ci.yml

name: CI
on: [push]
jobs:
  python-tests:
    runs-on: ubuntu-22.04

    services:
      db:
        image: postgres:17.1
        # Health checks to wait until postgres has started
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres # pragma: allowlist secret
          POSTGRES_DB: postgres
        ports:
          - 5432:5432

      redis:
        image: redis:7.4.1
        ports:
          - 6379:6379

      elastic:
        image: docker.elastic.co/elasticsearch/elasticsearch:8.16.0
        env:
          network.host: "0.0.0.0"
          http.cors.enabled: "true"
          http.cors.allow-origin: "*"
          rest.action.multi.allow_explicit_index: "false"
          ES_JAVA_OPTS: -Xms512m -Xmx512m"
        ports:
          - 9200:9200

    steps:
      - uses: actions/checkout@v4

      - name: Apt update
        run: sudo apt-get update -y

      - name: Apt install
        run: cat Aptfile | sudo xargs apt-get install

      - name: Set up Python
        id: setup-python
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
        with:
          python-version: "3.12.6"

      - name: Install poetry
        uses: snok/install-poetry@v1
        with:
          version: 1.8.2
          virtualenvs-create: true
          virtualenvs-in-project: true
          virtualenvs-path: .venv

      - name: Load cached venv
        id: cached-poetry-dependencies
        uses: actions/cache@v4
        with:
          path: .venv
          key: venv-${{ runner.os }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('**/poetry.lock') }}

      - name: Install dependencies
        if: steps.cached-poetry-dependencies.outputs.cache-hit != 'true'
        run: poetry install --no-interaction --no-root

      - name: Install project
        run: poetry install --no-interaction

      # Configurations required for elasticsearch.
      - name: Configure sysctl limits
        run: |
          sudo swapoff -a
          sudo sysctl -w vm.swappiness=1
          sudo sysctl -w fs.file-max=262144
          sudo sysctl -w vm.max_map_count=262144

      - name: Runs Elasticsearch
        uses: elastic/elastic-github-actions/elasticsearch@master
        with:
          stack-version: 6.7.1

      - name: Running Celery
        run: |
          celery -A mitxpro worker -B -l INFO &
          sleep 10
        env:
          CELERY_TASK_ALWAYS_EAGER: "True"
          CELERY_BROKER_URL: redis://localhost:6379/4
          CELERY_RESULT_BACKEND: redis://localhost:6379/4
          SECRET_KEY: local_unsafe_key # pragma: allowlist secret
          MITOL_HUBSPOT_API_PRIVATE_TOKEN: test-token
          MITXPRO_BASE_URL: http://localhost:8053
          MAILGUN_SENDER_DOMAIN: other.fake.site
          MAILGUN_KEY: fake_mailgun_key
          MITXPRO_ADMIN_EMAIL: example@localhost
          OPENEDX_API_CLIENT_ID: fake_client_id
          OPENEDX_API_CLIENT_SECRET: fake_client_secret # pragma: allowlist secret

      - name: Tests
        run: |
          source .venv/bin/activate
          export MEDIA_ROOT="$(mktemp -d)"
          poetry run ./scripts/test/python_tests.sh
        env:
          DEBUG: False
          NODE_ENV: "production"
          CELERY_TASK_ALWAYS_EAGER: "True"
          CELERY_BROKER_URL: redis://localhost:6379/4
          CELERY_RESULT_BACKEND: redis://localhost:6379/4
          DATABASE_URL: postgres://postgres:postgres@localhost:5432/postgres # pragma: allowlist secret
          WEBPACK_DISABLE_LOADER_STATS: "True"
          ELASTICSEARCH_URL: localhost:9200
          EMERITUS_API_KEY: fake_emeritus_api_key # pragma: allowlist secret
          MAILGUN_KEY: fake_mailgun_key
          MAILGUN_SENDER_DOMAIN: other.fake.site
          MITOL_DIGITAL_CREDENTIALS_VERIFY_SERVICE_BASE_URL: http://localhost:5000
          MITOL_DIGITAL_CREDENTIALS_HMAC_SECRET: fake.hmac.secret # pragma: allowlist secret
          MITOL_HUBSPOT_API_PRIVATE_TOKEN: test-token
          MITXPRO_ADMIN_EMAIL: example@localhost
          MITXPRO_BASE_URL: http://localhost:8053
          MITXPRO_DB_DISABLE_SSL: "True"
          MITXPRO_EMAIL_BACKEND: django.core.mail.backends.locmem.EmailBackend
          MITXPRO_NOTIFICATION_EMAIL_BACKEND: django.core.mail.backends.locmem.EmailBackend
          MITXPRO_SECURE_SSL_REDIRECT: "False"
          MITXPRO_USE_S3: "False"
          OPENEDX_API_BASE_URL: http://localhost:18000
          OPENEDX_API_CLIENT_ID: fake_client_id
          OPENEDX_API_CLIENT_SECRET: fake_client_secret # pragma: allowlist secret
          SECRET_KEY: local_unsafe_key # pragma: allowlist secret

      - name: Upload coverage to CodeCov
        uses: codecov/codecov-action@985343d70564a82044c1b7fcb84c2fa05405c1a2 # v5
        with:
          file: ./coverage.xml

  javascript-tests:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - name: Setup NodeJS
        uses: actions/setup-node@v2-beta
        with:
          node-version: 20.16.0

      - name: Get yarn cache directory path
        id: yarn-cache-dir-path
        run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT

      - uses: actions/cache@v4
        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
        with:
          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
          restore-keys: |
            ${{ runner.os }}-yarn-
      - name: Install dependencies
        run: yarn install --immutable

      - name: Lints
        run: npm run lint-check

      - name: Code formatting
        run: npm run fmt:check

      - name: Scss lint
        run: npm run scss-lint

      - name: Flow
        run: npm run flow

      - name: Tests
        run: npm run test
        env:
          CODECOV: true
          NODE_ENV: development

      - name: Webpack build
        run: node node_modules/webpack/bin/webpack.js --config webpack.config.prod.js --bail

      - name: Upload test coverage to CodeCov
        uses: codecov/codecov-action@985343d70564a82044c1b7fcb84c2fa05405c1a2 # v5
        with:
          file: coverage/lcov.info