Cyberpilot/.github/workflows/dotnet.yml at master · MSBart2/Cyberpilot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
name: .NET Build and Test

on:
  push:
    branches: [main, develop]
    paths:
      - '**.cs'
      - '**.csproj'
      - '**.sln'
      - '**.cshtml'
      - '**.razor'
      - '**/appsettings*.json'
      - '.github/workflows/dotnet.yml'
  pull_request:
    branches: [main]
    paths:
      - '**.cs'
      - '**.csproj'
      - '**.sln'
      - '**.cshtml'
      - '**.razor'
      - '**/appsettings*.json'
      - '.github/workflows/dotnet.yml'

permissions:
  contents: read

jobs:
  build:
    name: Build and Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "10.0.x"

      - name: Cache NuGet packages
        uses: actions/cache@v4
        with:
          path: ~/.nuget/packages
          key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.sln') }}
          restore-keys: |
            ${{ runner.os }}-nuget-

      - name: Restore dependencies
        run: dotnet restore

      - name: Build
        run: dotnet build --no-restore --configuration Release

      - name: Test
        run: |
          if [ -d "tests" ] || find . -name "*.Tests.csproj" | grep -q .; then
            dotnet test --no-build --configuration Release --verbosity normal
          else
            echo "No test projects found, skipping tests"
          fi

      - name: Publish
        run: dotnet publish ./web/Cyberpilot.Web.csproj --no-build --configuration Release --output ./publish

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: published-app
          path: ./publish

  security-scan:
    name: Security scan
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "10.0.x"

      - name: Restore dependencies
        run: dotnet restore

      - name: Dependency vulnerability scan
        run: dotnet list package --vulnerable --include-transitive || true

  code-quality:
    name: Code quality
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: "10.0.x"

      - name: Restore dependencies
        run: dotnet restore

      - name: Code analysis
        run: dotnet build --configuration Release --verbosity normal

  pipeline-report:
    name: Pipeline build report
    runs-on: ubuntu-latest
    needs: [build, security-scan, code-quality]
    if: github.event_name == 'pull_request'
    permissions:
      issues: write
      pull-requests: read
    steps:
      - name: Report to pipeline issue
        uses: actions/github-script@v7
        env:
          BUILD_RESULT: ${{ needs.build.result }}
          SECURITY_RESULT: ${{ needs.security-scan.result }}
          QUALITY_RESULT: ${{ needs.code-quality.result }}
        with:
          script: |
            const pr = context.payload.pull_request;
            if (!pr) return;

            const branch = pr.head.ref || '';
            const isPipelinePR = branch.startsWith('feat/issue-');
            if (!isPipelinePR) {
              core.info('Not a pipeline PR. Skipping pipeline report.');
              return;
            }

            const branchMatch = branch.match(/issue-(\d+)/);
            if (!branchMatch) return;
            const issueNumber = parseInt(branchMatch[1]);

            const buildResult = process.env.BUILD_RESULT;
            const securityResult = process.env.SECURITY_RESULT;
            const qualityResult = process.env.QUALITY_RESULT;
            const allPassed = buildResult === 'success' && securityResult === 'success' && qualityResult === 'success';
            const timestamp = new Date().toISOString().replace('T', ' ').slice(0, 19) + ' UTC';

            const comment = [
              `## 🏗️ Pipeline — CI Status Update`,
              ``,
              `**Timestamp:** ${timestamp}  `,
              `**PR:** #${pr.number} (\`${branch}\`)`,
              ``,
              `| Job | Status |`,
              `|-----|--------|`,
              `| Build & Test | ${buildResult === 'success' ? '✅ Pass' : '❌ Fail'} |`,
              `| Security Scan | ${securityResult === 'success' ? '✅ Pass' : '❌ Fail'} |`,
              `| Code Quality | ${qualityResult === 'success' ? '✅ Pass' : '❌ Fail'} |`,
              ``,
              allPassed
                ? `✅ All CI checks passed. Pipeline can proceed.`
                : `⚠️ CI checks have failures. Review needed.`,
            ].join('\n');

            await github.rest.issues.createComment({
              ...context.repo,
              issue_number: issueNumber,
              body: comment,
            });