remove logs #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Performance and Security Scan | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - master | |
| jobs: | |
| performance-and-security: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| actions: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Build backend image | |
| uses: docker/build-push-action@v4 | |
| with: | |
| context: ./backend | |
| push: false | |
| tags: tutorize-backend:perf | |
| load: true | |
| - name: Start test container | |
| run: | | |
| echo "Creating test.env for perf container" | |
| cat > test.env << EOF | |
| NODE_ENV=test | |
| DATABASE_URL=${{ secrets.PROD_DATABASE_URL }} | |
| JWT_SECRET=${{ secrets.JWT_SECRET }} | |
| JWT_EXPIRES_IN=7d | |
| BCRYPT_ROUNDS=10 | |
| PORT=3000 | |
| READ_ONLY_MODE=true | |
| SENDGRID_API_KEY=dummy_sendgrid_key_for_testing | |
| SENDGRID_FROM_EMAIL=test@example.com | |
| SENDGRID_FROM_NAME=test-name | |
| CLOUDINARY_CLOUD_NAME=dummy_cloud_for_testing | |
| CLOUDINARY_API_KEY=dummy_api_key_for_testing | |
| CLOUDINARY_API_SECRET=dummy_api_secret_for_testing | |
| AWS_S3_ACCESS_KEY_ID=dummy_aws_key_for_testing | |
| AWS_S3_SECRET_ACCESS_KEY=dummy_aws_secret_for_testing | |
| AWS_S3_REGION=ap-northeast-1 | |
| AWS_S3_BUCKET_NAME=dummy_bucket_for_testing | |
| FRONTEND_URL=https://annguyen.software | |
| CORS_ORIGIN=https://annguyen.software,https://www.annguyen.software | |
| EOF | |
| docker run -d --name tutorize-perf --env-file test.env -p 3000:3000 tutorize-backend:perf || true | |
| # give extra time for startup | |
| sleep 8 | |
| - name: Wait for API to be ready | |
| run: | | |
| for i in {1..20}; do | |
| if curl -fs http://localhost:3000/api/v1/health >/dev/null 2>&1; then | |
| echo "API ready"; break; | |
| fi | |
| sleep 2 | |
| done | |
| - name: Diagnose service health | |
| run: | | |
| echo "== docker ps ==" | |
| docker ps -a || true | |
| echo "\n== listening TCP ports (ss) ==" | |
| ss -ltnp || true | |
| echo "\n== netstat fallback ==" | |
| netstat -tlnp || true | |
| echo "\n== host curl to health ==" | |
| curl -v http://localhost:3000/api/v1/health || true | |
| echo "\n== last 200 lines of container logs (tutorize-perf) ==" | |
| docker logs tutorize-perf --tail 200 || true | |
| - name: Install k6 load testing tool | |
| run: | | |
| curl -sSL https://github.com/grafana/k6/releases/download/v0.49.0/k6-v0.49.0-linux-amd64.tar.gz | tar xz | |
| sudo mv k6-v0.49.0-linux-amd64/k6 /usr/local/bin/ | |
| - name: Run performance load test | |
| run: | | |
| mkdir -p load-test | |
| # Use host networking so the container can reach localhost:3000 on the runner | |
| docker run --rm --network host -v ${GITHUB_WORKSPACE}:/src -w /src --user $(id -u):$(id -g) -e BASE_URL="http://localhost:3000/api/v1" grafana/k6:latest run \ | |
| --vus 20 --duration 30s --out json=load-test/results.json load-test/load-test.js | |
| env: | |
| GITHUB_WORKSPACE: ${{ github.workspace }} | |
| - name: Upload performance test results | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: k6-results | |
| path: load-test/k6/results.json | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@v2 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Run ZAP security baseline scan | |
| uses: zaproxy/action-baseline@v0.14.0 | |
| with: | |
| target: "http://localhost:3000/api/v1" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| continue-on-error: true | |
| - name: Upload security scan report | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: zap-report | |
| path: | | |
| report_json.json | |
| report_md.md | |
| report_html.html | |
| zap_scan.zip | |
| - name: Stop container | |
| if: always() | |
| run: | | |
| docker stop tutorize-perf || true | |
| docker rm tutorize-perf || true |