claude-code-safety-net/.github/workflows/ci.yml at main · kenryu42/claude-code-safety-net · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
name: CI

on:
  workflow_dispatch:
  push:
    branches: [main]
    paths:
      - ".github/workflows/**"
      - "src/**"
      - "scripts/**"
      - "tests/**"
      - "assets/**"
      - "package.json"
      - "bun.lock"
      - "tsconfig.json"
      - "tsconfig.build.json"
      - "biome.json"
      - "knip.ts"
      - "sgconfig.yml"
      - "ast-grep/**"
  pull_request:
    branches: [main]
    paths:
      - ".github/workflows/**"
      - "src/**"
      - "scripts/**"
      - "tests/**"
      - "assets/**"
      - "package.json"
      - "bun.lock"
      - "tsconfig.json"
      - "tsconfig.build.json"
      - "biome.json"
      - "knip.ts"
      - "sgconfig.yml"
      - "ast-grep/**"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  full-check:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile
        env:
          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli"

      - name: Run full checks
        run: bun run check:ci

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  build:
    runs-on: ubuntu-latest
    needs: [full-check]
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile
        env:
          BUN_INSTALL_ALLOW_SCRIPTS: "@ast-grep/cli"

      - name: Build
        run: bun run build

      - name: Verify build output
        run: |
          test -f dist/index.js || (echo "ERROR: dist/index.js not found!" && exit 1)
          test -f dist/index.d.ts || (echo "ERROR: dist/index.d.ts not found!" && exit 1)
          test -f dist/bin/cc-safety-net.js || (echo "ERROR: dist/bin/cc-safety-net.js not found!" && exit 1)

      - name: Auto-commit schema changes
        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
        run: |
          if git diff --quiet assets/cc-safety-net.schema.json; then
            echo "No schema changes to commit"
          else
            git config user.name "github-actions[bot]"
            git config user.email "github-actions[bot]@users.noreply.github.com"
            git add assets/cc-safety-net.schema.json
            git commit -m "chore: auto-update schema.json"
            git push
          fi

  draft-release:
    runs-on: ubuntu-latest
    needs: [build]
    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - run: git fetch --force --tags

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Generate release notes
        id: notes
        run: |
          NOTES=$(bun run scripts/generate-changelog.ts)
          {
            echo "notes<<EOF"
            echo "$NOTES"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create or update draft release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          EXISTING_DRAFT=$(gh release list --json tagName,isDraft --jq '.[] | select(.isDraft == true and .tagName == "next") | .tagName')

          if [ -n "$EXISTING_DRAFT" ]; then
            echo "Updating existing draft release..."
            gh release edit next \
              --title "Upcoming Changes 🛡️" \
              --notes-file - \
              --draft <<'EOF'
          ${{ steps.notes.outputs.notes }}
          EOF
          else
            echo "Creating new draft release..."
            gh release create next \
              --title "Upcoming Changes 🛡️" \
              --notes-file - \
              --draft \
              --target ${{ github.sha }} <<'EOF'
          ${{ steps.notes.outputs.notes }}
          EOF
          fi