Merge pull request #6 from DROOdotFOO/mcp-signoz-primary #124
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Setup chezmoi | |
| run: | | |
| curl -fsLS https://github.com/twpayne/chezmoi/releases/latest/download/chezmoi-linux-amd64 -o chezmoi | |
| chmod +x chezmoi | |
| sudo mv chezmoi /usr/local/bin/ | |
| chezmoi --version | |
| - name: Lint shell scripts | |
| run: | | |
| find scripts/ -name "*.sh" -exec shellcheck {} \; | |
| - name: Check for template syntax errors | |
| run: | | |
| # `execute-template --init` only simulates prompt* functions; it does NOT | |
| # populate [data]. Render the config template once so [data] flags | |
| # (rust, coingecko, signoz, ...) are available to regular templates. | |
| chezmoi execute-template --init --source "$PWD" \ | |
| --promptString name=ci \ | |
| --promptString email=ci@example.com \ | |
| --promptString github=ci \ | |
| --promptString age_recipient= \ | |
| --promptString personal=false < .chezmoi.toml.tmpl > /tmp/chezmoi-ci.toml | |
| find . -name "*.tmpl" -o -name "*.conf" | xargs -I {} grep -l "{{.*}}" {} | while read file; do | |
| echo "Checking $file for template syntax..." | |
| # Config template is validated by the render step above. | |
| if [[ "$file" == *".chezmoi.toml.tmpl" ]]; then | |
| echo "Skipping $file (config template, validated on render)" | |
| continue | |
| fi | |
| # Skip SSH private key template as it requires personal flag and 1Password | |
| if [[ "$file" == *"private_id_rsa.tmpl" ]]; then | |
| echo "Skipping $file (requires personal flag and 1Password)" | |
| continue | |
| fi | |
| # Skip authorized_keys template as it requires GitHub API access | |
| if [[ "$file" == *"authorized_keys.tmpl" ]]; then | |
| echo "Skipping $file (requires GitHub API access)" | |
| continue | |
| fi | |
| # Skip Oh My Zsh template as it requires specific variables | |
| if [[ "$file" == *"oh-my-zsh.tmpl" ]]; then | |
| echo "Skipping $file (requires Oh My Zsh variables)" | |
| continue | |
| fi | |
| # Skip SSH public key template as it requires 1Password | |
| if [[ "$file" == *"id_rsa.pub.tmpl" ]]; then | |
| echo "Skipping $file (requires 1Password)" | |
| continue | |
| fi | |
| # Lint against the rendered config so [data] flags resolve. | |
| chezmoi --config /tmp/chezmoi-ci.toml execute-template < "$file" > /dev/null | |
| done | |
| test: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Setup chezmoi | |
| run: | | |
| curl -fsLS https://github.com/twpayne/chezmoi/releases/latest/download/chezmoi-linux-amd64 -o chezmoi | |
| chmod +x chezmoi | |
| sudo mv chezmoi /usr/local/bin/ | |
| chezmoi --version | |
| - name: Run health check | |
| run: | | |
| # Mock environment for testing | |
| export HOME=/tmp/test-home | |
| mkdir -p $HOME | |
| # Try new location first, then legacy | |
| if [ -f ./utils/health-check.sh ]; then | |
| ./utils/health-check.sh || true | |
| elif [ -f ./scripts/utils/health-check.sh ]; then | |
| ./scripts/utils/health-check.sh || true | |
| fi | |
| - name: Test template generation | |
| run: | | |
| # Test template generation without actual creation | |
| ./scripts/utils/template-manager.sh list | |
| security: | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: "fs" | |
| scan-ref: "." | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| - name: Display Trivy results | |
| run: | | |
| echo "=== Trivy Scan Results ===" | |
| if [[ -f trivy-results.sarif ]]; then | |
| echo "SARIF file generated successfully" | |
| echo "File size: $(wc -c < trivy-results.sarif) bytes" | |
| else | |
| echo "No SARIF file generated" | |
| fi | |
| - name: Upload Trivy scan results | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| continue-on-error: true |