ci: run the Postgres suites that never ran and lint the shell (#6917)

Eight Postgres-only tests skipped everywhere because no workflow named
them. The durable-first job now runs the service and outbound ones, and a
scratch-database job runs the migration tests that drop their own tables.
Every Postgres step counts top-level passes, so a renamed test cannot
leave a step green.

A shell-lint job runs actionlint on the workflows and shellcheck on the
shipped scripts (the legacy installers at error severity), golangci-lint
is pinned, and both the codegen job and make verify fail when
docs/public/openapi.json drifts from the panel's spec; docs-ci also fails
on a stale API reference. npm audit moves to its own script outside make
verify, since it depends on the network.
This commit is contained in:
25f2002654
2026-10-24 23:25:23 +05:30
committed by GitHub
parent 180cc37503
commit e8feb9d641
6 changed files with 123 additions and 15 deletions
+13 -2
View File
@@ -34,6 +34,10 @@ lint-go: dist-stub ## golangci-lint on Go sources
lint-fe: ## oxlint on frontend sources
cd $(FRONTEND) && npm run lint
.PHONY: audit-fe
audit-fe: ## Audit the frontend's production dependencies (needs the network)
cd $(FRONTEND) && npm run audit
.PHONY: lint
lint: lint-go lint-fe ## All linters
@@ -72,6 +76,10 @@ test: test-go test-fe ## All tests
vulncheck: dist-stub ## govulncheck
go run golang.org/x/vuln/cmd/govulncheck@latest ./...
.PHONY: docs-openapi-check
docs-openapi-check: ## Fail if the docs OpenAPI spec is not the panel's
cmp frontend/public/openapi.json docs/public/openapi.json
.PHONY: build-fe
build-fe: ## Build the Vite bundles into internal/web/dist
cd $(FRONTEND) && npm run build
@@ -85,7 +93,10 @@ build-storybook: ## Build the static Storybook (compile-checks all stories)
cd $(FRONTEND) && npm run build-storybook
# The PR gate. Matches ci.yml: codegen freshness, both linters, the formatter,
# typecheck, both test suites, a full build, and the Storybook compile-check.
# typecheck, both test suites, a full build, the Storybook compile-check and the
# docs spec check. The dependency audit is a separate target: it needs the
# network and a live advisory database, so an unchanged commit could pass today
# and fail tomorrow.
.PHONY: verify
verify: gen-check lint format-check typecheck test build build-storybook ## Full local gate (mirrors CI)
verify: gen-check lint format-check typecheck test build build-storybook docs-openapi-check ## Full local gate (mirrors CI)
@echo "verify: OK"