chore(release): v0.9.0 #18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # GENERATED - do not edit directly. | |
| # Source hash: c529e9a0dbe1d719c3cafa658058dc8efadbbd5c8a4c23a7a72ee6d212d9d6cb | |
| name: CI | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled] | |
| push: | |
| branches: | |
| - main | |
| # Cancel superseded runs on the same PR. Non-PR runs (pushes to main) get a | |
| # unique group per run so they neither cancel nor queue behind each other. | |
| # | |
| # Draft and ready runs are kept in separate groups on purpose. Every heavy job below | |
| # is gated on `draft == false`, so a run created while the PR was still a draft skips | |
| # them and finishes in seconds. Sharing one group let that cheap run cancel the | |
| # ready-for-review run that followed it, leaving a green fifteen-second result that | |
| # proved nothing. Observed on pull requests 841 and 843. | |
| concurrency: | |
| group: ci-${{ github.event.pull_request.number || github.run_id }}-${{ github.event.pull_request.draft && 'draft' || 'ready' }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| static: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # The Action requires a paid organization license; use the OSS CLI before npm ci. | |
| # Pin its version and verify SHA-256 so a moved tag cannot replace the binary. | |
| - name: Install gitleaks | |
| run: | | |
| curl -sSfL -o gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | |
| echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb gitleaks.tar.gz" | sha256sum -c - | |
| tar -xzf gitleaks.tar.gz gitleaks | |
| sudo mv gitleaks /usr/local/bin/gitleaks | |
| rm gitleaks.tar.gz | |
| - name: Scan working tree | |
| run: gitleaks dir . --redact --config .gitleaks.toml | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| # Lockfile is generated with npm 10.9.3; npm 11 dedupes nested esbuild entries and breaks npm ci. | |
| - run: npm i -g npm@10.9.3 | |
| - run: npm ci | |
| - run: npm run ci:static | |
| compose-contract: | |
| if: github.event_name != 'pull_request' || github.event.pull_request.draft == false | |
| runs-on: ${{ github.repository != 'CorgiCorner/bisibility' && vars.CI_USE_DEPOT == 'true' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }} | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 | |
| with: | |
| node-version-file: .nvmrc | |
| - run: npm run smoke:compose-contract | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3, 4] | |
| env: | |
| RUN_COVERAGE: ${{ github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'ci-coverage') }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| # Lockfile is generated with npm 10.9.3; npm 11 dedupes nested esbuild entries and breaks npm ci. | |
| - run: npm i -g npm@10.9.3 | |
| - run: npm ci | |
| - name: Unit tests | |
| if: env.RUN_COVERAGE != 'true' | |
| run: npm run test:unit -- --shard=${{ matrix.shard }}/4 | |
| - name: Unit tests with coverage blob report | |
| if: env.RUN_COVERAGE == 'true' | |
| # Partial shards cannot satisfy global thresholds; coverage enforces them after merging all four reports. | |
| run: npm run ci:test:coverage-shard -- --shard=${{ matrix.shard }}/4 --coverage.thresholds.functions=0 --coverage.thresholds.lines=0 --coverage.thresholds.statements=0 | |
| - name: Upload blob report | |
| if: env.RUN_COVERAGE == 'true' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: blob-report-${{ matrix.shard }} | |
| path: .vitest-reports/ | |
| if-no-files-found: error | |
| include-hidden-files: true | |
| - name: Upload failed blob report | |
| if: failure() && env.RUN_COVERAGE == 'true' && hashFiles('.vitest-reports/**') != '' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: failed-blob-report-${{ matrix.shard }} | |
| path: .vitest-reports/ | |
| if-no-files-found: error | |
| include-hidden-files: true | |
| coverage: | |
| needs: test | |
| if: github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'ci-coverage') | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| # Lockfile is generated with npm 10.9.3; npm 11 dedupes nested esbuild entries and breaks npm ci. | |
| - run: npm i -g npm@10.9.3 | |
| - run: npm ci | |
| - name: Download blob reports | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: blob-report-* | |
| path: .vitest-reports | |
| merge-multiple: true | |
| - run: npm run ci:coverage:merge | |
| build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| # Lockfile is generated with npm 10.9.3; npm 11 dedupes nested esbuild entries and breaks npm ci. | |
| - run: npm i -g npm@10.9.3 | |
| - name: Restore Next.js build cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: .next/cache | |
| key: ${{ runner.os }}-nextjs-${{ hashFiles('package-lock.json') }}-${{ hashFiles('**/*.ts', '**/*.tsx') }} | |
| restore-keys: | | |
| ${{ runner.os }}-nextjs-${{ hashFiles('package-lock.json') }}- | |
| - run: npm ci | |
| - run: npm run ci:build | |
| postgres-migration-contract: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| APP_VERSION: ${{ github.sha }} | |
| DATABASE_URL: postgresql://bisibility:bisibility@127.0.0.1:5432/bisibility?schema=ci_migration_contract | |
| DEPLOYMENT_ENV: test | |
| DIRECT_URL: postgresql://bisibility:bisibility@127.0.0.1:5432/bisibility?schema=ci_migration_contract | |
| services: | |
| postgres: | |
| image: postgres:16 | |
| env: | |
| POSTGRES_DB: bisibility | |
| POSTGRES_PASSWORD: bisibility | |
| POSTGRES_USER: bisibility | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U bisibility -d bisibility" | |
| --health-interval 2s | |
| --health-timeout 5s | |
| --health-retries 30 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - run: npm i -g npm@10.9.3 | |
| - run: npm ci | |
| - run: npm run ci:postgres-migration-contract | |
| ci-ok: | |
| needs: [static, test, coverage, build, postgres-migration-contract] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6 | |
| with: | |
| node-version-file: .nvmrc | |
| - name: Verify required jobs | |
| env: | |
| NEEDS_JSON: ${{ toJSON(needs) }} | |
| OPTIONAL_JOBS: coverage | |
| run: node scripts/ci/verify-required-jobs.mjs |