fix: green container test suites + remove broken ecosystem-repos setu… #31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build & Deploy | |
| # Lightweight pipeline — strictly builds the app and deploys it to Azure App Service. | |
| # No test execution lives here (tests run locally / in the tiered suites). If a deploy | |
| # issue arises, prefer trimming this file further over adding functionality. | |
| on: | |
| push: | |
| branches: [master] | |
| workflow_dispatch: | |
| env: | |
| DOTNET_VERSION: '10.0.x' | |
| AZURE_WEBAPP_NAME: app-poseereview | |
| AZURE_RESOURCE_GROUP: PoSeeReview | |
| API_PROJECT_PATH: src/PoSeeReview.Api/PoSeeReview.Api.csproj | |
| permissions: | |
| contents: read | |
| id-token: write | |
| concurrency: | |
| group: deploy-${{ github.repository }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: ${{ env.DOTNET_VERSION }} | |
| - uses: actions/cache@v4 | |
| with: | |
| path: ~/.nuget/packages | |
| key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', 'Directory.Packages.props') }} | |
| restore-keys: nuget-${{ runner.os }}- | |
| - run: dotnet publish ${{ env.API_PROJECT_PATH }} -c Release -o publish | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| name: webapp | |
| path: publish | |
| retention-days: 1 | |
| deploy: | |
| name: Deploy to Azure App Service | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/master' | |
| timeout-minutes: 20 | |
| environment: | |
| name: production | |
| url: https://app-poseereview.azurewebsites.net | |
| steps: | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: webapp | |
| path: publish | |
| - uses: azure/login@v2 | |
| with: | |
| client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
| - uses: azure/webapps-deploy@v3 | |
| with: | |
| app-name: ${{ env.AZURE_WEBAPP_NAME }} | |
| resource-group-name: ${{ env.AZURE_RESOURCE_GROUP }} | |
| package: publish | |
| # Post-deployment smoke validation (curl-based, not a test runner): | |
| # 1) /health returns 200 + "Healthy" JSON | |
| # 2) Blazor render tree bootstraps (index.html references blazor.webassembly.js) | |
| # 3) /diag returns secret-presence status with values masked (no raw secret leaked) | |
| - name: Smoke validation | |
| run: | | |
| BASE="https://${{ env.AZURE_WEBAPP_NAME }}.azurewebsites.net" | |
| ok=0 | |
| for i in 1 2 3 4 5 6; do | |
| BODY=$(curl -s "$BASE/health" --max-time 30 || echo "") | |
| STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$BASE/health" --max-time 30 || echo "000") | |
| echo "Attempt $i — /health HTTP $STATUS: $BODY" | |
| if [ "$STATUS" = "200" ]; then ok=1; break; fi | |
| sleep 20 | |
| done | |
| if [ "$ok" != "1" ]; then echo "::error::/health never returned 200"; exit 1; fi | |
| echo "Checking Blazor render bootstrap..." | |
| INDEX=$(curl -s "$BASE/" --max-time 30 || echo "") | |
| if echo "$INDEX" | grep -qi "blazor.webassembly.js"; then | |
| echo "Render tree bootstrap present." | |
| else | |
| echo "::error::index.html did not reference blazor.webassembly.js (render tree failed to bootstrap)"; exit 1 | |
| fi | |
| echo "Checking /diag (masked secret retrieval)..." | |
| DIAG=$(curl -s "$BASE/diag" --max-time 30 || echo "") | |
| echo "/diag: $DIAG" | |
| if echo "$DIAG" | grep -Eqi 'BEGIN (RSA |EC )?PRIVATE KEY|AccountKey=[A-Za-z0-9+/]{20}'; then | |
| echo "::error::/diag appears to leak an unmasked secret"; exit 1 | |
| fi | |
| echo "Smoke validation passed." |