Skip to content

Commit cc7656f

Browse files
brunozoricbrunozoric
authored
chore: ci hardening (#3)
1 parent 8b87b78 commit cc7656f

7 files changed

Lines changed: 1012 additions & 266 deletions

File tree

‎.github/workflows/audit.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Audit
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
audit:
13+
name: Dependency audit
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
17+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
18+
with:
19+
node-version: 24
20+
cache: yarn
21+
- run: yarn install --immutable
22+
- run: yarn npm audit
23+
24+
dependency-review:
25+
name: Dependency review
26+
runs-on: ubuntu-latest
27+
if: github.event_name == 'pull_request'
28+
permissions:
29+
contents: read
30+
pull-requests: write
31+
steps:
32+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
33+
- uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

‎.github/workflows/ci.yml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
lockfile:
13+
name: Lockfile immutability
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
17+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
18+
with:
19+
node-version: 24
20+
cache: yarn
21+
- run: yarn install --immutable
22+
23+
dist-clean:
24+
name: No committed dist
25+
runs-on: ubuntu-latest
26+
steps:
27+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
28+
- name: Verify dist is not tracked in git
29+
run: |
30+
tracked=$(git ls-files dist/)
31+
if [ -n "$tracked" ]; then
32+
echo "ERROR: dist/ files are committed to git:"
33+
echo "$tracked"
34+
echo "Fix: git rm -r --cached dist/"
35+
exit 1
36+
fi
37+
echo "OK: dist/ is not tracked"
38+
39+
format:
40+
name: Format
41+
runs-on: ubuntu-latest
42+
steps:
43+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
44+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
45+
with:
46+
node-version: 24
47+
cache: yarn
48+
- run: yarn install --immutable
49+
- run: yarn format:check
50+
51+
lint:
52+
name: Lint
53+
runs-on: ubuntu-latest
54+
steps:
55+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
56+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
57+
with:
58+
node-version: 24
59+
cache: yarn
60+
- run: yarn install --immutable
61+
- run: yarn lint
62+
63+
imports:
64+
name: Import check (adio)
65+
runs-on: ubuntu-latest
66+
steps:
67+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
68+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
69+
with:
70+
node-version: 24
71+
cache: yarn
72+
- run: yarn install --immutable
73+
- run: yarn check:imports
74+
75+
typecheck:
76+
name: Typecheck
77+
runs-on: ubuntu-latest
78+
steps:
79+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
80+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
81+
with:
82+
node-version: 24
83+
cache: yarn
84+
- run: yarn install --immutable
85+
- run: yarn typecheck
86+
87+
build:
88+
name: Build
89+
needs: [lockfile, format, lint, imports, typecheck]
90+
runs-on: ubuntu-latest
91+
steps:
92+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
93+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
94+
with:
95+
node-version: 24
96+
cache: yarn
97+
- run: yarn install --immutable
98+
- run: yarn build
99+
100+
test:
101+
name: Test & Coverage
102+
needs: [build]
103+
runs-on: ubuntu-latest
104+
steps:
105+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
106+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
107+
with:
108+
node-version: 24
109+
cache: yarn
110+
- run: yarn install --immutable
111+
- run: yarn test:coverage
112+
113+
pack:
114+
name: Pack dry-run
115+
needs: [build]
116+
runs-on: ubuntu-latest
117+
steps:
118+
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
119+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
120+
with:
121+
node-version: 24
122+
cache: yarn
123+
- run: yarn install --immutable
124+
- run: yarn build
125+
- run: yarn pack:packages

‎.github/workflows/pr-title.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: PR Title
2+
3+
on:
4+
pull_request:
5+
types: [opened, edited, synchronize, reopened]
6+
7+
permissions:
8+
pull-requests: read
9+
10+
jobs:
11+
title-lint:
12+
name: Conventional commit title
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
16+
env:
17+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
18+
with:
19+
types: |
20+
feat
21+
fix
22+
refactor
23+
test
24+
chore
25+
docs
26+
style
27+
perf
28+
build
29+
ci
30+
revert
31+
requireScope: false

0 commit comments

Comments
 (0)