ci: standardize shellcheck --severity=error across all lab scripts #11

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main, develop, 'feature/', 'bugfix/']
	pull_request:
	branches: [main, develop]

	permissions:
	contents: read
	security-events: write

	jobs:
	validate:
	name: Validate Configuration
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Validate Docker Compose files
	run: \|
	for f in docker/docker-compose.*.yml; do
	echo "Validating: $f"
	docker compose -f "$f" config --no-interpolate -q
	done

	- name: ShellCheck — lab test scripts
	run: \|
	sudo apt-get install -y shellcheck -qq
	shellcheck --severity=error tests/labs/*.sh

	- name: Validate module manifest
	run: \|
	python3 -c "
	import sys, re
	with open('it-stack-openkm.yml') as f:
	content = f.read()
	required = ['module:', 'version:', 'phase:', 'category:', 'ports:']
	missing = [k for k in required if k not in content]
	if missing:
	print('Missing fields:', missing); sys.exit(1)
	print('Manifest valid')
	"

	security-scan:
	name: Security Scan
	runs-on: ubuntu-latest
	needs: validate
	steps:
	- uses: actions/checkout@v4

	- name: Trivy — scan Dockerfile
	uses: aquasecurity/trivy-action@0.28.0
	with:
	scan-type: config
	scan-ref: .
	exit-code: '0'
	severity: CRITICAL,HIGH

	- name: Trivy — SARIF output
	uses: aquasecurity/trivy-action@0.28.0
	with:
	scan-type: config
	scan-ref: .
	format: sarif
	output: trivy-results.sarif

	- name: Upload SARIF to GitHub Security
	uses: github/codeql-action/upload-sarif@v3
	if: always()
	with:
	sarif_file: trivy-results.sarif

	lab-01-smoke:
	name: Lab 01 -- OpenKM Standalone (MySQL + DMS)
	runs-on: ubuntu-latest
	needs: validate
	continue-on-error: true
	steps:
	- uses: actions/checkout@v4
	- name: Install tools
	run: sudo apt-get install -y curl
	- name: Validate standalone compose
	run: docker compose -f docker/docker-compose.standalone.yml config -q && echo "Standalone compose valid"
	- name: Start standalone stack
	run: docker compose -f docker/docker-compose.standalone.yml up -d
	- name: Wait for MySQL
	run: timeout 120 bash -c 'until docker exec openkm-s01-db mysqladmin ping -h localhost -u root -pRootLab01! > /dev/null 2>&1; do sleep 5; done'
	- name: Wait for OpenKM
	run: timeout 360 bash -c 'until curl -sf http://localhost:8304/openkm/ \| grep -qi openkm; do sleep 10; done'
	- name: Run Lab 14-01 test script
	run: bash tests/labs/test-lab-14-01.sh --no-cleanup
	- name: Collect logs on failure
	if: failure()
	run: docker compose -f docker/docker-compose.standalone.yml logs
	- name: Cleanup
	if: always()
	run: docker compose -f docker/docker-compose.standalone.yml down -v

	lab-02-smoke:
	name: Lab 02 -- OpenKM External Dependencies (MySQL + Mailhog)
	runs-on: ubuntu-latest
	needs: validate
	continue-on-error: true
	steps:
	- uses: actions/checkout@v4
	- name: Install tools
	run: sudo apt-get install -y curl default-mysql-client
	- name: Validate LAN compose
	run: docker compose -f docker/docker-compose.lan.yml config -q && echo "LAN compose valid"
	- name: Start LAN stack
	run: docker compose -f docker/docker-compose.lan.yml up -d
	- name: Wait for MySQL
	run: timeout 120 bash -c 'until docker exec openkm-l02-db mysqladmin ping -uroot -pRootLab02! --silent; do sleep 5; done'
	- name: Wait for Mailhog
	run: timeout 60 bash -c 'until curl -sf http://localhost:8613/api/v2/messages; do sleep 5; done'
	- name: Wait for OpenKM
	run: timeout 300 bash -c 'until curl -sf http://localhost:8313/openkm/; do sleep 10; done'
	- name: Run Lab 14-02 test script
	run: bash tests/labs/test-lab-14-02.sh --no-cleanup
	- name: Collect logs on failure
	if: failure()
	run: docker compose -f docker/docker-compose.lan.yml logs
	- name: Cleanup
	if: always()
	run: docker compose -f docker/docker-compose.lan.yml down -v

	lab-03-smoke:
	name: Lab 03 -- OpenKM Advanced Features (Elasticsearch full-text search)
	runs-on: ubuntu-latest
	needs: validate
	continue-on-error: true
	steps:
	- uses: actions/checkout@v4
	- name: Install tools
	run: sudo apt-get install -y curl default-mysql-client
	- name: Validate advanced compose
	run: docker compose -f docker/docker-compose.advanced.yml config -q && echo "Advanced compose valid"
	- name: Start advanced stack
	run: docker compose -f docker/docker-compose.advanced.yml up -d
	- name: Wait for MySQL
	run: timeout 120 bash -c 'until docker exec openkm-a03-db mysqladmin ping -uroot -pRootLab03! --silent; do sleep 5; done'
	- name: Wait for Elasticsearch
	run: timeout 120 bash -c 'until curl -sf http://localhost:9201/_cluster/health \| grep -q green; do sleep 5; done'
	- name: Wait for Mailhog
	run: timeout 60 bash -c 'until curl -sf http://localhost:8632/api/v2/messages; do sleep 5; done'
	- name: Wait for OpenKM
	run: timeout 300 bash -c 'until curl -sf http://localhost:8332/openkm/; do sleep 10; done'
	- name: Run Lab 14-03 test script
	run: bash tests/labs/test-lab-14-03.sh --no-cleanup
	- name: Collect logs on failure
	if: failure()
	run: docker compose -f docker/docker-compose.advanced.yml logs
	- name: Cleanup
	if: always()
	run: docker compose -f docker/docker-compose.advanced.yml down -v

	lab-04-smoke:
	name: Lab 04 -- OpenKM SSO Integration (OpenLDAP + Keycloak SAML)
	runs-on: ubuntu-latest
	needs: validate
	continue-on-error: true
	steps:
	- uses: actions/checkout@v4
	- name: Install tools
	run: sudo apt-get install -y curl default-mysql-client netcat-openbsd ldap-utils
	- name: Validate SSO compose
	run: docker compose -f docker/docker-compose.sso.yml config -q && echo "SSO compose valid"
	- name: Start SSO stack
	run: docker compose -f docker/docker-compose.sso.yml up -d
	- name: Wait for MySQL
	run: timeout 120 bash -c 'until docker exec openkm-s04-db mysqladmin ping -uroot -pRootLab04! --silent; do sleep 5; done'
	- name: Wait for OpenLDAP
	run: timeout 120 bash -c 'until docker exec openkm-s04-ldap ldapsearch -x -H ldap://localhost -b dc=lab,dc=local -D cn=admin,dc=lab,dc=local -w LdapLab04! cn=admin >/dev/null 2>&1; do sleep 5; done'
	- name: Wait for Elasticsearch
	run: timeout 180 bash -c 'until curl -sf http://localhost:9202/_cluster/health; do sleep 10; done'
	- name: Wait for Keycloak
	run: timeout 300 bash -c 'until curl -sf http://localhost:8452/realms/master; do sleep 10; done'
	- name: Wait for Mailhog
	run: timeout 60 bash -c 'until curl -sf http://localhost:8652/api/v2/messages; do sleep 5; done'
	- name: Wait for OpenKM web
	run: timeout 300 bash -c 'until curl -sf http://localhost:8352/OpenKM/; do sleep 10; done'
	- name: Run Lab 14-04 test script
	run: bash tests/labs/test-lab-14-04.sh --no-cleanup
	- name: Collect logs on failure
	if: failure()
	run: docker compose -f docker/docker-compose.sso.yml logs
	- name: Cleanup
	if: always()
	run: docker compose -f docker/docker-compose.sso.yml down -v

	lab-05-smoke:
	name: Lab 05 -- OpenKM Advanced Integration (WireMock SuiteCRM/Odoo consumers + ES)
	runs-on: ubuntu-latest
	needs: validate
	continue-on-error: true
	steps:
	- uses: actions/checkout@v4
	- name: Install tools
	run: sudo apt-get install -y curl default-mysql-client netcat-openbsd ldap-utils
	- name: Validate integration compose
	run: docker compose -f docker/docker-compose.integration.yml config -q && echo "Integration compose valid"
	- name: Start integration stack
	run: docker compose -f docker/docker-compose.integration.yml up -d
	- name: Wait for MySQL
	run: timeout 120 bash -c 'until docker exec openkm-i05-db mysqladmin ping -uroot -pRootLab05! --silent; do sleep 5; done'
	- name: Wait for Elasticsearch
	run: timeout 180 bash -c 'until curl -sf http://localhost:9203/_cluster/health; do sleep 10; done'
	- name: Wait for WireMock
	run: timeout 60 bash -c 'until curl -sf http://localhost:8374/__admin/health; do sleep 5; done'
	- name: Wait for Keycloak
	run: timeout 300 bash -c 'until curl -sf http://localhost:8471/realms/master; do sleep 10; done'
	- name: Wait for Mailhog
	run: timeout 60 bash -c 'until curl -sf http://localhost:8673/api/v2/messages; do sleep 5; done'
	- name: Wait for OpenKM web
	run: timeout 300 bash -c 'until curl -sf http://localhost:8373/OpenKM/; do sleep 10; done'
	- name: Run Lab 14-05 test script
	run: bash tests/labs/test-lab-14-05.sh --no-cleanup
	- name: Collect logs on failure
	if: failure()
	run: docker compose -f docker/docker-compose.integration.yml logs
	- name: Cleanup
	if: always()
	run: docker compose -f docker/docker-compose.integration.yml down -v

	lab-06-smoke:
	name: Lab 06 -- OpenKM Production Deployment (MySQL + LDAP + Elasticsearch + Keycloak + resource limits)
	runs-on: ubuntu-latest
	needs: validate
	continue-on-error: true
	steps:
	- uses: actions/checkout@v4
	- name: Install tools
	run: sudo apt-get install -y curl default-mysql-client netcat-openbsd ldap-utils
	- name: Validate production compose
	run: docker compose -f docker/docker-compose.production.yml config -q && echo "Production compose valid"
	- name: Start production stack
	run: docker compose -f docker/docker-compose.production.yml up -d
	- name: Wait for MySQL
	run: timeout 120 bash -c 'until docker exec openkm-p06-db mysqladmin ping -uroot -pRootProd06! --silent; do sleep 5; done'
	- name: Wait for Elasticsearch
	run: timeout 180 bash -c 'until curl -sf http://localhost:9204/_cluster/health; do sleep 10; done'
	- name: Wait for Keycloak
	run: timeout 300 bash -c 'until curl -sf http://localhost:8491/realms/master; do sleep 10; done'
	- name: Wait for Mailhog
	run: timeout 60 bash -c 'until curl -sf http://localhost:8693/api/v2/messages; do sleep 5; done'
	- name: Wait for OpenKM web
	run: timeout 300 bash -c 'until curl -sf http://localhost:8393/OpenKM/; do sleep 10; done'
	- name: Run Lab 14-06 test script
	run: bash tests/labs/test-lab-14-06.sh --no-cleanup
	- name: Collect logs on failure
	if: failure()
	run: docker compose -f docker/docker-compose.production.yml logs
	- name: Cleanup
	if: always()
	run: docker compose -f docker/docker-compose.production.yml down -v

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: standardize shellcheck --severity=error across all lab scripts #11

Workflow file

ci: standardize shellcheck --severity=error across all lab scripts #11

Uh oh!

Workflow file for this run