chore: harden registry resolution #232
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Red/green signal on every PR: typecheck (whole workspace) + test + audit. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| # Default-deny; each job opts back into the minimum it needs. | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| jobs: | |
| typecheck: | |
| name: Typecheck | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| # Root script builds nimbus-docs, then runs `pnpm -r typecheck`. | |
| - run: pnpm typecheck | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm --filter ./packages/nimbus-docs build | |
| - run: pnpm -r test | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm lint | |
| registry-scope: | |
| name: Registry scope guard | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm --filter @nimbus/www generate-registry | |
| # Registry payloads must import the scoped package. A bare | |
| # `grep 'from "nimbus-docs'` false-passes because the JSON escapes the | |
| # quote — match the escaped form / parse `.files[].content`. | |
| - name: Assert no unscoped nimbus-docs imports | |
| run: | | |
| hits=$(grep -rl 'from \\"nimbus-docs' apps/www/public/registry/components || true) | |
| if [ -n "$hits" ]; then | |
| echo "::error::Registry payloads import the unscoped nimbus-docs. Regenerate from the scoped source:" | |
| echo "$hits" | |
| exit 1 | |
| fi | |
| audit: | |
| name: Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 24 | |
| cache: pnpm | |
| # `pnpm audit` needs the resolved tree to populate advisory paths; without | |
| # an install it returns advisories with empty `paths` and the fail-closed | |
| # shape guard rejects the run. | |
| - run: pnpm install --frozen-lockfile | |
| # Fail closed: a non-JSON or unsupported audit response means this gate | |
| # cannot classify published-package risk reliably. | |
| - name: Audit published package prod deps | |
| run: pnpm audit:published-prod | |
| - name: Report full workspace high+ audit | |
| run: pnpm audit --audit-level high | |
| continue-on-error: true |