chore(deps): bump @nestjs/config from 4.0.4 to 12.0.0 #357
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: STELLARHUNTS | ||
| on: | ||
| workflow_dispatch: | ||
| push: | ||
| branches: | ||
| - main | ||
| pull_request: | ||
| permissions: read-all | ||
| # Cancels any in-progress run for the same branch / PR so we don't | ||
| # waste runner minutes on superseded pushes. | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| # ───────────────────────────────────────────────────────────────────── | ||
| # Onchain jobs (contracts) | ||
| # ───────────────────────────────────────────────────────────────────── | ||
| jobs: | ||
| # Changed-path matrix: only run the jobs relevant to the files touched | ||
| # in a PR/push, while preserving a full run whenever shared configuration | ||
| # (lockfile, workflows, release config, root manifests) changes. This | ||
| # speeds up validation without losing coverage (#321). | ||
| changes: | ||
| name: Detect changed paths | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| outputs: | ||
| backend: ${{ steps.filter.outputs.backend }} | ||
| frontend: ${{ steps.filter.outputs.frontend }} | ||
| onchain: ${{ steps.filter.outputs.onchain }} | ||
| shared: ${{ steps.filter.outputs.shared }} | ||
| run-all: ${{ steps.filter.outputs.run_all }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: dorny/paths-filter@v3 | ||
| id: filter | ||
| with: | ||
| base: ${{ github.event.pull_request.base.sha || 'main' }} | ||
| filters: | | ||
| backend: | ||
| - 'backend/**' | ||
| frontend: | ||
| - 'frontend/**' | ||
| onchain: | ||
| - 'onchain/**' | ||
| # Shared configuration affects every project: any of these alone | ||
| # is enough to force a full (all jobs) validation run. | ||
| shared: | ||
| - 'package.json' | ||
| - 'package-lock.json' | ||
| - 'npm-workspaces.yaml' | ||
| - '**/package.json' | ||
| - '**/package-lock.json' | ||
| - '.github/workflows/**.yml' | ||
| - '.github/workflows/**.yaml' | ||
| run_all: | ||
| - 'package.json' | ||
| - 'package-lock.json' | ||
| - '**/package.json' | ||
| - '**/package-lock.json' | ||
| - '.github/workflows/release.yml' | ||
| - 'onchain/Scarb.lock' | ||
| - 'onchain/Scarb.toml' | ||
| - 'onchain/Cargo.lock' | ||
| - 'onchain/Cargo.toml' | ||
| # Helper: resolves the effective "should this job run?" boolean by OR-ing | ||
| # the project-specific filter with the shared/run-all signal. | ||
| onchain-build: | ||
| name: Build contracts | ||
| needs: changes | ||
| if: ${{ needs.changes.outputs.onchain == 'true' || needs.changes.outputs.run-all == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| # Cache Cargo artifacts and any (future) root-level | ||
| # node_modules. Keyed on the lockfile hash so a dependency change | ||
| # invalidates the entry, but identical lockfiles re-use the | ||
| # previous cache. The `**/node_modules` path is currently a | ||
| # no-op target because no JS step runs in this workflow — it is | ||
| # included so that when npm-based jobs are added in the future, | ||
| # the cache key already covers them. | ||
| - name: Cache Cargo and node_modules | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: | | ||
| ~/.cargo/registry | ||
| ~/.cargo/git | ||
| onchain/target | ||
| **/node_modules | ||
| key: ${{ runner.os }}-cargo-${{ hashFiles('onchain/Cargo.lock', '**/package-lock.json') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-cargo- | ||
| - name: Install Rust toolchain | ||
| uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | ||
| with: | ||
| targets: wasm32-unknown-unknown | ||
| components: rustfmt | ||
| # See onchain/Cargo.lock for pinned dependency resolutions. | ||
| - name: Build contracts (release wasm) | ||
| working-directory: onchain | ||
| run: cargo build --workspace --target wasm32-unknown-unknown --release --locked | ||
| - name: Format check | ||
| working-directory: onchain | ||
| run: cargo fmt --all -- --check | ||
| # ── cargo-deny ──────────────────────────────────────────── | ||
| # Audit dependencies for security advisories, license compliance, | ||
| # and duplicate crate versions. | ||
| - name: Install cargo-deny | ||
| uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2 | ||
| with: | ||
| tool: cargo-deny | ||
| - name: cargo-deny check | ||
| working-directory: onchain | ||
| run: cargo deny --locked check advisories licenses bans sources | ||
| onchain-test: | ||
| name: Test contracts | ||
| needs: changes | ||
| if: ${{ needs.changes.outputs.onchain == 'true' || needs.changes.outputs.run-all == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Cache Cargo and node_modules | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: | | ||
| ~/.cargo/registry | ||
| ~/.cargo/git | ||
| onchain/target | ||
| **/node_modules | ||
| key: ${{ runner.os }}-cargo-${{ hashFiles('onchain/Cargo.lock', '**/package-lock.json') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-cargo- | ||
| - name: Install Rust toolchain | ||
| uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable | ||
| with: | ||
| toolchain: stable | ||
| - name: Install cargo-deny | ||
| uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2 | ||
| with: | ||
| tool: cargo-deny | ||
| - name: cargo-deny check (covers dev-deps too) | ||
| working-directory: onchain | ||
| run: cargo deny --locked check advisories licenses bans sources | ||
| - name: Build contracts (test profile) | ||
| working-directory: onchain | ||
| run: cargo build --workspace --tests --locked | ||
| - name: Run unit tests | ||
| working-directory: onchain | ||
| run: cargo test --workspace --locked | ||
| # ── Resource bench ───────────────────────────────────────── | ||
| # Bench tests for submit_answer budget (issue #34). Output is | ||
| # captured as an artifact so budget regressions are visible in | ||
| # the CI run summary, and then enforced against the documented | ||
| # baselines in onchain/bench-baselines.json (issue #281) — a | ||
| # material regression fails the job. | ||
| - name: Run resource bench | ||
| working-directory: onchain | ||
| run: cargo test --workspace --locked -- bench_ --nocapture 2>&1 | tee bench-output.txt | ||
| - name: Check bench budget thresholds | ||
| # Fails when any measured metric exceeds its baseline or when | ||
| # the bench produced no measurements at all (silent regression). | ||
| run: python3 scripts/check-bench-budgets.py onchain/bench-output.txt | ||
| - name: Upload bench artifact | ||
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | ||
| with: | ||
| name: bench-output | ||
| path: onchain/bench-output.txt | ||
| if-no-files-found: warn | ||
| retention-days: 7 | ||
| # ───────────────────────────────────────────────────────────────────── | ||
| # Backend CI | ||
| # ───────────────────────────────────────────────────────────────────── | ||
| backend-lint: | ||
| name: Backend lint | ||
| needs: changes | ||
| if: ${{ needs.changes.outputs.backend == 'true' || needs.changes.outputs.shared == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| cache-dependency-path: backend/package-lock.json | ||
| - name: Install dependencies | ||
| working-directory: backend | ||
| run: npm ci | ||
| - name: Lint | ||
| working-directory: backend | ||
| # The backend currently contains pre-existing lint errors across | ||
| # unrelated modules; keep this report visible without blocking CI. | ||
| continue-on-error: true | ||
| run: npm run lint | ||
| - name: npm audit | ||
| working-directory: backend | ||
| run: npm audit --audit-level=critical | ||
| continue-on-error: true | ||
| backend-test: | ||
| name: Backend tests | ||
| needs: changes | ||
| if: ${{ needs.changes.outputs.backend == 'true' || needs.changes.outputs.shared == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| cache-dependency-path: backend/package-lock.json | ||
| - name: Install dependencies | ||
| working-directory: backend | ||
| run: npm ci | ||
| - name: Run unit tests | ||
| working-directory: backend | ||
| run: npm test -- --passWithNoTests | ||
| # ───────────────────────────────────────────────────────────────────── | ||
| # Frontend CI | ||
| # ───────────────────────────────────────────────────────────────────── | ||
| frontend-lint: | ||
| name: Frontend lint | ||
| needs: changes | ||
| if: ${{ needs.changes.outputs.frontend == 'true' || needs.changes.outputs.shared == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| cache-dependency-path: frontend/package-lock.json | ||
| - name: Install dependencies | ||
| working-directory: frontend | ||
| run: npm ci | ||
| - name: Lint | ||
| working-directory: frontend | ||
| run: npm run lint | ||
| - name: npm audit | ||
| working-directory: frontend | ||
| run: npm audit --audit-level=critical | ||
| continue-on-error: true | ||
| run: npm audit --audit-level=high | ||
| frontend-build: | ||
| name: Frontend build | ||
| needs: changes | ||
| if: ${{ needs.changes.outputs.frontend == 'true' || needs.changes.outputs.shared == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| cache-dependency-path: frontend/package-lock.json | ||
| - name: Install dependencies | ||
| working-directory: frontend | ||
| run: npm ci | ||
| - name: Build | ||
| working-directory: frontend | ||
| run: npm run build | ||
| frontend-smoke-test: | ||
| name: Frontend production smoke test | ||
| needs: [changes, frontend-build] | ||
| if: ${{ needs.changes.outputs.frontend == 'true' || needs.changes.outputs.shared == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| cache-dependency-path: frontend/package-lock.json | ||
| - name: Install dependencies | ||
| working-directory: frontend | ||
| run: npm ci | ||
| - name: Build production bundle | ||
| working-directory: frontend | ||
| run: npm run build | ||
| - name: Start production server | ||
| working-directory: frontend | ||
| run: | | ||
| npm run start -- --hostname 127.0.0.1 --port 3000 > /tmp/stellarhunts-frontend.log 2>&1 & | ||
| echo $! > /tmp/stellarhunts-frontend.pid | ||
| for i in $(seq 1 30); do | ||
| if curl -fsS http://127.0.0.1:3000 >/dev/null; then | ||
| exit 0 | ||
| fi | ||
| sleep 2 | ||
| done | ||
| cat /tmp/stellarhunts-frontend.log | ||
| exit 1 | ||
| - name: Stop production server | ||
| if: always() | ||
| run: | | ||
| if [ -f /tmp/stellarhunts-frontend.pid ]; then | ||
| kill "$(cat /tmp/stellarhunts-frontend.pid)" || true | ||
| fi | ||
| frontend-test: | ||
| name: Frontend tests | ||
| needs: changes | ||
| if: ${{ needs.changes.outputs.frontend == 'true' || needs.changes.outputs.shared == 'true' }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | ||
| with: | ||
| node-version: 20 | ||
| cache: npm | ||
| cache-dependency-path: frontend/package-lock.json | ||
| - name: Install dependencies | ||
| working-directory: frontend | ||
| run: npm ci | ||
| - name: Run unit tests | ||
| working-directory: frontend | ||
| run: npm test | ||
