nimbus/.github/workflows/ci.yml at 18330c21d5df6715a160ec138fdf4eafddfdb123 · cloudflare/nimbus · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: CI

# Red/green signal on every PR: typecheck (whole workspace) + test + audit.
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

# Default-deny; each job opts back into the minimum it needs.
permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  typecheck:
    name: Typecheck
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      # Root script builds nimbus-docs, then runs `pnpm -r typecheck`.
      - run: pnpm typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm --filter ./packages/nimbus-docs build

      - run: pnpm -r test

  lint:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm lint

  registry-scope:
    name: Registry scope guard
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: pnpm

      - run: pnpm install --frozen-lockfile

      - run: pnpm --filter @nimbus/www generate-registry

      # Registry payloads must import the scoped package. A bare
      # `grep 'from "nimbus-docs'` false-passes because the JSON escapes the
      # quote — match the escaped form / parse `.files[].content`.
      - name: Assert no unscoped nimbus-docs imports
        run: |
          hits=$(grep -rl 'from \\"nimbus-docs' apps/www/public/registry/components || true)
          if [ -n "$hits" ]; then
            echo "::error::Registry payloads import the unscoped nimbus-docs. Regenerate from the scoped source:"
            echo "$hits"
            exit 1
          fi

  audit:
    name: Audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 24
          cache: pnpm

      # `pnpm audit` needs the resolved tree to populate advisory paths; without
      # an install it returns advisories with empty `paths` and the fail-closed
      # shape guard rejects the run.
      - run: pnpm install --frozen-lockfile

      # Fail closed: a non-JSON or unsupported audit response means this gate
      # cannot classify published-package risk reliably.
      - name: Audit published package prod deps
        run: pnpm audit:published-prod

      - name: Report full workspace high+ audit
        run: pnpm audit --audit-level high
        continue-on-error: true