rl-cli/.github/workflows/ci.yml at main · runloopai/rl-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
name: CI

on:
  pull_request:
    # labeled/unlabeled needed so the dependency-check bypass-age-gate label re-triggers the gate
    types: [opened, synchronize, reopened, labeled, unlabeled]
  pull_request_target:
    # Run on release-please PRs (created by GITHUB_TOKEN which doesn't trigger regular pull_request)
    types: [opened, synchronize, reopened]
  workflow_dispatch:

jobs:
  format:
    runs-on: ubuntu-slim
    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
    if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          # For pull_request_target, explicitly checkout the PR head (for security)
          # For regular pull_request and workflow_dispatch, checkout action uses defaults
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run Prettier check
        run: pnpm run format:check

  lint:
    runs-on: ubuntu-slim
    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
    if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          # For pull_request_target, explicitly checkout the PR head (for security)
          # For regular pull_request and workflow_dispatch, checkout action uses defaults
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run ESLint
        run: pnpm run lint

  build:
    runs-on: ubuntu-slim
    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
    if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          # For pull_request_target, explicitly checkout the PR head (for security)
          # For regular pull_request and workflow_dispatch, checkout action uses defaults
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build TypeScript
        run: pnpm run build

  test:
    runs-on: ubuntu-slim
    needs: build
    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
    if: (github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch'
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          # For pull_request_target, explicitly checkout the PR head (for security)
          # For regular pull_request and workflow_dispatch, checkout action uses defaults
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Setup pnpm
        uses: pnpm/action-setup@v5

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run component tests with coverage
        run: pnpm run test:components

      - name: Upload coverage report
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: component-coverage
          path: coverage/
          retention-days: 7

  dependency-check:
    runs-on: ubuntu-slim
    if: github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')
    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          repository: ${{ github.event.pull_request.head.repo.full_name }}

      - name: Fetch base ref
        run: git fetch origin ${{ github.event.pull_request.base.ref }} --depth=1

      - name: Check dependency age (supply-chain gate)
        uses: runloopai/dependency-age-check-action@main
        with:
          ecosystems: npm
          min-age-days: "7"
          warn-age-days: "14"
          base-ref: origin/${{ github.event.pull_request.base.ref }}
          bypass-keyword: "bypass-age-gate"

  ready-to-merge:
    runs-on: ubuntu-slim
    permissions: {}
    needs: [format, lint, build, test, dependency-check]
    # Run from pull_request for non-release-please branches, or pull_request_target for release-please branches only
    if: always() && ((github.event_name == 'pull_request' && !startsWith(github.event.pull_request.head.ref, 'release-please--')) || (github.event_name == 'pull_request_target' && startsWith(github.event.pull_request.head.ref, 'release-please--')) || github.event_name == 'workflow_dispatch')
    steps:
      - name: Check all jobs passed
        run: |
          if [[ "${{ needs.format.result }}" != "success" ]] || \
             [[ "${{ needs.lint.result }}" != "success" ]] || \
             [[ "${{ needs.build.result }}" != "success" ]] || \
             [[ "${{ needs.test.result }}" != "success" ]] || \
             [[ "${{ needs.dependency-check.result }}" != "success" && "${{ needs.dependency-check.result }}" != "skipped" ]]; then
            echo "One or more required jobs failed"
            exit 1
          fi
          echo "All required jobs passed!"