fix: rewrite docs with correct backend URL + field names, add AI Prox… #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| DATABASE_URL: sqlite:///./test_api_keys.db | |
| ENCRYPTION_KEY: FvGGWbuwbLf4zjJ_eqSsos7tjf4cs09WyMbsyIiDMH4= | |
| JWT_SECRET_KEY: test-jwt-secret-key-for-ci | |
| JWT_ALGORITHM: HS256 | |
| ALLOWED_ORIGINS: http://localhost:3000 | |
| jobs: | |
| # ─── Backend Tests ─── | |
| backend-tests: | |
| name: 🔧 Backend Tests | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ['3.11', '3.12'] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r backend/requirements.txt | |
| - name: Run tests | |
| working-directory: backend | |
| run: pytest test_main.py -v --tb=short | |
| - name: Lint with ruff | |
| run: | | |
| pip install ruff | |
| ruff check backend/ --ignore E501 | |
| # ─── Frontend Build ─── | |
| frontend-build: | |
| name: 🎨 Frontend Build | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| node-version: ['18', '20'] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| working-directory: frontend | |
| run: npm ci | |
| - name: TypeScript check | |
| working-directory: frontend | |
| run: npx tsc --noEmit | |
| - name: Build production | |
| working-directory: frontend | |
| run: npm run build | |
| - name: Run tests | |
| working-directory: frontend | |
| run: npm test -- --run | |
| continue-on-error: true | |
| # ─── Security Audit ─── | |
| security-audit: | |
| name: 🔒 Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check for secrets in code | |
| run: | | |
| echo "Scanning for hardcoded secrets..." | |
| ! grep -rn "nvapi-" --include="*.py" --include="*.ts" --include="*.tsx" --include="*.md" . || exit 1 | |
| ! grep -rn "password.*=.*\"" --include="*.py" --include="*.env.example" . | grep -v "password_hash" | grep -v "test" | grep -v "#" || exit 1 | |
| echo "✅ No hardcoded secrets found" | |
| - name: Check sensitive files not committed | |
| run: | | |
| for f in YOUR_CREDENTIALS.md TEST_CREDENTIALS.md cookies.txt backend.log; do | |
| if [ -f "$f" ]; then | |
| echo "❌ Sensitive file found: $f" | |
| exit 1 | |
| fi | |
| done | |
| echo "✅ No sensitive files committed" | |
| - name: npm audit | |
| working-directory: frontend | |
| run: npm audit --audit-level=high | |
| continue-on-error: true | |
| # ─── Docker Build ─── | |
| docker-build: | |
| name: 🐳 Docker Build | |
| runs-on: ubuntu-latest | |
| needs: [backend-tests, frontend-build] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build Docker image | |
| run: docker build -t api-gateway:test . | |
| - name: Test health check | |
| run: | | |
| docker run -d --name test-api \ | |
| -e DATABASE_URL=sqlite:///./test.db \ | |
| -e ENCRYPTION_KEY=${{ env.ENCRYPTION_KEY }} \ | |
| -e JWT_SECRET_KEY=${{ env.JWT_SECRET_KEY }} \ | |
| -p 8000:8000 api-gateway:test | |
| sleep 5 | |
| curl -f http://localhost:8000/api/v1/health || exit 1 | |
| docker stop test-api |