chore(deps): bump nanoid from 3.3.11 to 3.3.16 #615
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, master, develop] | |
| pull_request: | |
| branches: [main, master, develop] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| detect: | |
| name: Detect Languages | |
| runs-on: ubuntu-latest | |
| outputs: | |
| has_rust: ${{ steps.detect.outputs.has_rust }} | |
| has_deny: ${{ steps.detect.outputs.has_deny }} | |
| has_python: ${{ steps.detect.outputs.has_python }} | |
| has_go: ${{ steps.detect.outputs.has_go }} | |
| has_typescript: ${{ steps.detect.outputs.has_typescript }} | |
| has_security: ${{ steps.detect.outputs.has_security }} | |
| has_trunk: ${{ steps.detect.outputs.has_trunk }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - id: detect | |
| run: | | |
| set +e | |
| # Initialize all outputs to false (critical: every output must be set) | |
| echo "has_rust=false" >> $GITHUB_OUTPUT | |
| echo "has_deny=false" >> $GITHUB_OUTPUT | |
| echo "has_python=false" >> $GITHUB_OUTPUT | |
| echo "has_go=false" >> $GITHUB_OUTPUT | |
| echo "has_typescript=false" >> $GITHUB_OUTPUT | |
| echo "has_security=false" >> $GITHUB_OUTPUT | |
| echo "has_trunk=false" >> $GITHUB_OUTPUT | |
| # Rust: needs Cargo.toml AND deny.toml | |
| if [ -f "Cargo.toml" ] || [ -f "**/Cargo.toml" ]; then | |
| echo "has_rust=true" >> $GITHUB_OUTPUT | |
| if [ -f "deny.toml" ]; then | |
| echo "has_deny=true" >> $GITHUB_OUTPUT | |
| fi | |
| fi | |
| # Python: needs pyproject.toml, setup.py, requirements.txt, or *.py | |
| if [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ] || find . -maxdepth 3 -name "*.py" -type f 2>/dev/null | head -1 | grep -q .; then | |
| echo "has_python=true" >> $GITHUB_OUTPUT | |
| fi | |
| # Go: needs go.mod | |
| if [ -f "go.mod" ]; then | |
| echo "has_go=true" >> $GITHUB_OUTPUT | |
| fi | |
| # TypeScript / JS: needs package.json (with type=module or tsconfig or js files) | |
| if [ -f "package.json" ]; then | |
| echo "has_typescript=true" >> $GITHUB_OUTPUT | |
| fi | |
| # Security: always run (bandit/gitleaks/dependency-review) | |
| echo "has_security=true" >> $GITHUB_OUTPUT | |
| # Trunk: only if trunk.yaml exists | |
| if [ -f "trunk.yaml" ]; then | |
| echo "has_trunk=true" >> $GITHUB_OUTPUT | |
| fi | |
| echo "" | |
| echo "=== Detected ===" | |
| echo "rust=${{ steps.detect.outputs.has_rust }} deny=${{ steps.detect.outputs.has_deny }} python=${{ steps.detect.outputs.has_python }} go=${{ steps.detect.outputs.has_go }} typescript=${{ steps.detect.outputs.has_typescript }} security=${{ steps.detect.outputs.has_security }} trunk=${{ steps.detect.outputs.has_trunk }}" | |
| rust: | |
| name: Rust | |
| needs: detect | |
| if: needs.detect.outputs.has_rust == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: cargo fmt --check | |
| run: | | |
| cargo fmt --all -- --check | |
| - name: cargo clippy | |
| run: | | |
| cargo clippy --all-targets -- -D warnings | |
| - name: cargo test | |
| run: | | |
| cargo test --workspace --no-fail-fast | |
| cargo-deny: | |
| name: Cargo Deny (Advisories + Licenses) | |
| needs: detect | |
| if: needs.detect.outputs.has_deny == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: cargo-deny check | |
| uses: EmbarkStudios/cargo-deny-action@v1 | |
| with: | |
| arguments: --all-features | |
| python: | |
| name: Python | |
| needs: detect | |
| if: needs.detect.outputs.has_python == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install ruff | |
| run: pip install ruff | |
| - name: ruff check | |
| run: ruff check . | |
| - name: ruff format --check | |
| run: ruff format --check . | |
| go: | |
| name: Go | |
| needs: detect | |
| if: needs.detect.outputs.has_go == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.22' | |
| - name: gofmt check | |
| run: gofmt -l . | |
| - name: go vet | |
| run: go vet ./... | |
| - name: go test | |
| run: go test ./... | |
| typescript: | |
| name: TS/JS | |
| needs: detect | |
| if: needs.detect.outputs.has_typescript == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - run: npm ci --no-audit --no-fund || npm install --no-audit --no-fund | |
| - name: lint | |
| run: | | |
| if [ -f package.json ] && grep -q '"lint"' package.json; then | |
| npm run lint | |
| fi | |
| - name: test | |
| run: | | |
| if [ -f package.json ] && grep -q '"test"' package.json; then | |
| npm test | |
| fi | |
| security: | |
| name: Security Scan | |
| needs: detect | |
| if: needs.detect.outputs.has_security == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| dep-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: low | |
| lint: | |
| name: ci / lint | |
| if: always() | |
| needs: [detect, rust, cargo-deny, python, go, typescript, security, dep-review] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Aggregate lint gate | |
| run: | | |
| failed=0 | |
| for pair in \ | |
| "rust:${{ needs.rust.result }}" \ | |
| "cargo-deny:${{ needs.cargo-deny.result }}" \ | |
| "python:${{ needs.python.result }}" \ | |
| "go:${{ needs.go.result }}" \ | |
| "typescript:${{ needs.typescript.result }}" \ | |
| "security:${{ needs.security.result }}" \ | |
| "dep-review:${{ needs.dep-review.result }}" \ | |
| ; do | |
| name="${pair%%:*}" | |
| result="${pair#*:}" | |
| if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then | |
| echo " ✗ $name: $result" | |
| failed=$((failed + 1)) | |
| elif [ "$result" = "success" ] || [ "$result" = "skipped" ]; then | |
| echo " ✓ $name: $result" | |
| else | |
| echo " ? $name: $result" | |
| fi | |
| done | |
| if [ "$failed" -gt 0 ]; then | |
| echo "" | |
| echo "❌ $failed lint check(s) failed" | |
| exit 1 | |
| fi | |
| echo "" | |
| echo "✅ All lint checks passed (or were skipped)" | |
| test: | |
| name: ci / test | |
| if: always() | |
| needs: [lint] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Test gate | |
| run: | | |
| # Test gate is currently combined with lint | |
| echo "✅ All test stages passed (gated via ci / lint)" |