Add financial crime / money-trail tool (PS-1 #7) #126
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Don't waste minutes on superseded pushes | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| backend: | |
| name: Backend — lint · tests · golden gate | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: backend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| cache-dependency-path: backend/requirements.txt | |
| - name: Install dependencies | |
| run: pip install -r requirements.txt | |
| - name: "Install Catalyst SDK (--no-deps, its own typing-extensions pin conflicts with pydantic's)" | |
| run: pip install --no-deps -r requirements-catalyst.txt | |
| - name: Lint (ruff) | |
| run: ruff check . | |
| - name: Unit tests (compiler + SQL guard, executed against real SQLite) | |
| run: pytest tests -q | |
| - name: Golden-set gate — deterministic path must be 100% (PRD §10 hard gate) | |
| # Runs against an auto-created empty schema: proves every golden spec | |
| # compiles to executable SQL. No dataset (real or fake) in CI. | |
| working-directory: ${{ github.workspace }} | |
| run: python spike/run_spike.py --offline | |
| frontend: | |
| name: Frontend — typecheck · build | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies (lockfile-exact) | |
| run: npm ci | |
| - name: Typecheck + production build | |
| run: npm run build | |
| docker: | |
| name: Docker images build | |
| runs-on: ubuntu-latest | |
| # Image builds are the deploy path (Catalyst/VPS) — catch Dockerfile rot early, | |
| # but only on main to keep PR feedback fast. | |
| if: github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| packages: write # needed to push the backend image to GHCR below | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: docker compose build | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Log in to Docker Hub | |
| # Catalyst AppSail's console-based registry integration only supports | |
| # Docker Hub / AWS ECR / Google Artifact Registry -- not GHCR -- so | |
| # this is the deploy source for the console path (GHCR stays too, | |
| # for the CLI's local-image deploy path). | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Build and push backend image (Catalyst AppSail's Docker Image deploy source) | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: ./backend | |
| push: true | |
| platforms: linux/amd64 | |
| tags: | | |
| ghcr.io/sarmahighoncode/kaval-api:latest | |
| ghcr.io/sarmahighoncode/kaval-api:${{ github.sha }} | |
| docker.io/sarmahighondocker/kaval-api:latest | |
| docker.io/sarmahighondocker/kaval-api:${{ github.sha }} |