fix(bazel): repair v8-canary config (llvm flag target + lockfile drift) #628
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, master, develop] | |
| pull_request: | |
| branches: [main, master, develop] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| detect: | |
| name: Detect Languages | |
| runs-on: ubuntu-latest | |
| outputs: | |
| has_rust: ${{ steps.detect.outputs.has_rust }} | |
| has_deny: ${{ steps.detect.outputs.has_deny }} | |
| has_python: ${{ steps.detect.outputs.has_python }} | |
| has_go: ${{ steps.detect.outputs.has_go }} | |
| has_typescript: ${{ steps.detect.outputs.has_typescript }} | |
| has_security: ${{ steps.detect.outputs.has_security }} | |
| has_trunk: ${{ steps.detect.outputs.has_trunk }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - id: detect | |
| run: | | |
| set +e | |
| # Initialize all outputs to false (critical: every output must be set) | |
| echo "has_rust=false" >> $GITHUB_OUTPUT | |
| echo "has_deny=false" >> $GITHUB_OUTPUT | |
| echo "has_python=false" >> $GITHUB_OUTPUT | |
| echo "has_go=false" >> $GITHUB_OUTPUT | |
| echo "has_typescript=false" >> $GITHUB_OUTPUT | |
| echo "has_security=false" >> $GITHUB_OUTPUT | |
| echo "has_trunk=false" >> $GITHUB_OUTPUT | |
| # Rust: needs Cargo.toml AND deny.toml | |
| if [ -f "Cargo.toml" ] || [ -f "**/Cargo.toml" ]; then | |
| echo "has_rust=true" >> $GITHUB_OUTPUT | |
| if [ -f "deny.toml" ]; then | |
| echo "has_deny=true" >> $GITHUB_OUTPUT | |
| fi | |
| fi | |
| # Python: needs pyproject.toml, setup.py, requirements.txt, or *.py | |
| if [ -f "pyproject.toml" ] || [ -f "setup.py" ] || [ -f "requirements.txt" ] || find . -maxdepth 3 -name "*.py" -type f 2>/dev/null | head -1 | grep -q .; then | |
| echo "has_python=true" >> $GITHUB_OUTPUT | |
| fi | |
| # Go: needs go.mod | |
| if [ -f "go.mod" ]; then | |
| echo "has_go=true" >> $GITHUB_OUTPUT | |
| fi | |
| # TypeScript / JS: needs package.json (with type=module or tsconfig or js files) | |
| if [ -f "package.json" ]; then | |
| echo "has_typescript=true" >> $GITHUB_OUTPUT | |
| fi | |
| # Security: always run (bandit/gitleaks/dependency-review) | |
| echo "has_security=true" >> $GITHUB_OUTPUT | |
| # Trunk: only if trunk.yaml exists | |
| if [ -f "trunk.yaml" ]; then | |
| echo "has_trunk=true" >> $GITHUB_OUTPUT | |
| fi | |
| echo "" | |
| echo "=== Detected ===" | |
| echo "rust=${{ steps.detect.outputs.has_rust }} deny=${{ steps.detect.outputs.has_deny }} python=${{ steps.detect.outputs.has_python }} go=${{ steps.detect.outputs.has_go }} typescript=${{ steps.detect.outputs.has_typescript }} security=${{ steps.detect.outputs.has_security }} trunk=${{ steps.detect.outputs.has_trunk }}" | |
| rust: | |
| name: Rust | |
| needs: detect | |
| if: needs.detect.outputs.has_rust == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: cargo fmt --check | |
| run: | | |
| cargo fmt --all -- --check | |
| - name: cargo clippy | |
| run: | | |
| cargo clippy --all-targets -- -D warnings | |
| - name: cargo test | |
| run: | | |
| cargo test --workspace --no-fail-fast | |
| cargo-deny: | |
| name: Cargo Deny (Advisories + Licenses) | |
| needs: detect | |
| if: needs.detect.outputs.has_deny == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - name: cargo-deny check | |
| # v2 (SHA-pinned, same as rust-ci.yml/cargo-deny.yml): v1 bundles | |
| # cargo-deny 0.14.21, which cannot parse the current RustSec advisory | |
| # database (TOML parse error on RUSTSEC-2026-0109). | |
| uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2 | |
| with: | |
| arguments: --all-features | |
| python: | |
| name: Python | |
| needs: detect | |
| if: needs.detect.outputs.has_python == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install ruff | |
| run: pip install ruff | |
| - name: ruff check | |
| run: ruff check . | |
| - name: ruff format --check | |
| run: ruff format --check . | |
| go: | |
| name: Go | |
| needs: detect | |
| if: needs.detect.outputs.has_go == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.22' | |
| - name: gofmt check | |
| run: gofmt -l . | |
| - name: go vet | |
| run: go vet ./... | |
| - name: go test | |
| run: go test ./... | |
| typescript: | |
| name: TS/JS | |
| needs: detect | |
| if: needs.detect.outputs.has_typescript == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5 | |
| with: | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: lint | |
| run: | | |
| if [ -f package.json ] && grep -q '"lint"' package.json; then | |
| pnpm run lint | |
| fi | |
| - name: test | |
| run: | | |
| if [ -f package.json ] && grep -q '"test"' package.json; then | |
| pnpm run test | |
| fi | |
| security: | |
| name: Security Scan | |
| needs: detect | |
| if: needs.detect.outputs.has_security == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # gitleaks-action scans the PR commit range on pull_request events; | |
| # the default depth-1 checkout lacks the parent commit and makes the | |
| # git log range fail ("stderr is not empty"). | |
| fetch-depth: 0 | |
| - name: gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| dep-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: low | |
| lint: | |
| name: ci / lint | |
| if: always() | |
| needs: [detect, rust, cargo-deny, python, go, typescript, security, dep-review] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Aggregate lint gate | |
| run: | | |
| failed=0 | |
| for pair in \ | |
| "rust:${{ needs.rust.result }}" \ | |
| "cargo-deny:${{ needs.cargo-deny.result }}" \ | |
| "python:${{ needs.python.result }}" \ | |
| "go:${{ needs.go.result }}" \ | |
| "typescript:${{ needs.typescript.result }}" \ | |
| "security:${{ needs.security.result }}" \ | |
| "dep-review:${{ needs.dep-review.result }}" \ | |
| ; do | |
| name="${pair%%:*}" | |
| result="${pair#*:}" | |
| if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then | |
| echo " ✗ $name: $result" | |
| failed=$((failed + 1)) | |
| elif [ "$result" = "success" ] || [ "$result" = "skipped" ]; then | |
| echo " ✓ $name: $result" | |
| else | |
| echo " ? $name: $result" | |
| fi | |
| done | |
| if [ "$failed" -gt 0 ]; then | |
| echo "" | |
| echo "❌ $failed lint check(s) failed" | |
| exit 1 | |
| fi | |
| echo "" | |
| echo "✅ All lint checks passed (or were skipped)" | |
| test: | |
| name: ci / test | |
| if: always() | |
| needs: [lint] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Test gate | |
| run: | | |
| # Test gate is currently combined with lint | |
| echo "✅ All test stages passed (gated via ci / lint)" |