updating ci workflow

update pre quality

Author: arii

.github/workflows/ci-cd.yml

@@ -2,14 +2,14 @@ name: CI/CD Pipeline
 
 on:
   push:
-    branches: [leader, main]
+    branches: [leader]
   pull_request:
-    branches: [leader, main]
+    branches: [leader]
 
 jobs:
   # 1. Fast, parallel validation for linting and unit tests
   unit_tests:
-    runs-on: ubuntu-latest # 2-core runner is sufficient for fast tests
+    runs-on: self-hosted# 2-core runner is sufficient for fast tests
     strategy:
       matrix:
         node-version: [18.x, 20.x]
@@ -48,7 +48,7 @@ jobs:
     needs: [unit_tests]
     # For self-hosted or larger runners, specify here:
     # runs-on: self-hosted-8core 
-    runs-on: ubuntu-latest # Consider upgrading this to ubuntu-latest-8-cores for speed
+    runs-on: self-hosted # Consider upgrading this to ubuntu-latest-8-cores for speed
 
     # We only need the latest, validated Node version here.
     steps:
@@ -113,7 +113,7 @@ jobs:
 
   # 3. Security remains separate
   security:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
@@ -150,4 +150,4 @@ jobs:
   #       path: .
 
   #   - name: Deploy Notification
-  #     run: echo "Deployment would happen here, using the downloaded build artifact."
+  #     run: echo "Deployment would happen here, using the downloaded build artifact."

.github/workflows/pr-quality.yml

@@ -1,16 +1,27 @@
 name: PR Quality Gate
 
+# 🔒 SECURITY: Use manual trigger only for self-hosted runners
+# This prevents forks from automatically running code on your machine
 on:
   workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Branch to check'
+        required: true
+        default: 'main'
 
 jobs:
   pr-quality:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
 
     steps:
+    - name: Cleanup Workspace
+      run: rm -rf ./*
+      
     - name: Checkout code
       uses: actions/checkout@v4
       with:
+        ref: ${{ inputs.branch }}
         fetch-depth: 0
 
     - name: Setup Node.js
@@ -19,29 +30,26 @@ jobs:
         node-version: "20.x"
         cache: "npm"
 
-    - name: Install dependencies
-      run: npm ci
+    - name: Install dependencies (Safe Mode)
+      # 🛡️ SECURITY: --ignore-scripts prevents malicious postinstall scripts
+      # from executing on your local machine.
+      run: npm ci --ignore-scripts
 
-    - name: Check PR title format
-      run: |
-        # This check is informational for manual runs.
-        # In a real PR context, you would use github.event.pull_request.title
-        echo "Note: This check is for a manual run. In a PR, it would validate the title."
-
     - name: Check for large files
       run: |
+        echo "🔍 Scanning for large files (>1MB)..."
         find . -type f -size +1M -not -path "./node_modules/*" -not -path "./.git/*" | while read file; do
           echo "::warning::Large file detected: $file ($(du -h "$file" | cut -f1))"
         done
     
     - name: Lint commit messages
       run: |
-        echo "Note: This check is for a manual run. In a PR, it would lint commit messages."
+        echo "🔍 Verifying Conventional Commits..."
         if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then
           git log --oneline HEAD~1..HEAD | while read line; do
             if [[ ! "$line" =~ ^[a-f0-9]+\ (feat|fix|docs|style|refactor|test|chore|perf|ci)(\(.+\))?: ]]; then
-              echo "::warning::Commit message should follow conventional commits: $line"
+              echo "::warning::Invalid Commit Message: $line"
+              echo "::warning::Format should be: type(scope): description"
             fi
           done
         fi
-