-on-error: true
-
- - name: Check for high severity alerts
- if: always()
- uses: actions/github-script@v9
- with:
- script: |
- const { data: alerts } = await github.rest.codeScanning.listAlertsForRepo({
- owner: context.repo.owner,
- repo: context.repo.repo,
- state: 'open',
- severity: 'high'
- });
-
- const criticalAlerts = alerts.filter(a => a.rule.severity === 'error' || a.rule.severity === 'warning');
-
- if (criticalAlerts.length > 0) {
- console.log(`⚠️ Found ${criticalAlerts.length} high/critical severity alerts`);
- core.warning(`Found ${criticalAlerts.length} high/critical severity CodeQL alerts. Please review in the Security tab.`);
- } else {
- console.log('✅ No high/critical severity alerts found');
- }
- continue-on-error: true
diff --git a/.github/workflows/complete-production-pipeline.yml b/.github/workflows/complete-production-pipeline.yml
deleted file mode 100644
index 86a6feb4..00000000
--- a/.github/workflows/complete-production-pipeline.yml
+++ /dev/null
@@ -1,371 +0,0 @@
-name: Complete Production Pipeline
-
-on:
- push:
- branches:
- - main
- - develop
- - staging
- pull_request:
- branches:
- - main
- - develop
- workflow_dispatch:
- inputs:
- environment:
- description: 'Target environment'
- required: true
- default: 'staging'
- type: choice
- options:
- - staging
- - production
-
-concurrency:
- group: ${{ github.workflow }}-${{ github.ref }}
- cancel-in-progress: true
-
-permissions:
- contents: write
- checks: write
- pull-requests: write
- issues: write
- actions: write
-
-jobs:
- security-scan:
- name: Security Scan
- runs-on: ubuntu-latest
- timeout-minutes: 10
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Install dependencies
- run: npm ci
-
- - name: Run npm audit
- run: npm audit --audit-level=high || echo "⚠️ Security vulnerabilities found"
- continue-on-error: true
-
- - name: Run Snyk security scan
- uses: snyk/actions/node@master
- continue-on-error: true
- env:
- SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
- with:
- args: --severity-threshold=high
-
- build-and-test:
- name: Build and Test
- runs-on: ubuntu-latest
- needs: security-scan
- timeout-minutes: 20
- strategy:
- fail-fast: false
- matrix:
- retry: [1, 2, 3]
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Install backend dependencies (with retry)
- uses: nick-fields/retry@v4
- with:
- timeout_minutes: 10
- max_attempts: 3
- retry_wait_seconds: 30
- command: npm ci
-
- - name: Install webapp dependencies (with retry)
- uses: nick-fields/retry@v4
- with:
- timeout_minutes: 10
- max_attempts: 3
- retry_wait_seconds: 30
- command: cd webapp && npm ci
-
- - name: Lint backend
- run: npm run lint
- continue-on-error: true
-
- - name: Lint webapp
- run: npm run lint:webapp
- continue-on-error: true
-
- - name: Type check
- run: npm run type-check && npm run type-check:webapp
-
- - name: Run tests (with retry)
- uses: nick-fields/retry@v4
- with:
- timeout_minutes: 15
- max_attempts: 2
- retry_wait_seconds: 60
- command: npm test
-
- - name: Build backend
- run: npm run build:backend
-
- - name: Build webapp
- run: npm run build:webapp
- env:
- NEXT_PUBLIC_RPC_URL: ${{ secrets.NEXT_PUBLIC_RPC_URL || 'https://api.mainnet-beta.solana.com' }}
-
- - name: Upload artifacts
- if: matrix.retry == 1
- uses: actions/upload-artifact@v7
- with:
- name: build-artifacts
- path: |
- dist/
- webapp/.next/
- retention-days: 3
-
- - name: Success on first try
- if: matrix.retry == 1 && success()
- run: echo "::notice::Build succeeded on first attempt"
-
- canary-deployment:
- name: Canary Deployment
- runs-on: ubuntu-latest
- needs: build-and-test
- if: github.ref == 'refs/heads/staging' || github.event.inputs.environment == 'staging'
- timeout-minutes: 30
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Install dependencies
- run: npm ci
-
- - name: Run canary deployment
- run: npm run canary-deploy
- env:
- STAGING_URL: ${{ secrets.STAGING_URL || 'https://gxq-staging.vercel.app' }}
- PRODUCTION_URL: ${{ secrets.PRODUCTION_URL || 'https://gxq.vercel.app' }}
- VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
-
- - name: Comment on PR
- if: github.event_name == 'pull_request'
- uses: actions/github-script@v9
- with:
- script: |
- await github.rest.issues.createComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number,
- body: '✅ Canary deployment completed successfully! Ready for production.'
- });
-
- post-deployment-analysis:
- name: Post-Deployment Analysis
- runs-on: ubuntu-latest
- needs: [build-and-test]
- if: always()
- timeout-minutes: 15
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Install dependencies
- run: npm ci
-
- - name: Fetch deployment logs
- if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop'
- run: |
- echo "Fetching logs from Vercel..."
- # In a real setup, fetch logs from Vercel API
- touch combined.log error.log
- continue-on-error: true
-
- - name: Run post-deployment analysis
- run: npm run analyze-deployment
- env:
- AUTO_FIX_ENABLED: ${{ secrets.AUTO_FIX_ENABLED || 'false' }}
- AUTO_REDEPLOY_ENABLED: ${{ secrets.AUTO_REDEPLOY_ENABLED || 'false' }}
- GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
- continue-on-error: true
-
- - name: Commit auto-fixes
- if: env.AUTO_FIX_ENABLED == 'true'
- run: |
- git config user.name "GXQ Auto-Fix Bot"
- git config user.email "bot@gxq.studio"
- git add .
- if ! git diff --staged --quiet; then
- git commit -m "Auto-fix: Applied fixes from post-deployment analysis [skip ci]"
- git push
- fi
- continue-on-error: true
-
- setup-monitoring:
- name: Setup Monitoring
- runs-on: ubuntu-latest
- needs: build-and-test
- if: github.ref == 'refs/heads/main'
- timeout-minutes: 10
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Install dependencies
- run: npm ci
-
- - name: Generate monitoring configs
- run: npm run setup-monitoring
-
- - name: Upload monitoring configs
- uses: actions/upload-artifact@v7
- with:
- name: monitoring-configs
- path: monitoring/
- retention-days: 30
-
- - name: Deploy to Grafana
- if: env.GRAFANA_API_KEY != ''
- run: |
- echo "Deploying dashboard to Grafana..."
- # In a real setup, use Grafana API to import dashboard
- env:
- GRAFANA_API_KEY: ${{ secrets.GRAFANA_API_KEY }}
- GRAFANA_URL: ${{ secrets.GRAFANA_URL }}
- continue-on-error: true
-
- auto-ticketing:
- name: Auto-Ticketing
- runs-on: ubuntu-latest
- needs: [build-and-test, post-deployment-analysis]
- if: failure()
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Create failure issue
- uses: actions/github-script@v9
- with:
- script: |
- const workflowRun = await github.rest.actions.getWorkflowRun({
- owner: context.repo.owner,
- repo: context.repo.repo,
- run_id: context.runId
- });
-
- const issueBody = `## 🚨 Production Pipeline Failure
-
- **Workflow:** ${workflowRun.data.name}
- **Run:** [#${workflowRun.data.run_number}](${workflowRun.data.html_url})
- **Branch:** ${context.ref}
- **Commit:** ${context.sha.substring(0, 7)}
- **Triggered by:** ${context.actor}
-
- ### Failed Jobs
- Check the workflow run for details on which jobs failed.
-
- ### Recommended Actions
- 1. Review the failed job logs
- 2. Check for dependency or configuration issues
- 3. Verify all required secrets are set
- 4. Run the pipeline locally to reproduce
- 5. Fix the issue and re-run the pipeline
-
- ---
- *This issue was automatically created by the production pipeline*
- `;
-
- await github.rest.issues.create({
- owner: context.repo.owner,
- repo: context.repo.repo,
- title: `Production Pipeline Failure: ${context.ref}`,
- body: issueBody,
- labels: ['pipeline-failure', 'automated', 'high-priority']
- });
-
- pipeline-summary:
- name: Pipeline Summary
- runs-on: ubuntu-latest
- needs:
- - security-scan
- - build-and-test
- - canary-deployment
- - post-deployment-analysis
- - setup-monitoring
- if: always()
-
- steps:
- - name: Generate summary
- run: |
- echo "## 🚀 Production Pipeline Summary" >> $GITHUB_STEP_SUMMARY
- echo "" >> $GITHUB_STEP_SUMMARY
- echo "| Job | Status |" >> $GITHUB_STEP_SUMMARY
- echo "|-----|--------|" >> $GITHUB_STEP_SUMMARY
- echo "| Security Scan | ${{ needs.security-scan.result == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Build and Test | ${{ needs.build-and-test.result == 'success' && '✅' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Canary Deployment | ${{ needs.canary-deployment.result == 'success' && '✅' || needs.canary-deployment.result == 'skipped' && '⏭️' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Post-Deployment | ${{ needs.post-deployment-analysis.result == 'success' && '✅' || '⚠️' }} |" >> $GITHUB_STEP_SUMMARY
- echo "| Monitoring Setup | ${{ needs.setup-monitoring.result == 'success' && '✅' || needs.setup-monitoring.result == 'skipped' && '⏭️' || '❌' }} |" >> $GITHUB_STEP_SUMMARY
- echo "" >> $GITHUB_STEP_SUMMARY
-
- if [[ "${{ needs.build-and-test.result }}" == "failure" ]] || \
- [[ "${{ needs.security-scan.result }}" == "failure" ]]; then
- echo "❌ **Pipeline failed!** Check the jobs above for details." >> $GITHUB_STEP_SUMMARY
- exit 1
- else
- echo "✅ **Pipeline completed successfully!**" >> $GITHUB_STEP_SUMMARY
- fi
-
- - name: Notify on Slack
- if: failure() && github.ref == 'refs/heads/main'
- run: |
- curl -X POST ${{ secrets.SLACK_WEBHOOK_URL }} \
- -H 'Content-Type: application/json' \
- -d '{
- "text": "🚨 Production pipeline failed!",
- "blocks": [
- {
- "type": "section",
- "text": {
- "type": "mrkdwn",
- "text": "*Production Pipeline Failure*\n\nWorkflow: ${{ github.workflow }}\nBranch: ${{ github.ref }}\nCommit: ${{ github.sha }}"
- }
- }
- ]
- }'
- continue-on-error: true
diff --git a/.github/workflows/deploy-preview.yml b/.github/workflows/deploy-preview.yml
deleted file mode 100644
index 96e18902..00000000
--- a/.github/workflows/deploy-preview.yml
+++ /dev/null
@@ -1,197 +0,0 @@
-name: Deploy Preview
-
-on:
- pull_request:
- types: [opened, synchronize, reopened]
- branches:
- - main
- - develop
- - dev
-
-permissions:
- contents: read
- pull-requests: write
- deployments: write
-
-jobs:
- validate-secrets:
- name: Validate Required Secrets
- runs-on: ubuntu-latest
- timeout-minutes: 5
- outputs:
- has-secrets: ${{ steps.check.outputs.has-secrets }}
-
- steps:
- - name: Check required secrets
- id: check
- run: |
- MISSING_SECRETS=""
-
- if [ -z "${{ secrets.VERCEL_TOKEN }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}VERCEL_TOKEN, "
- fi
-
- if [ -z "${{ secrets.VERCEL_PROJECT_ID }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}VERCEL_PROJECT_ID, "
- fi
-
- if [ -z "${{ secrets.VERCEL_ORG_ID }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}VERCEL_ORG_ID, "
- fi
-
- if [ -n "$MISSING_SECRETS" ]; then
- echo "has-secrets=false" >> $GITHUB_OUTPUT
- echo "⚠️ Missing required secrets: $MISSING_SECRETS"
- echo "::warning::Missing required secrets: $MISSING_SECRETS"
- else
- echo "has-secrets=true" >> $GITHUB_OUTPUT
- echo "✅ All required secrets are configured"
- fi
-
- deploy-preview:
- name: Deploy to Vercel Preview
- runs-on: ubuntu-latest
- needs: validate-secrets
- if: needs.validate-secrets.outputs.has-secrets == 'true'
- timeout-minutes: 15
- environment:
- name: preview
- url: ${{ steps.deploy.outputs.url }}
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
- cache-dependency-path: webapp/package-lock.json
-
- - name: Install webapp dependencies
- working-directory: ./webapp
- run: npm ci
-
- - name: Build webapp
- working-directory: ./webapp
- run: npm run build
- env:
- NEXT_PUBLIC_RPC_URL: ${{ secrets.NEXT_PUBLIC_RPC_URL || 'https://api.mainnet-beta.solana.com' }}
-
- - name: Deploy to Vercel
- id: deploy
- uses: amondnet/vercel-action@v42
- with:
- vercel-token: ${{ secrets.VERCEL_TOKEN }}
- vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
- vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
- working-directory: ./webapp
- scope: ${{ secrets.VERCEL_ORG_ID }}
-
- - name: Add preview-deployed label
- uses: actions/github-script@v9
- with:
- script: |
- try {
- await github.rest.issues.addLabels({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number,
- labels: ['preview-deployed']
- });
- } catch (error) {
- console.log('Label may already exist:', error.message);
- }
-
- - name: Comment preview URL on PR
- uses: actions/github-script@v9
- with:
- script: |
- const url = '${{ steps.deploy.outputs.preview-url }}';
- const comment = `## 🚀 Preview Deployment
-
- Your preview deployment is ready!
-
- **Preview URL**: ${url}
-
- ### Quick Links
- - [🌐 Preview Site](${url})
- - [🔍 Health Check](${url}/api/health)
- - [📊 Vercel Dashboard](https://vercel.com/${{ secrets.VERCEL_ORG_ID }}/${{ secrets.VERCEL_PROJECT_ID }})
-
- ### Deployment Details
- - **Commit**: ${context.sha.substring(0, 7)}
- - **Branch**: ${context.ref.replace('refs/heads/', '')}
- - **Author**: @${context.actor}
-
- ---
-
- *This preview will be automatically updated when you push new commits.*
- `;
-
- // Check if a preview comment already exists
- const { data: comments } = await github.rest.issues.listComments({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number
- });
-
- const botComment = comments.find(comment =>
- comment.user.type === 'Bot' &&
- comment.body.includes('Preview Deployment')
- );
-
- if (botComment) {
- // Update existing comment
- await github.rest.issues.updateComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- comment_id: botComment.id,
- body: comment
- });
- } else {
- // Create new comment
- await github.rest.issues.createComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number,
- body: comment
- });
- }
-
- skip-preview:
- name: Skip Preview (Missing Secrets)
- runs-on: ubuntu-latest
- needs: validate-secrets
- if: needs.validate-secrets.outputs.has-secrets == 'false'
-
- steps:
- - name: Comment on PR
- uses: actions/github-script@v9
- with:
- script: |
- const comment = `## ⚠️ Preview Deployment Skipped
-
- Preview deployment was skipped because required secrets are not configured.
-
- ### Required Secrets
- Repository maintainers need to configure these secrets in repository settings:
- - \`VERCEL_TOKEN\` - Vercel authentication token
- - \`VERCEL_PROJECT_ID\` - Vercel project ID
- - \`VERCEL_ORG_ID\` - Vercel organization/team ID
-
- ### How to Configure
- 1. Go to repository **Settings** → **Secrets and variables** → **Actions**
- 2. Add the required secrets
- 3. Re-run this workflow or push a new commit
-
- For more information, see the [Vercel deployment documentation](https://vercel.com/docs/deployments/git).
- `;
-
- github.rest.issues.createComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number,
- body: comment
- });
diff --git a/.github/workflows/deploy-railway-preview.yml b/.github/workflows/deploy-railway-preview.yml
deleted file mode 100644
index d639253a..00000000
--- a/.github/workflows/deploy-railway-preview.yml
+++ /dev/null
@@ -1,358 +0,0 @@
-name: Deploy Railway Preview
-
-on:
- pull_request:
- types: [opened, synchronize, reopened]
- branches:
- - main
- - develop
-
-permissions:
- contents: read
- pull-requests: write
- deployments: write
-
-jobs:
- check-skip:
- name: Check Skip Deployment
- runs-on: ubuntu-latest
- timeout-minutes: 2
- outputs:
- should-deploy: ${{ steps.check.outputs.should-deploy }}
-
- steps:
- - name: Check for skip-deployment label
- id: check
- uses: actions/github-script@v9
- with:
- script: |
- const labels = context.payload.pull_request.labels.map(label => label.name);
- const shouldSkip = labels.includes('skip-deployment');
-
- if (shouldSkip) {
- console.log('⏭️ Skipping deployment due to skip-deployment label');
- core.setOutput('should-deploy', 'false');
- } else {
- console.log('✅ Deployment will proceed');
- core.setOutput('should-deploy', 'true');
- }
-
- validate-secrets:
- name: Validate Required Secrets
- runs-on: ubuntu-latest
- needs: check-skip
- if: needs.check-skip.outputs.should-deploy == 'true'
- timeout-minutes: 5
- outputs:
- has-secrets: ${{ steps.check.outputs.has-secrets }}
-
- steps:
- - name: Check required secrets
- id: check
- run: |
- MISSING_SECRETS=""
-
- if [ -z "${{ secrets.RAILWAY_TOKEN }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}RAILWAY_TOKEN, "
- fi
-
- if [ -z "${{ secrets.RAILWAY_PROJECT_ID }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}RAILWAY_PROJECT_ID, "
- fi
-
- if [ -z "${{ secrets.SOLANA_RPC_URL }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}SOLANA_RPC_URL, "
- fi
-
- if [ -z "${{ secrets.WALLET_PRIVATE_KEY }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}WALLET_PRIVATE_KEY, "
- fi
-
- if [ -z "${{ secrets.ADMIN_USERNAME }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}ADMIN_USERNAME, "
- fi
-
- if [ -z "${{ secrets.ADMIN_PASSWORD }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}ADMIN_PASSWORD, "
- fi
-
- if [ -z "${{ secrets.JWT_SECRET }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}JWT_SECRET, "
- fi
-
- if [ -n "$MISSING_SECRETS" ]; then
- echo "has-secrets=false" >> $GITHUB_OUTPUT
- echo "⚠️ Missing required secrets: $MISSING_SECRETS"
- echo "::warning::Missing required secrets: $MISSING_SECRETS"
- else
- echo "has-secrets=true" >> $GITHUB_OUTPUT
- echo "✅ All required secrets are configured"
- fi
-
- deploy-preview:
- name: Deploy to Railway Preview
- runs-on: ubuntu-latest
- needs: validate-secrets
- if: needs.validate-secrets.outputs.has-secrets == 'true'
- timeout-minutes: 15
- environment:
- name: preview-railway
- url: ${{ steps.deploy.outputs.url }}
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Install dependencies
- run: npm ci
-
- - name: Build project
- run: npm run build
- env:
- NODE_ENV: production
-
- - name: Install Railway CLI
- run: |
- curl -fsSL https://railway.app/install.sh | sh
- echo "$HOME/.railway/bin" >> $GITHUB_PATH
-
- - name: Deploy to Railway Preview
- id: deploy
- run: |
- # Link to project
- railway link ${{ secrets.RAILWAY_PROJECT_ID }}
-
- # Create preview environment name
- PR_NUMBER=${{ github.event.pull_request.number }}
- PREVIEW_ENV="pr-${PR_NUMBER}"
-
- echo "Creating preview environment: $PREVIEW_ENV"
-
- # Set environment variables for preview
- railway variables --set SOLANA_RPC_URL="${{ secrets.SOLANA_RPC_URL }}"
- railway variables --set WALLET_PRIVATE_KEY="${{ secrets.WALLET_PRIVATE_KEY }}"
- railway variables --set ADMIN_USERNAME="${{ secrets.ADMIN_USERNAME }}"
- railway variables --set ADMIN_PASSWORD="${{ secrets.ADMIN_PASSWORD }}"
- railway variables --set JWT_SECRET="${{ secrets.JWT_SECRET }}"
- railway variables --set NODE_ENV="preview"
- railway variables --set PR_NUMBER="${PR_NUMBER}"
-
- # Deploy to preview environment
- railway up --detach
-
- # Wait for deployment
- sleep 20
-
- # Get preview URL
- PREVIEW_URL=$(railway domain 2>&1 | grep -oP 'https://[^\s]+' | head -1)
- echo "url=$PREVIEW_URL" >> $GITHUB_OUTPUT
- echo "Preview deployed to: $PREVIEW_URL"
- env:
- RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
-
- - name: Wait for deployment
- run: |
- echo "⏳ Waiting for preview deployment to be ready..."
- sleep 30
-
- - name: Run health check
- id: health-check
- run: |
- echo "🔍 Running health check..."
- HEALTH_URL="${{ steps.deploy.outputs.url }}/api/health"
-
- MAX_RETRIES=5
- RETRY_COUNT=0
- HEALTH_STATUS="unknown"
-
- while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
- echo "Attempt $((RETRY_COUNT + 1))/$MAX_RETRIES: Checking $HEALTH_URL"
-
- RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" "$HEALTH_URL" || echo "000")
-
- if [ "$RESPONSE" == "200" ] || [ "$RESPONSE" == "503" ]; then
- echo "✅ Health check passed (HTTP $RESPONSE)"
- HEALTH_STATUS="✅ Healthy (HTTP $RESPONSE)"
- echo "status=$HEALTH_STATUS" >> $GITHUB_OUTPUT
- exit 0
- fi
-
- echo "⚠️ Health check returned HTTP $RESPONSE, retrying..."
- RETRY_COUNT=$((RETRY_COUNT + 1))
- sleep 10
- done
-
- echo "❌ Health check failed after $MAX_RETRIES attempts"
- HEALTH_STATUS="❌ Failed"
- echo "status=$HEALTH_STATUS" >> $GITHUB_OUTPUT
- exit 1
- continue-on-error: true
-
- - name: Add preview-deployed label
- if: success()
- uses: actions/github-script@v9
- with:
- script: |
- try {
- await github.rest.issues.addLabels({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number,
- labels: ['preview-deployed', 'railway']
- });
- } catch (error) {
- console.log('Label may already exist:', error.message);
- }
-
- - name: Comment preview URL on PR
- uses: actions/github-script@v9
- with:
- script: |
- const url = '${{ steps.deploy.outputs.url }}';
- const healthStatus = '${{ steps.health-check.outputs.status }}' || '⏳ Checking...';
- const prNumber = context.issue.number;
-
- const comment = `## 🚂 Railway Preview Deployment
-
- Your Railway preview deployment is ready!
-
- **Preview URL**: ${url}
- **Health Status**: ${healthStatus}
- **PR Number**: #${prNumber}
-
- ### Quick Links
- - [🌐 Preview Application](${url})
- - [🏥 Health Check](${url}/api/health)
- - [📊 Metrics](${url}/api/metrics)
- - [🚂 Railway Dashboard](https://railway.app/project/${{ secrets.RAILWAY_PROJECT_ID }})
-
- ### Deployment Details
- - **Commit**: ${context.sha.substring(0, 7)}
- - **Branch**: ${context.ref.replace('refs/heads/', '')}
- - **Author**: @${context.actor}
- - **Environment**: preview-railway
-
- ---
-
- *This preview will be automatically updated when you push new commits.*
- *Add the \`skip-deployment\` label to skip future deployments for this PR.*
- `;
-
- // Check if a Railway preview comment already exists
- const { data: comments } = await github.rest.issues.listComments({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number
- });
-
- const botComment = comments.find(comment =>
- comment.user.type === 'Bot' &&
- comment.body.includes('Railway Preview Deployment')
- );
-
- if (botComment) {
- // Update existing comment
- await github.rest.issues.updateComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- comment_id: botComment.id,
- body: comment
- });
- } else {
- // Create new comment
- await github.rest.issues.createComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number,
- body: comment
- });
- }
-
- - name: Create deployment record
- if: success()
- uses: actions/github-script@v9
- with:
- script: |
- const deployment = await github.rest.repos.createDeployment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- ref: context.sha,
- environment: 'preview-railway',
- required_contexts: [],
- auto_merge: false,
- });
-
- await github.rest.repos.createDeploymentStatus({
- owner: context.repo.owner,
- repo: context.repo.repo,
- deployment_id: deployment.data.id,
- state: 'success',
- environment_url: '${{ steps.deploy.outputs.url }}',
- description: 'Railway preview deployment successful',
- });
-
- skip-preview:
- name: Skip Preview (Missing Secrets or Label)
- runs-on: ubuntu-latest
- needs: [check-skip, validate-secrets]
- if: |
- always() && (
- needs.check-skip.outputs.should-deploy == 'false' ||
- (needs.check-skip.outputs.should-deploy == 'true' && needs.validate-secrets.outputs.has-secrets == 'false')
- )
-
- steps:
- - name: Comment on PR
- uses: actions/github-script@v9
- with:
- script: |
- const skipLabel = '${{ needs.check-skip.outputs.should-deploy }}' === 'false';
- const missingSecrets = '${{ needs.validate-secrets.outputs.has-secrets }}' === 'false';
-
- let comment = '';
-
- if (skipLabel) {
- comment = `## ⏭️ Railway Preview Deployment Skipped
-
- Preview deployment was skipped because the \`skip-deployment\` label is present.
-
- To enable preview deployments:
- 1. Remove the \`skip-deployment\` label
- 2. Push a new commit or re-run this workflow
- `;
- } else if (missingSecrets) {
- comment = `## ⚠️ Railway Preview Deployment Skipped
-
- Preview deployment was skipped because required secrets are not configured.
-
- ### Required Secrets
- Repository maintainers need to configure these secrets in repository settings:
- - \`RAILWAY_TOKEN\` - Railway API authentication token
- - \`RAILWAY_PROJECT_ID\` - Railway project ID (should be \`2077acd9-f81f-47ba-b8c7-8bf6905f45fc\`)
- - \`SOLANA_RPC_URL\` - Solana RPC endpoint URL
- - \`WALLET_PRIVATE_KEY\` - Wallet private key (base58 format)
- - \`ADMIN_USERNAME\` - Admin panel username
- - \`ADMIN_PASSWORD\` - Admin panel password
- - \`JWT_SECRET\` - JWT secret for authentication
-
- ### How to Configure
- 1. Go to repository **Settings** → **Secrets and variables** → **Actions**
- 2. Add the required secrets
- 3. Re-run this workflow or push a new commit
-
- For more information, see the [Railway deployment documentation](./docs/RAILWAY_DEPLOYMENT.md).
- `;
- }
-
- github.rest.issues.createComment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- issue_number: context.issue.number,
- body: comment
- });
diff --git a/.github/workflows/deploy-railway.yml b/.github/workflows/deploy-railway.yml
deleted file mode 100644
index f9e7dd8d..00000000
--- a/.github/workflows/deploy-railway.yml
+++ /dev/null
@@ -1,230 +0,0 @@
-name: Deploy to Railway
-
-on:
- push:
- branches:
- - main
- workflow_dispatch:
-
-permissions:
- contents: read
- deployments: write
-
-jobs:
- validate-secrets:
- name: Validate Required Secrets
- runs-on: ubuntu-latest
- timeout-minutes: 5
- outputs:
- has-secrets: ${{ steps.check.outputs.has-secrets }}
-
- steps:
- - name: Check required secrets
- id: check
- run: |
- MISSING_SECRETS=""
-
- if [ -z "${{ secrets.RAILWAY_TOKEN }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}RAILWAY_TOKEN, "
- fi
-
- if [ -z "${{ secrets.RAILWAY_PROJECT_ID }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}RAILWAY_PROJECT_ID, "
- fi
-
- if [ -z "${{ secrets.SOLANA_RPC_URL }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}SOLANA_RPC_URL, "
- fi
-
- if [ -z "${{ secrets.WALLET_PRIVATE_KEY }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}WALLET_PRIVATE_KEY, "
- fi
-
- if [ -z "${{ secrets.ADMIN_USERNAME }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}ADMIN_USERNAME, "
- fi
-
- if [ -z "${{ secrets.ADMIN_PASSWORD }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}ADMIN_PASSWORD, "
- fi
-
- if [ -z "${{ secrets.JWT_SECRET }}" ]; then
- MISSING_SECRETS="${MISSING_SECRETS}JWT_SECRET, "
- fi
-
- if [ -n "$MISSING_SECRETS" ]; then
- echo "has-secrets=false" >> $GITHUB_OUTPUT
- echo "⚠️ Missing required secrets: $MISSING_SECRETS"
- echo "::warning::Missing required secrets: $MISSING_SECRETS"
- exit 1
- else
- echo "has-secrets=true" >> $GITHUB_OUTPUT
- echo "✅ All required secrets are configured"
- fi
-
- deploy:
- name: Deploy to Railway
- runs-on: ubuntu-latest
- needs: validate-secrets
- if: needs.validate-secrets.outputs.has-secrets == 'true'
- timeout-minutes: 15
- environment:
- name: production-railway
- url: ${{ steps.deploy.outputs.url }}
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Setup Node.js
- uses: actions/setup-node@v6
- with:
- node-version: '24'
- cache: 'npm'
-
- - name: Install dependencies
- run: npm ci
-
- - name: Run tests
- run: npm test || echo "No tests configured"
- continue-on-error: true
- env:
- NODE_ENV: test
-
- - name: Build project
- run: npm run build
-
- - name: Install Railway CLI
- run: |
- curl -fsSL https://railway.app/install.sh | sh
- echo "$HOME/.railway/bin" >> $GITHUB_PATH
-
- - name: Deploy to Railway
- id: deploy
- run: |
- railway link ${{ secrets.RAILWAY_PROJECT_ID }}
-
- # Set environment variables from secrets
- railway variables --set SOLANA_RPC_URL="${{ secrets.SOLANA_RPC_URL }}"
- railway variables --set WALLET_PRIVATE_KEY="${{ secrets.WALLET_PRIVATE_KEY }}"
- railway variables --set ADMIN_USERNAME="${{ secrets.ADMIN_USERNAME }}"
- railway variables --set ADMIN_PASSWORD="${{ secrets.ADMIN_PASSWORD }}"
- railway variables --set JWT_SECRET="${{ secrets.JWT_SECRET }}"
- railway variables --set NODE_ENV="production"
-
- # Deploy
- railway up --detach
-
- # Wait for deployment to complete
- sleep 15
-
- # Get deployment URL
- DEPLOYMENT_URL=$(railway domain 2>&1 | grep -oP 'https://[^\s]+' | head -1)
- echo "url=$DEPLOYMENT_URL" >> $GITHUB_OUTPUT
- echo "Deployed to: $DEPLOYMENT_URL"
- env:
- RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
-
- - name: Wait for deployment
- run: |
- echo "⏳ Waiting for deployment to be ready..."
- sleep 30
-
- - name: Run health check
- run: |
- echo "🔍 Running health check..."
- HEALTH_URL="${{ steps.deploy.outputs.url }}/api/health"
-
- MAX_RETRIES=5
- RETRY_COUNT=0
-
- while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
- echo "Attempt $((RETRY_COUNT + 1))/$MAX_RETRIES: Checking $HEALTH_URL"
-
- RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" "$HEALTH_URL" || echo "000")
-
- if [ "$RESPONSE" == "200" ] || [ "$RESPONSE" == "503" ]; then
- echo "✅ Health check passed (HTTP $RESPONSE)"
- exit 0
- fi
-
- echo "⚠️ Health check returned HTTP $RESPONSE, retrying..."
- RETRY_COUNT=$((RETRY_COUNT + 1))
- sleep 10
- done
-
- echo "❌ Health check failed after $MAX_RETRIES attempts"
- exit 1
-
- - name: Create deployment record
- uses: actions/github-script@v9
- with:
- script: |
- const deployment = await github.rest.repos.createDeployment({
- owner: context.repo.owner,
- repo: context.repo.repo,
- ref: context.sha,
- environment: 'production-railway',
- required_contexts: [],
- auto_merge: false,
- });
-
- await github.rest.repos.createDeploymentStatus({
- owner: context.repo.owner,
- repo: context.repo.repo,
- deployment_id: deployment.data.id,
- state: 'success',
- environment_url: '${{ steps.deploy.outputs.url }}',
- description: 'Railway deployment successful',
- });
-
- console.log('✅ Deployment successful');
- console.log('🔗 URL:', '${{ steps.deploy.outputs.url }}');
-
- - name: Notify on failure
- if: failure()
- uses: actions/github-script@v9
- with:
- script: |
- const issue = await github.rest.issues.create({
- owner: context.repo.owner,
- repo: context.repo.repo,
- title: '🚨 Railway Deployment Failed',
- body: `### Deployment Failure Report
-
- **Workflow**: ${context.workflow}
- **Run**: ${context.runNumber}
- **Branch**: ${context.ref}
- **Commit**: ${context.sha}
- **Actor**: @${context.actor}
-
- **Details**: [View workflow run](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})
-
- Please investigate and retry the deployment.
- `,
- labels: ['deployment', 'railway', 'bug', 'high-priority']
- });
-
- console.log('Created issue:', issue.data.number);
-
- test-endpoints:
- name: Test Deployed Endpoints
- runs-on: ubuntu-latest
- needs: deploy
- timeout-minutes: 10
-
- steps:
- - name: Test health endpoint
- run: |
- echo "Testing /api/health..."
- curl -f "${{ needs.deploy.outputs.url }}/api/health" || exit 1
-
- - name: Test monitor endpoint
- run: |
- echo "Testing /api/monitor..."
- curl "${{ needs.deploy.outputs.url }}/api/monitor" || echo "Monitor endpoint requires authentication"
-
- - name: Summary
- run: |
- echo "✅ Endpoint tests complete"
- echo "🔗 Deployment URL: ${{ needs.deploy.outputs.url }}"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 00000000..d3e2a4e4
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,67 @@
+name: deploy
+
+on:
+ workflow_run:
+ workflows: ["ci"]
+ types: [completed]
+ pull_request:
+ workflow_dispatch:
+
+concurrency:
+ group: deploy-${{ github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+ deployments: write
+
+jobs:
+ preview:
+ name: preview
+ if: github.event_name == 'pull_request'
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - uses: actions/checkout@v6
+ - uses: amondnet/vercel-action@v42
+ if: ${{ secrets.VERCEL_TOKEN != '' && secrets.VERCEL_ORG_ID != '' && secrets.VERCEL_PROJECT_ID != '' }}
+ with:
+ vercel-token: ${{ secrets.VERCEL_TOKEN }}
+ vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
+ vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
+ working-directory: ./webapp
+
+ production:
+ name: production
+ if: >-
+ github.event_name == 'workflow_run' &&
+ github.event.workflow_run.conclusion == 'success' &&
+ github.event.workflow_run.head_branch == 'main'
+ runs-on: ubuntu-latest
+ timeout-minutes: 20
+ steps:
+ - uses: actions/checkout@v6
+ with:
+ ref: ${{ github.event.workflow_run.head_sha }}
+ - uses: actions/setup-node@v6
+ with:
+ node-version-file: .nvmrc
+ cache: npm
+ cache-dependency-path: |
+ package-lock.json
+ webapp/package-lock.json
+ - run: npm ci --no-audit --no-fund
+ - run: npm --prefix webapp ci --no-audit --no-fund
+ - run: npm run build
+ - name: Validate deploy secrets
+ run: |
+ test -n "${{ secrets.VERCEL_TOKEN }}"
+ test -n "${{ secrets.VERCEL_ORG_ID }}"
+ test -n "${{ secrets.VERCEL_PROJECT_ID }}"
+ - uses: amondnet/vercel-action@v42
+ with:
+ vercel-token: ${{ secrets.VERCEL_TOKEN }}
+ vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
+ vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
+ vercel-args: --prod
+ working-directory: ./webapp
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
deleted file mode 100644
index 1cc93cdf..00000000
--- a/.github/workflows/docker-build.yml
+++ /dev/null
@@ -1,142 +0,0 @@
-name: Build and Push Docker Images
-
-on:
- push:
- branches:
- - main
- - develop
- tags:
- - 'v*'
- pull_request:
- branches:
- - main
- workflow_dispatch:
-
-env:
- REGISTRY: ghcr.io
- IMAGE_NAME: ${{ github.repository }}
-
-jobs:
- build-and-push:
- runs-on: ubuntu-latest
- permissions:
- contents: read
- packages: write
-
- steps:
- - name: Checkout repository
- uses: actions/checkout@v6
-
- - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v4
-
- - name: Log in to Container Registry
- if: github.event_name != 'pull_request'
- uses: docker/login-action@v4
- with:
- registry: ${{ env.REGISTRY }}
- username: ${{ github.actor }}
- password: ${{ secrets.GITHUB_TOKEN }}
-
- - name: Extract metadata for Backend
- id: meta-backend
- uses: docker/metadata-action@v6
- with:
- images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/backend
- tags: |
- type=ref,event=branch
- type=ref,event=pr
- type=semver,pattern={{version}}
- type=semver,pattern={{major}}.{{minor}}
- type=semver,pattern={{major}}
- type=sha
- type=raw,value=latest,enable={{is_default_branch}}
-
- - name: Build and push Backend image
- uses: docker/build-push-action@v7
- with:
- context: .
- target: backend
- push: ${{ github.event_name != 'pull_request' }}
- tags: ${{ steps.meta-backend.outputs.tags }}
- labels: ${{ steps.meta-backend.outputs.labels }}
- cache-from: type=gha
- cache-to: type=gha,mode=max
-
- - name: Extract metadata for Webapp
- id: meta-webapp
- uses: docker/metadata-action@v6
- with:
- images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/webapp
- tags: |
- type=ref,event=branch
- type=ref,event=pr
- type=semver,pattern={{version}}
- type=semver,pattern={{major}}.{{minor}}
- type=semver,pattern={{major}}
- type=sha
- type=raw,value=latest,enable={{is_default_branch}}
-
- - name: Build and push Webapp image
- uses: docker/build-push-action@v7
- with:
- context: ./webapp
- file: ./webapp/Dockerfile
- push: ${{ github.event_name != 'pull_request' }}
- tags: ${{ steps.meta-webapp.outputs.tags }}
- labels: ${{ steps.meta-webapp.outputs.labels }}
- cache-from: type=gha
- cache-to: type=gha,mode=max
-
- - name: Extract metadata for Fullstack
- id: meta-fullstack
- uses: docker/metadata-action@v6
- with:
- images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/fullstack
- tags: |
- type=ref,event=branch
- type=ref,event=pr
- type=semver,pattern={{version}}
- type=semver,pattern={{major}}.{{minor}}
- type=semver,pattern={{major}}
- type=sha
- type=raw,value=latest,enable={{is_default_branch}}
-
- - name: Build and push Fullstack image
- uses: docker/build-push-action@v7
- with:
- context: .
- target: fullstack
- push: ${{ github.event_name != 'pull_request' }}
- tags: ${{ steps.meta-fullstack.outputs.tags }}
- labels: ${{ steps.meta-fullstack.outputs.labels }}
- cache-from: type=gha
- cache-to: type=gha,mode=max
-
- - name: Generate artifact attestation
- if: github.event_name != 'pull_request'
- uses: actions/attest-build-provenance@v4
- with:
- subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}/backend
- subject-digest: ${{ steps.build-backend.outputs.digest }}
- push-to-registry: true
-
- - name: Summary
- if: github.event_name != 'pull_request'
- run: |
- echo "## Docker Images Built and Pushed 🐳" >> $GITHUB_STEP_SUMMARY
- echo "" >> $GITHUB_STEP_SUMMARY
- echo "### Backend" >> $GITHUB_STEP_SUMMARY
- echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
- echo "${{ steps.meta-backend.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
- echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
- echo "" >> $GITHUB_STEP_SUMMARY
- echo "### Webapp" >> $GITHUB_STEP_SUMMARY
- echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
- echo "${{ steps.meta-webapp.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
- echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
- echo "" >> $GITHUB_STEP_SUMMARY
- echo "### Fullstack" >> $GITHUB_STEP_SUMMARY
- echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
- echo "${{ steps.meta-fullstack.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
- echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/failed-job-handler.yml b/.github/workflows/failed-job-handler.yml
deleted file mode 100644
index 7d50e776..00000000
--- a/.github/workflows/failed-job-handler.yml
+++ /dev/null
@@ -1,204 +0,0 @@
-name: Failed Job Handler
-
-on:
- workflow_run:
- workflows: ["CI - Continuous Integration"]
- types: [completed]
- workflow_dispatch:
- inputs:
- run_id:
- description: 'Workflow run ID to analyze'
- required: true
- type: string
-
-permissions:
- actions: write
- issues: write
- contents: read
-
-jobs:
- analyze-failure:
- name: Analyze Failed Jobs
- runs-on: ubuntu-latest
- if: ${{ github.event.workflow_run.conclusion == 'failure' || github.event_name == 'workflow_dispatch' }}
-
- steps:
- - name: Checkout code
- uses: actions/checkout@v6
-
- - name: Get workflow run details
- id: workflow
- uses: actions/github-script@v9
- with:
- script: |
- let runId;
- if (context.eventName === 'workflow_dispatch') {
- runId = parseInt('${{ inputs.run_id }}');
- } else {
- runId = context.payload.workflow_run.id;
- }
-
- console.log(`Analyzing workflow run: ${runId}`);
-
- // Get workflow run details
- const { data: workflowRun } = await github.rest.actions.getWorkflowRun({
- owner: context.repo.owner,
- repo: context.repo.repo,
- run_id: runId
- });
-
- console.log(`Workflow: ${workflowRun.name}`);
- console.log(`Conclusion: ${workflowRun.conclusion}`);
- console.log(`Attempt: ${workflowRun.run_attempt}`);
-
- // Get failed jobs
- const { data: jobs } = await github.rest.actions.listJobsForWorkflowRun({
- owner: context.repo.owner,
- repo: context.repo.repo,
- run_id: runId
- });
-
- const failedJobs = jobs.jobs.filter(job => job.conclusion === 'failure');
-
- if (failedJobs.length === 0) {
- console.log('No failed jobs found');
- return { shouldRetry: false, failedJobs: [] };
- }
-
- console.log(`Found ${failedJobs.length} failed jobs`);
-
- // Analyze failure reasons
- const failureReasons = [];
- for (const job of failedJobs) {
- console.log(`\nFailed job: ${job.name}`);
- console.log(`Status: ${job.status}, Conclusion: ${job.conclusion}`);
-
- // Get job logs
- try {
- const { data: logs } = await github.rest.actions.downloadJobLogsForWorkflowRun({
- owner: context.repo.owner,
- repo: context.repo.repo,
- job_id: job.id
- });
-
- // Analyze common transient failures
- const logsStr = typeof logs === 'string' ? logs : '';
- const isTransient =
- logsStr.includes('ECONNRESET') ||
- logsStr.includes('ETIMEDOUT') ||
- logsStr.includes('network') ||
- logsStr.includes('timeout') ||
- logsStr.includes('429') || // Rate limit
- logsStr.includes('503') || // Service unavailable
- logsStr.includes('502'); // Bad gateway
-
- failureReasons.push({
- jobName: job.name,
- jobId: job.id,
- isTransient,
- logSnippet: logsStr.slice(0, 500)
- });
- } catch (error) {
- console.log(`Could not fetch logs for job ${job.id}: ${error.message}`);
- }
- }
-
- // Decide if should retry
- const shouldRetry =
- workflowRun.run_attempt < 3 && // Max 3 attempts
- failureReasons.some(f => f.isTransient);
-
- core.setOutput('run_id', runId);
- core.setOutput('should_retry', shouldRetry);
- core.setOutput('attempt', workflowRun.run_attempt);
- core.setOutput('failed_jobs_count', failedJobs.length);
- core.setOutput('failure_details', JSON.stringify(failureReasons));
-
- return { shouldRetry, failedJobs: failureReasons };
-
- - name: Retry workflow
- if: steps.workflow.outputs.should_retry == 'true'
- uses: actions/github-script@v9
- with:
- script: |
- const runId = parseInt('${{ steps.workflow.outputs.run_id }}');
-
- console.log(`Retrying workflow run ${runId}...`);
-
- try {
- await github.rest.actions.reRunWorkflowFailedJobs({
- owner: context.repo.owner,
- repo: context.repo.repo,
- run_id: runId
- });
-
- console.log('✅ Successfully triggered retry for failed jobs');
- } catch (error) {
- console.error('Failed to retry workflow:', error);
- }
-
- - name: Create issue for persistent failure
- if: |
- steps.workflow.outputs.should_retry == 'false' &&
- steps.workflow.outputs.attempt >= 3
- uses: actions/github-script@v9
- with:
- script: |
- const runId = '${{ steps.workflow.outputs.run_id }}';
- const failureDetails = JSON.parse('${{ steps.workflow.outputs.failure_details }}');
-
- // Check if issue already exists
- const { data: existingIssues } = await github.rest.issues.listForRepo({
- owner: context.repo.owner,
- repo: context.repo.repo,
- labels: 'ci-failure',
- state: 'open'
- });
-
- const issueTitle = `CI Failure: Workflow Run ${runId}`;
- const existingIssue = existingIssues.find(issue => issue.title === issueTitle);
-
- if (existingIssue) {
- console.log(`Issue already exists: #${existingIssue.number}`);
- return;
- }
-
- // Create detailed issue body
- let issueBody = `## 🚨 Persistent CI Failure\n\n`;
- issueBody += `**Workflow Run:** [#${runId}](${context.payload.workflow_run?.html_url || 'N/A'})\n`;
- issueBody += `**Attempt:** ${{ steps.workflow.outputs.attempt }}\n`;
- issueBody += `**Failed Jobs:** ${{ steps.workflow.outputs.failed_jobs_count }}\n\n`;
- issueBody += `### Failed Jobs Details\n\n`;
-
- for (const failure of failureDetails) {
- issueBody += `#### ${failure.jobName}\n`;
- issueBody += `- **Job ID:** ${failure.jobId}\n`;
- issueBody += `- **Transient:** ${failure.isTransient ? '✅' : '❌'}\n`;
- issueBody += `\nLog Snippet
\n\n\`\`\`\n${failure.logSnippet}\n\`\`\`\n\n