stack/.github/workflows/fta-v3.yml at a3152fbd513a795e04aa294fe2c994ec883d2a4e · cipherstash/stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
name: "FTA Complexity (EQL v3)"

# Blocking complexity gate for the EQL v3 text-search schema. Runs the Fast
# TypeScript Analyzer (fta-cli) against the v3 source directory only and fails
# the check when any file exceeds the score cap (`--score-cap` in the
# `analyze:complexity` script). FTA is pure static source analysis, so this job
# needs no build step, database, or credentials.

on:
  push:
    branches:
      - 'main'
    paths:
      - 'packages/stack/src/eql/v3/**'
      # Shared match-index defaults live outside src/eql/v3 but shape every
      # emitted v3 match block (load-bearing `k`/`m` ciphertext params), so edits
      # here must trigger the v3 gate too.
      - 'packages/stack/src/schema/match-defaults.ts'
      - 'packages/stack/package.json'
      - '.github/workflows/fta-v3.yml'
  pull_request:
    branches:
      - "**"
    paths:
      - 'packages/stack/src/eql/v3/**'
      - 'packages/stack/src/schema/match-defaults.ts'
      - 'packages/stack/package.json'
      - '.github/workflows/fta-v3.yml'

permissions:
  contents: read

jobs:
  fta:
    name: Analyze v3 complexity
    runs-on: blacksmith-4vcpu-ubuntu-2404

    steps:
      - name: Checkout Repo
        uses: actions/checkout@v6

      - uses: pnpm/action-setup@v6.0.8
        name: Install pnpm
        with:
          run_install: false

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: 'pnpm'

      # node-pty's install hook falls back to `node-gyp rebuild` when no
      # linux-x64 prebuild matches. pnpm/action-setup v6 no longer ships
      # node-gyp on PATH, so install it explicitly.
      - name: Install node-gyp
        run: npm install -g node-gyp

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Non-zero exit (score above the cap) fails the check — this is the
      # blocking gate. No `continue-on-error`.
      - name: Analyze v3 complexity
        run: pnpm --filter @cipherstash/stack run analyze:complexity