docs: update repo references for framework → objectstack rename #2177
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate Dependencies | |
| on: | |
| pull_request: | |
| paths: | |
| - '**/package.json' | |
| - 'pnpm-lock.yaml' | |
| - '.changeset/config.json' | |
| - 'pnpm-workspace.yaml' | |
| - 'scripts/check-changeset-fixed.mjs' | |
| - 'scripts/check-override-consistency.mjs' | |
| # Re-run when the workflow itself changes, so edits to these gates are | |
| # exercised on the PR that introduces them. | |
| - '.github/workflows/validate-deps.yml' | |
| schedule: | |
| # Run weekly on Monday at 03:00 UTC | |
| - cron: '0 3 * * 1' | |
| workflow_dispatch: | |
| jobs: | |
| validate: | |
| name: Validate Package Dependencies | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '20' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Verify pnpm version | |
| run: pnpm --version | |
| - name: Get pnpm store directory | |
| shell: bash | |
| run: | | |
| echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV | |
| - name: Setup pnpm cache | |
| uses: actions/cache@v6 | |
| with: | |
| path: ${{ env.STORE_PATH }} | |
| key: ${{ runner.os }}-pnpm-store-v3-${{ hashFiles('**/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm-store-v3- | |
| - name: Verify lockfile is up to date | |
| run: | | |
| pnpm install --frozen-lockfile --prefer-offline | |
| - name: Verify Changesets "fixed" group covers every public package | |
| run: node scripts/check-changeset-fixed.mjs | |
| # pnpm overrides pin what THIS workspace resolves, but they do not ship | |
| # with published packages — downstream installs see only the declared | |
| # ranges. If an override target isn't reachable from a publishable | |
| # package's declared range, we test one dependency graph and publish | |
| # another (the 15.1.0 quickstart shipped exactly that: plugin-auth | |
| # declared better-auth ^1.6.23 while CI ran the 1.7.0-rc.1 override, | |
| # and every fresh project 500'd on auth). | |
| - name: Verify overrides are reflected in published manifests | |
| run: node scripts/check-override-consistency.mjs | |
| # Fail the workflow if known vulnerabilities are found — enforces | |
| # security compliance before merging. | |
| # | |
| # Previously this ran `pnpm audit --audit-level=high`, but npm retired the | |
| # audit endpoint (HTTP 410, "This endpoint is being retired. Use the bulk | |
| # advisory endpoint instead.") and pnpm has not migrated, so `pnpm audit` | |
| # now fails unconditionally on every branch (see issue #2974). OSV-Scanner | |
| # reads pnpm-lock.yaml directly against the OSV database and exits non-zero | |
| # when any advisory matches, restoring a working blocking gate. | |
| # | |
| # Note: OSV-Scanner blocks on any severity, not just high/critical. To | |
| # accept a specific advisory, add an osv-scanner.toml `[[IgnoredVulns]]` | |
| # entry rather than lowering the gate. | |
| - name: Audit dependencies for known vulnerabilities (OSV-Scanner) | |
| uses: google/osv-scanner-action/osv-scanner-action@a82132c0bd6c7261ffcb78e754c46c70ab57ad9a # v2.3.8 | |
| with: | |
| scan-args: |- | |
| --lockfile=pnpm-lock.yaml | |
| - name: List outdated packages | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| run: | | |
| pnpm outdated --recursive || true |