it-stack-postgresql/.github/workflows/ci.yml at 8b385cc63a38b019c2b08da32bc72f9ad9293153 · it-stack-dev/it-stack-postgresql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
name: CI

on:
  push:
    branches: [main, develop, 'feature/**', 'bugfix/**']
  pull_request:
    branches: [main, develop]

permissions:
  contents: read
  security-events: write

jobs:
  validate:
    name: Validate Configuration
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Validate Docker Compose files
        run: |
          # Strictly validate the standalone lab (fully built out)
          echo "Validating: docker/docker-compose.standalone.yml"
          docker compose -f docker/docker-compose.standalone.yml config -q
          echo "OK: docker/docker-compose.standalone.yml"
          # Strictly validate lan.yml (Lab 02 — fully built out)
          echo "Validating: docker/docker-compose.lan.yml"
          docker compose -f docker/docker-compose.lan.yml config -q
          echo "OK: docker/docker-compose.lan.yml"
          # Parse-check remaining scaffold files
          for f in docker/docker-compose.advanced.yml docker/docker-compose.sso.yml \
                   docker/docker-compose.integration.yml docker/docker-compose.production.yml; do
            echo "Checking scaffold: $f"
            docker compose -f "$f" config --no-interpolate -q 2>&1 && echo "OK: $f" \
              || echo "WARN: $f has placeholder variables (scaffold — not yet built out)"
          done

      - name: ShellCheck — lab test scripts
        run: |
          sudo apt-get install -y shellcheck -qq
          shellcheck tests/labs/*.sh

      - name: Validate module manifest
        run: |
          python3 -c "
          import sys, re
          with open('it-stack-postgresql.yml') as f:
              content = f.read()
          required = ['module:', 'version:', 'phase:', 'category:', 'ports:']
          missing = [k for k in required if k not in content]
          if missing:
              print('Missing fields:', missing); sys.exit(1)
          print('Manifest valid')
          "

  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    needs: validate
    steps:
      - uses: actions/checkout@v4

      - name: Trivy — scan Dockerfile
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: config
          scan-ref: .
          exit-code: '0'
          severity: CRITICAL,HIGH

      - name: Trivy — SARIF output
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: config
          scan-ref: .
          format: sarif
          output: trivy-results.sarif

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

  lab-01-smoke:
    name: Lab 01 — Smoke Test
    runs-on: ubuntu-latest
    needs: validate
    continue-on-error: true   # scaffold stubs; full lab runs on real VMs
    steps:
      - uses: actions/checkout@v4

      - name: Install PostgreSQL client tools
        run: sudo apt-get install -y postgresql-client netcat-openbsd

      - name: Start standalone stack
        run: docker compose -f docker/docker-compose.standalone.yml up -d

      - name: Wait for PostgreSQL to be ready
        run: |
          echo "Waiting for PostgreSQL..."
          timeout 120 bash -c 'until pg_isready -h localhost -p 5432 -U labadmin; do sleep 3; done'
          docker compose -f docker/docker-compose.standalone.yml ps

      - name: Run Lab 03-01 test script
        env:
          PGPASSWORD: "Lab01Password!"
        run: bash tests/labs/test-lab-03-01.sh

      - name: Collect logs on failure
        if: failure()
        run: docker compose -f docker/docker-compose.standalone.yml logs

      - name: Cleanup
        if: always()
        run: docker compose -f docker/docker-compose.standalone.yml down -v

  lab-02-smoke:
    name: Lab 02 — Streaming Replication
    runs-on: ubuntu-latest
    needs: validate
    continue-on-error: true
    steps:
      - uses: actions/checkout@v4

      - name: Install PostgreSQL client tools
        run: sudo apt-get install -y postgresql-client netcat-openbsd curl

      - name: Start LAN stack (primary + replica + pgAdmin)
        run: docker compose -f docker/docker-compose.lan.yml up -d

      - name: Wait for primary PostgreSQL
        run: |
          echo "Waiting for primary..."
          timeout 120 bash -c 'until pg_isready -h localhost -p 5432 -U labadmin; do sleep 3; done'

      - name: Wait for replica PostgreSQL
        run: |
          echo "Waiting for replica (base backup ~30s)..."
          timeout 180 bash -c 'until pg_isready -h localhost -p 5433 -U labadmin; do echo -n "."; sleep 5; done'
          echo ""

      - name: Run Lab 03-02 test script
        env:
          ADMIN_PASS: "Lab02Password!"
        run: bash tests/labs/test-lab-03-02.sh

      - name: Collect logs on failure
        if: failure()
        run: docker compose -f docker/docker-compose.lan.yml logs

      - name: Cleanup
        if: always()
        run: docker compose -f docker/docker-compose.lan.yml down -v