42 lines
1.2 KiB
YAML
42 lines
1.2 KiB
YAML
name: IT-0 verify
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Setup JDK 17
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: temurin
|
|
java-version: '17'
|
|
cache: maven
|
|
|
|
- name: Compile and run unit tests
|
|
working-directory: dev/RuoYi-Vue-master
|
|
run: mvn -B -ntp test
|
|
|
|
- name: Reject plaintext credentials (IT-0 acceptance #2 / IR-05)
|
|
shell: bash
|
|
run: |
|
|
set -e
|
|
RES=dev/RuoYi-Vue-master/ruoyi-admin/src/main/resources
|
|
if grep -RInE '(password|secret)[[:space:]]*:[[:space:]]*[^$<{[:space:]]' "$RES"; then
|
|
echo "::error::plaintext credential found in resources"
|
|
exit 1
|
|
fi
|
|
if grep -RInE 'APT_DB_PASSWORD[[:space:]]*=[[:space:]]*[^<$[:space:]]' . --exclude-dir=.git; then
|
|
echo "::error::a literal database password is committed"
|
|
exit 1
|
|
fi
|
|
if git ls-files --error-unmatch dev/.env >/dev/null 2>&1; then
|
|
echo "::error::dev/.env must not be tracked"
|
|
exit 1
|
|
fi
|
|
echo "credential scan passed"
|