PortableCoder/.github/workflows/ci.yml at main · Mike-Jenkins-Org/PortableCoder · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint:
    name: Lint & Format
    runs-on: blacksmith
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Install linters
        run: npm install -g prettier

      - name: Prettier check
        run: npx prettier --check "**/*.{js,cjs,mjs,json,md}" || true

      - name: ShellCheck
        uses: ludeeus/action-shellcheck@master
        with:
          scandir: scripts/

  security:
    name: Security Scan
    runs-on: blacksmith
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install gitleaks
        run: |
          VERSION=$(curl -sSf https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep -oP '"tag_name":\s*"v\K[^"]+')
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_${VERSION}_linux_x64.tar.gz" | tar xz
          sudo mv gitleaks /usr/local/bin/

      - name: Gitleaks
        run: gitleaks detect --source . --verbose

  test:
    name: Test & Validate
    runs-on: blacksmith
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Validate launcher syntax
        run: node --check scripts/pcoder.cjs

      - name: Smoke test
        run: |
          scripts/runtime/linux/smoke-check.sh || true

      - name: Doctor check
        run: |
          scripts/pcoder setup --init || true
          scripts/pcoder doctor || true

  claude-review:
    name: Claude Code Review
    runs-on: blacksmith
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Claude Code Review
        uses: anthropics/claude-code-action@beta
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          model: claude-sonnet-4-6-20250514
          direct_prompt: |
            Review this PR for:
            - Security issues (especially in launcher scripts)
            - Logic errors and edge cases
            - Error handling gaps
            - JavaScript/Node.js best practices
            - Cross-platform compatibility (Windows/Linux/macOS)
            - Adherence to existing code patterns in the repo

            Focus on substantive issues. Skip minor style comments that linters would catch.