action/.github/workflows/ci.yml at 077c356eeccee2dc06a8474aecc7cf692a1a4eab · changesets/action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: CI

on:
  pull_request:
  # merge queue is required so all commits on target branches trigger this workflow
  # despite lack of the push event trigger here
  merge_group:
    branches:
      - main
      - next
      # merge group rulesets don't allow wildcards so in settings each maintenance branch needs to be added separately
      - "maintenance/v*" # branch rulesets don't support v[0-9]+

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.sha }}
  cancel-in-progress: true

jobs:
  lint-workflows:
    name: Lint workflows
    runs-on: ubuntu-latest
    permissions:
      actions: read # only required in private repos
      security-events: write # allow writing security events
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
        with:
          persona: pedantic
          annotations: true
          advanced-security: false

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: $/.github/actions/ci-setup

      - name: Test
        run: pnpm test

  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: $/.github/actions/ci-setup

      - name: Typecheck
        run: pnpm typecheck

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: $/.github/actions/ci-setup

      - name: Format
        run: pnpm format

  ci-ok:
    name: CI OK
    runs-on: ubuntu-latest
    if: always()
    needs: [lint-workflows, test, typecheck, lint]
    steps:
      - name: Exit with error if some jobs are not successful
        run: exit 1
        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}