chore(main): release sandbox 0.1.1 #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| # PRs are covered by `pull_request`; the merge queue by `merge_group`. | |
| # Scoping `push` to main avoids a duplicate run on every PR branch | |
| # (push + pull_request) while still validating main after a queue merge. | |
| push: | |
| branches: [main] | |
| pull_request: | |
| merge_group: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| # One in-flight run per PR (or per ref elsewhere); cancel superseded PR runs. | |
| group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| build: | |
| name: Lint, typecheck, test, build (Node ${{ matrix.node }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # sandbox engines.node >=22 is the binding floor; agent (>=20) runs fine | |
| # on these. 26.3.0 matches the version pinned in mise.toml. | |
| node: ["22", "24", "26.3.0"] | |
| env: | |
| # mise-action installs pnpm from mise.toml; this overrides only the node | |
| # version per matrix cell. | |
| MISE_NODE_VERSION: ${{ matrix.node }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install node and pnpm via mise | |
| uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4 | |
| - name: Resolve pnpm store path | |
| run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV" | |
| - name: Cache pnpm store | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: ${{ env.STORE_PATH }} | |
| key: ${{ runner.os }}-node${{ matrix.node }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-node${{ matrix.node }}-pnpm- | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Lint | |
| run: pnpm lint | |
| - name: Check formatting | |
| run: pnpm format:check | |
| - name: Typecheck | |
| run: pnpm typecheck | |
| - name: Test | |
| run: pnpm test | |
| - name: Build | |
| run: pnpm build | |
| # ESM-only publish gates — sandbox only (the root scripts --filter it). | |
| # Run after build so dist/ exists. | |
| - name: Publint (sandbox) | |
| run: pnpm publint | |
| - name: Are the types wrong? (sandbox) | |
| run: pnpm attw | |
| lint-workflows: | |
| name: Lint workflows (actionlint + zizmor) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Install tools via mise | |
| uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4 | |
| - name: actionlint | |
| run: actionlint | |
| - name: zizmor | |
| run: zizmor .github/workflows | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| # Single, stable required status check. The branch ruleset requires exactly | |
| # one context named "Required"; it aggregates every other job, so it stays | |
| # valid no matter how the matrix or job list changes — 'success' only if all | |
| # passed. Runs in the merge queue (merge_group) too. | |
| Required: | |
| name: Required | |
| if: ${{ always() }} | |
| needs: [build, lint-workflows] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify all jobs succeeded | |
| env: | |
| BUILD_RESULT: ${{ needs.build.result }} | |
| LINT_RESULT: ${{ needs.lint-workflows.result }} | |
| run: | | |
| echo "build=$BUILD_RESULT lint-workflows=$LINT_RESULT" | |
| test "$BUILD_RESULT" = "success" | |
| test "$LINT_RESULT" = "success" |