From 668a08125e03a60fa07c057bc95d033c51fe5246 Mon Sep 17 00:00:00 2001 From: Mikhail Deriabin Date: Fri, 24 Jul 2026 18:10:29 +0300 Subject: [PATCH 1/2] migrate CI/CD pipeline to GitHub Actions from Jenkins --- .../Jenkinsfile-archived-24-07-2026 | 0 .../ci-archived-24-07-2026.yml} | 0 .github/workflows/ci-cd.yml | 153 ++++++++++++++++++ README.md | 2 + codecov.yml | 11 ++ frontend-next-migration/jest.ci-config.ts | 2 +- 6 files changed, 167 insertions(+), 1 deletion(-) rename Jenkinsfile => .github/deprecated/Jenkinsfile-archived-24-07-2026 (100%) rename .github/{workflows/ci.yml => deprecated/ci-archived-24-07-2026.yml} (100%) create mode 100644 .github/workflows/ci-cd.yml create mode 100644 codecov.yml diff --git a/Jenkinsfile b/.github/deprecated/Jenkinsfile-archived-24-07-2026 similarity index 100% rename from Jenkinsfile rename to .github/deprecated/Jenkinsfile-archived-24-07-2026 diff --git a/.github/workflows/ci.yml b/.github/deprecated/ci-archived-24-07-2026.yml similarity index 100% rename from .github/workflows/ci.yml rename to .github/deprecated/ci-archived-24-07-2026.yml diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml new file mode 100644 index 000000000..a5259b457 --- /dev/null +++ b/.github/workflows/ci-cd.yml @@ -0,0 +1,153 @@ +name: CI-CD + +on: + push: + branches: + - main + - dev + pull_request: + branches: + - '**' + +defaults: + run: + working-directory: frontend-next-migration + +jobs: + test: + name: Run tests + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v7 + + - name: Setup Node.js + uses: actions/setup-node@v7 + with: + node-version: 24 + cache: 'npm' + + - name: Install dependencies + run: npm ci + + - name: Run tests + env: + NEXT_PUBLIC_API_LINK: ${{ secrets.NEXT_PUBLIC_API_LINK }} + NEXT_PUBLIC_API_DOMAIN: ${{ secrets.NEXT_PUBLIC_API_DOMAIN }} + NEXT_PUBLIC_LOCAL_HOST: ${{ secrets.NEXT_PUBLIC_LOCAL_HOST }} + NEXT_PUBLIC_DIRECTUS_HOST: ${{ secrets.NEXT_PUBLIC_DIRECTUS_HOST }} + run: | + set +e + npm run test:ci + FIRST_RESULT=$? + + if [ $FIRST_RESULT -ne 0 ]; then + echo "First test run failed, retrying failed tests..." + npm run test:ci-retry-failed + RETRY_RESULT=$? + + if [ $RETRY_RESULT -ne 0 ]; then + echo "Tests failed after retry" + exit 1 + fi + fi + + - name: Upload coverage reports to Codecov + uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} + url: ${{ secrets.CODECOV_URL }} + slug: Alt-Org/Altzone-WebPages + files: ./frontend-next-migration/coverage/coverage-final.json + fail_ci_if_error: true + + build-and-push: + name: Build and Push Docker Image + needs: test + if: github.ref_name == 'main' || github.ref_name == 'dev' + runs-on: [self-hosted, gh-runner-common] + steps: + - name: Checkout code + uses: actions/checkout@v7 + + - name: Log in to Docker Hub + uses: docker/login-action@v4 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Write build env file + env: + ENV_LOCAL_BUILD: ${{ secrets.SITE_ENV_LOCAL_BUILD }} + run: printf '%s' "$ENV_LOCAL_BUILD" > .env.local + + - name: Build and push image + uses: docker/build-push-action@v7 + env: + DOCKER_BUILD_RECORD_UPLOAD: false + with: + context: frontend-next-migration + push: true + load: true + tags: | + ${{ secrets.DOCKERHUB_USERNAME }}/${{ secrets.DOCKERHUB_REPO }}:${{ github.ref_name }}-${{ github.run_number }} + ${{ secrets.DOCKERHUB_USERNAME }}/${{ secrets.DOCKERHUB_REPO }}:${{ github.ref_name }}-latest + + - name: Clean up build env file + if: always() + run: rm -f .env.local + + - name: Scan image for vulnerabilities + uses: aquasecurity/trivy-action@v0.36.0 + with: + image-ref: ${{ secrets.DOCKERHUB_USERNAME }}/${{ secrets.DOCKERHUB_REPO }}:${{ github.ref_name }}-${{ github.run_number }} + format: json + ignore-unfixed: true + exit-code: '0' + output: frontend-next-migration/trivy-results.json + + - name: Upload vulnerabilities to summary tab + if: always() + run: | + { + echo "## Vulnerability scan results" + echo "" + echo "| Target | Package | CVE | Severity | Installed | Fixed |" + echo "|---|---|---|---|---|---|" + jq -r ' + .Results[]? + | select(.Vulnerabilities != null) + | .Target as $t + | .Vulnerabilities[] + | "| \($t) | \(.PkgName) | \(.VulnerabilityID) | \(.Severity) | \(.InstalledVersion) | \(.FixedVersion // "-") |" + ' trivy-results.json + } >> "$GITHUB_STEP_SUMMARY" + + - name: Convert scan results to SARIF format + if: always() + run: trivy convert --format sarif --output trivy-results.sarif trivy-results.json + + - name: Upload vulnerabilities to Security tab + uses: github/codeql-action/upload-sarif@v4 + with: + sarif_file: frontend-next-migration/trivy-results.sarif + + notify: + name: Notify server about new image build + needs: build-and-push + if: github.ref_name == 'main' || github.ref_name == 'dev' + runs-on: [self-hosted, gh-runner-common] + steps: + - name: Notify server + env: + WEBHOOK_SECRET: ${{ secrets.SERVER_WEBHOOK_NOTIFY_SECRET }} + WEBHOOK_URL: ${{ secrets.SERVER_WEBHOOK_NOTIFY_URL }} + PAYLOAD: '{"name": "site", "tag": "${{ github.ref_name }}"}' + run: | + SIGNATURE=$(echo "$PAYLOAD" | openssl dgst -sha256 -hmac "$WEBHOOK_SECRET" | sed 's/^.* //') + + curl -s -o /dev/null -X POST "$WEBHOOK_URL" \ + -H "Content-Type: application/json" \ + -H "X-Hub-Signature: sha256=$SIGNATURE" \ + -d "$PAYLOAD" \ + --insecure \ No newline at end of file diff --git a/README.md b/README.md index ca2806556..1530477d2 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,5 @@ +[![codecov](https://yrfbcpxonsco.mikhail.com.de/github/Alt-Org/Altzone-WebPages/graph/badge.svg?token=HYZVADVM8S)](https://yrfbcpxonsco.mikhail.com.de/github/Alt-Org/Altzone-WebPages) + # Altzone-WebPages Welcome to the **Altzone-WebPages** repository! 🎉 diff --git a/codecov.yml b/codecov.yml new file mode 100644 index 000000000..9f3ea4b6e --- /dev/null +++ b/codecov.yml @@ -0,0 +1,11 @@ +coverage: + status: + project: + default: + target: 1 + patch: + default: + target: 1 + +codecov: + branch: dev \ No newline at end of file diff --git a/frontend-next-migration/jest.ci-config.ts b/frontend-next-migration/jest.ci-config.ts index d7ced6434..59ce8cb0a 100644 --- a/frontend-next-migration/jest.ci-config.ts +++ b/frontend-next-migration/jest.ci-config.ts @@ -27,7 +27,7 @@ const config: Config = { collectCoverage: true, coverageDirectory: 'coverage', - coverageReporters: ['cobertura'], + coverageReporters: ['json', 'json-summary', 'text-summary'], reporters: ['jest-junit'], collectCoverageFrom: ['src/**/*.{ts,tsx}'], }; From c318ae8a112d8600b9a3f41863c677b78ee27a8c Mon Sep 17 00:00:00 2001 From: Mikhail Deriabin Date: Fri, 24 Jul 2026 18:17:36 +0300 Subject: [PATCH 2/2] set codecov step not to fail pipeline --- .github/workflows/ci-cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index a5259b457..fce044690 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -59,7 +59,7 @@ jobs: url: ${{ secrets.CODECOV_URL }} slug: Alt-Org/Altzone-WebPages files: ./frontend-next-migration/coverage/coverage-final.json - fail_ci_if_error: true + fail_ci_if_error: false build-and-push: name: Build and Push Docker Image