Skip to content

Commit 57895f0

Browse files
tomymaritanoclaude
tomymaritano
and
claude
authored
chore(ci): workflow surface cleanup (Phase 0 B-bundle) (#292)
## Summary Phase 0 B-bundle of the post-audit roadmap. Six independent fixes batched into one PR because they all touch the workflow YAML surface and reviewing them together is faster than three ping-pong PRs that all conflict on the same files. ## docs.yml | Change | Why | |---|---| | \`pnpm install\` → \`pnpm install --filter '@readied/web...' --ignore-scripts\` | Marketing-site install was the last workflow still firing apps/desktop's \`electron-builder install-app-deps\` step that fails on Linux + Node 22. Same shape as #287 (deploy-api) and #288 (release). | | Added \`permissions: contents: read\` | Cloudflare Pages deploy doesn't need anything beyond checkout | | Build step moved into \`working-directory: apps/web\` | Was inline \`cd apps/web && ...\` — explicit working-directory reads better | ## build.yml | Change | Why | |---|---| | \`windows-latest\` → \`windows-2025-vs2026\` | GitHub announced \`windows-latest\` migration to that image on **2026-06-15** (6 days from this commit). Pinning ahead avoids a surprise toolchain swap mid-release. | | Removed \`FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true\` env | This was the migration toggle for the Node 20→24 actions rollout. With all actions now on @v5 (Node 24-native) it's no-op. | | Artifact upload \`if-no-files-found: ignore\` → \`error\` | Silent zero-asset releases are worse than a failed upload. If electron-builder swallowed an error, signing failed, working-directory drifted, etc., we want loud failure here, not a release un-drafted with no installers. | ## release.yml | Change | Why | |---|---| | Removed \`HUSKY: '0'\` env | Leftover from the husky → lefthook migration in #267. Lefthook only reads .git/hooks if those files exist; on fresh CI clones they don't. | ## deploy-api.yml | Change | Why | |---|---| | Added \`permissions: contents: read\` | Cloudflare deploy doesn't push commits or create issues; minimum-privilege default. | ## Action versions sweep (all 8 workflows) | From | To | |---|---| | \`actions/checkout@v4\` | \`@v5\` | | \`actions/setup-node@v4\` | \`@v5\` | | \`actions/cache@v4\` | \`@v5\` | | \`actions/cache/save@v4\` | \`@v5\` | | \`actions/cache/restore@v4\` | \`@v5\` | | \`actions/upload-artifact@v4\` | \`@v5\` | GitHub announced Node 20-based actions deprecation on **2026-06-16** (7 days from this commit). The \`@v5\` family runs on Node 24. ## Verification - ✅ \`pnpm -r typecheck\` — green - ✅ \`pnpm test\` — 17/17 (untouched) - ✅ YAML parsed locally; no syntax errors ## Stack context Phase 0 B-bundle. Pairs with #290 (A1 electron pin) and #291 (A2 bump-version). Independent files, can land in any order. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent f5adb62 commit 57895f0

6 files changed

Lines changed: 69 additions & 45 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ env:
1313
NODE_VERSION: '22'
1414
ELECTRON_CACHE: ~/.cache/electron
1515
ELECTRON_BUILDER_CACHE: ~/.cache/electron-builder
16-
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
1716

1817
jobs:
1918
build:
@@ -23,7 +22,10 @@ jobs:
2322
include:
2423
- os: macos-14
2524
platform: mac
26-
- os: windows-latest
25+
# Pin Windows runner explicitly. `windows-latest` migrates to
26+
# `windows-2025-vs2026` on 2026-06-15; pinning ahead avoids a
27+
# surprise toolchain swap mid-release. Revisit on each new GA.
28+
- os: windows-2025-vs2026
2729
platform: win
2830
- os: ubuntu-latest
2931
platform: linux
@@ -32,7 +34,7 @@ jobs:
3234

3335
steps:
3436
- name: Checkout tag
35-
uses: actions/checkout@v4
37+
uses: actions/checkout@v5
3638
with:
3739
ref: ${{ github.ref }}
3840
fetch-depth: 0
@@ -41,20 +43,20 @@ jobs:
4143
uses: pnpm/action-setup@v5
4244

4345
- name: Setup Node.js
44-
uses: actions/setup-node@v4
46+
uses: actions/setup-node@v5
4547
with:
4648
node-version: ${{ env.NODE_VERSION }}
4749
cache: 'pnpm'
4850

4951
- name: Cache pnpm store
50-
uses: actions/cache@v4
52+
uses: actions/cache@v5
5153
with:
5254
path: ~/.pnpm-store
5355
key: pnpm-${{ matrix.platform }}-${{ hashFiles('pnpm-lock.yaml') }}
5456
restore-keys: pnpm-${{ matrix.platform }}-
5557

5658
- name: Cache Electron downloads
57-
uses: actions/cache@v4
59+
uses: actions/cache@v5
5860
with:
5961
path: ${{ env.ELECTRON_CACHE }}
6062
key: electron-v3-${{ matrix.platform }}-${{ hashFiles('apps/desktop/package.json') }}
@@ -105,7 +107,7 @@ jobs:
105107
run: pnpm dist:linux --publish always
106108

107109
- name: Upload artifacts (backup)
108-
uses: actions/upload-artifact@v4
110+
uses: actions/upload-artifact@v5
109111
with:
110112
name: ${{ matrix.platform }}-build
111113
path: |
@@ -116,7 +118,11 @@ jobs:
116118
apps/desktop/release/*.deb
117119
apps/desktop/release/latest*.yml
118120
apps/desktop/release/*.blockmap
119-
if-no-files-found: ignore
121+
# `error` (was `ignore`) — if the build silently produced zero
122+
# artefacts (signing failure, electron-builder swallowed an
123+
# error, wrong working-directory, etc.) we want the job to fail
124+
# loud here, not let the release un-draft with no installers.
125+
if-no-files-found: error
120126
retention-days: 30
121127

122128
publish:

‎.github/workflows/ci.yml‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,13 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Checkout
22-
uses: actions/checkout@v4
22+
uses: actions/checkout@v5
2323

2424
- name: Setup pnpm
2525
uses: pnpm/action-setup@v5
2626

2727
- name: Setup Node.js
28-
uses: actions/setup-node@v4
28+
uses: actions/setup-node@v5
2929
with:
3030
node-version: ${{ env.NODE_VERSION }}
3131
cache: 'pnpm'
@@ -44,7 +44,7 @@ jobs:
4444
run: pnpm install --frozen-lockfile --ignore-scripts
4545

4646
- name: Cache node_modules
47-
uses: actions/cache/save@v4
47+
uses: actions/cache/save@v5
4848
with:
4949
path: |
5050
node_modules
@@ -57,14 +57,14 @@ jobs:
5757
needs: setup
5858
runs-on: ubuntu-latest
5959
steps:
60-
- uses: actions/checkout@v4
60+
- uses: actions/checkout@v5
6161
- uses: pnpm/action-setup@v5
62-
- uses: actions/setup-node@v4
62+
- uses: actions/setup-node@v5
6363
with:
6464
node-version: ${{ env.NODE_VERSION }}
6565

6666
- name: Restore node_modules
67-
uses: actions/cache/restore@v4
67+
uses: actions/cache/restore@v5
6868
with:
6969
path: |
7070
node_modules
@@ -87,14 +87,14 @@ jobs:
8787
needs: setup
8888
runs-on: ubuntu-latest
8989
steps:
90-
- uses: actions/checkout@v4
90+
- uses: actions/checkout@v5
9191
- uses: pnpm/action-setup@v5
92-
- uses: actions/setup-node@v4
92+
- uses: actions/setup-node@v5
9393
with:
9494
node-version: ${{ env.NODE_VERSION }}
9595

9696
- name: Restore node_modules
97-
uses: actions/cache/restore@v4
97+
uses: actions/cache/restore@v5
9898
with:
9999
path: |
100100
node_modules
@@ -110,7 +110,7 @@ jobs:
110110

111111
- name: Upload coverage
112112
if: always()
113-
uses: actions/upload-artifact@v4
113+
uses: actions/upload-artifact@v5
114114
with:
115115
name: coverage-report
116116
path: |
@@ -123,14 +123,14 @@ jobs:
123123
needs: setup
124124
runs-on: ubuntu-latest
125125
steps:
126-
- uses: actions/checkout@v4
126+
- uses: actions/checkout@v5
127127
- uses: pnpm/action-setup@v5
128-
- uses: actions/setup-node@v4
128+
- uses: actions/setup-node@v5
129129
with:
130130
node-version: ${{ env.NODE_VERSION }}
131131

132132
- name: Restore node_modules
133-
uses: actions/cache/restore@v4
133+
uses: actions/cache/restore@v5
134134
with:
135135
path: |
136136
node_modules
@@ -156,14 +156,14 @@ jobs:
156156
runs-on: ubuntu-latest
157157
continue-on-error: true
158158
steps:
159-
- uses: actions/checkout@v4
159+
- uses: actions/checkout@v5
160160
- uses: pnpm/action-setup@v5
161-
- uses: actions/setup-node@v4
161+
- uses: actions/setup-node@v5
162162
with:
163163
node-version: ${{ env.NODE_VERSION }}
164164

165165
- name: Restore node_modules
166-
uses: actions/cache/restore@v4
166+
uses: actions/cache/restore@v5
167167
with:
168168
path: |
169169
node_modules
@@ -186,7 +186,7 @@ jobs:
186186

187187
- name: Upload Playwright report on failure
188188
if: failure()
189-
uses: actions/upload-artifact@v4
189+
uses: actions/upload-artifact@v5
190190
with:
191191
name: playwright-report
192192
path: apps/desktop/playwright-report/
@@ -197,14 +197,14 @@ jobs:
197197
needs: setup
198198
runs-on: ubuntu-latest
199199
steps:
200-
- uses: actions/checkout@v4
200+
- uses: actions/checkout@v5
201201
- uses: pnpm/action-setup@v5
202-
- uses: actions/setup-node@v4
202+
- uses: actions/setup-node@v5
203203
with:
204204
node-version: ${{ env.NODE_VERSION }}
205205

206206
- name: Restore node_modules
207-
uses: actions/cache/restore@v4
207+
uses: actions/cache/restore@v5
208208
with:
209209
path: |
210210
node_modules
@@ -225,14 +225,14 @@ jobs:
225225
runs-on: ubuntu-latest
226226
if: github.event_name == 'pull_request'
227227
steps:
228-
- uses: actions/checkout@v4
228+
- uses: actions/checkout@v5
229229
- uses: pnpm/action-setup@v5
230-
- uses: actions/setup-node@v4
230+
- uses: actions/setup-node@v5
231231
with:
232232
node-version: ${{ env.NODE_VERSION }}
233233

234234
- name: Restore node_modules
235-
uses: actions/cache/restore@v4
235+
uses: actions/cache/restore@v5
236236
with:
237237
path: |
238238
node_modules

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
security-events: write
2121
steps:
2222
- name: Checkout
23-
uses: actions/checkout@v4
23+
uses: actions/checkout@v5
2424

2525
- name: Initialize CodeQL
2626
uses: github/codeql-action/init@v4

‎.github/workflows/deploy-api.yml‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,23 @@ on:
1717
- staging
1818
- production
1919

20+
# Minimum-privilege default. The Cloudflare deploy doesn't push commits
21+
# or create issues; checkout + read of the workflow definition is all
22+
# the GITHUB_TOKEN side needs. Wrangler authenticates via the
23+
# CLOUDFLARE_API_TOKEN secret separately.
24+
permissions:
25+
contents: read
26+
2027
jobs:
2128
test:
2229
name: Test API
2330
runs-on: ubuntu-latest
2431
steps:
25-
- uses: actions/checkout@v4
32+
- uses: actions/checkout@v5
2633

2734
- uses: pnpm/action-setup@v5
2835

29-
- uses: actions/setup-node@v4
36+
- uses: actions/setup-node@v5
3037
with:
3138
node-version: '22'
3239
cache: 'pnpm'
@@ -49,11 +56,11 @@ jobs:
4956
needs: test
5057
runs-on: ubuntu-latest
5158
steps:
52-
- uses: actions/checkout@v4
59+
- uses: actions/checkout@v5
5360

5461
- uses: pnpm/action-setup@v5
5562

56-
- uses: actions/setup-node@v4
63+
- uses: actions/setup-node@v5
5764
with:
5865
node-version: '22'
5966
cache: 'pnpm'

‎.github/workflows/docs.yml‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,31 +9,39 @@ on:
99
- '.github/workflows/docs.yml'
1010
workflow_dispatch:
1111

12+
permissions:
13+
contents: read
14+
1215
jobs:
1316
deploy:
1417
runs-on: ubuntu-latest
1518
steps:
16-
- uses: actions/checkout@v4
19+
- uses: actions/checkout@v5
1720

1821
- uses: pnpm/action-setup@v5
1922

20-
- uses: actions/setup-node@v4
23+
- uses: actions/setup-node@v5
2124
with:
2225
node-version: '22'
2326
cache: 'pnpm'
2427

2528
- name: Force HTTPS for GitHub git dependencies
2629
run: git config --global 'url.https://github.com/.insteadOf' 'git@github.com:'
2730

28-
- run: pnpm install
31+
# Marketing site only needs @readied/web + product-config's transitive
32+
# deps. Plain `pnpm install` would also run apps/desktop's postinstall
33+
# (electron-builder install-app-deps -> better-sqlite3 native rebuild),
34+
# which fails on the Linux + Node 22 runner. See #287 for the
35+
# deploy-api workflow and #288 for release.yml — same fix shape.
36+
- run: pnpm install --filter '@readied/web...' --ignore-scripts
2937

3038
- name: Build web app
39+
working-directory: apps/web
40+
env:
41+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3142
run: |
32-
cd apps/web
3343
pnpm exec fumadocs-mdx
3444
pnpm exec next build
35-
env:
36-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3745
3846
- name: Deploy to Cloudflare Pages
3947
env:

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
if: github.ref == 'refs/heads/main'
1919
steps:
2020
- name: Checkout
21-
uses: actions/checkout@v4
21+
uses: actions/checkout@v5
2222
with:
2323
fetch-depth: 0
2424
token: ${{ secrets.GH_TOKEN }}
@@ -27,7 +27,7 @@ jobs:
2727
uses: pnpm/action-setup@v5
2828

2929
- name: Setup Node.js
30-
uses: actions/setup-node@v4
30+
uses: actions/setup-node@v5
3131
with:
3232
node-version: '22'
3333
cache: 'pnpm'
@@ -68,10 +68,13 @@ jobs:
6868
exit 1
6969
fi
7070
71+
# HUSKY: '0' was leftover from the husky->lefthook migration in #267
72+
# (kept hooks from firing inside the workflow's commit step). Lefthook
73+
# only reads .git/hooks if those files exist, and they don't on a
74+
# fresh CI clone, so the env var is no longer needed.
7175
- name: Run semantic-release
7276
env:
7377
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
74-
HUSKY: '0'
7578
GIT_AUTHOR_NAME: github-actions[bot]
7679
GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
7780
GIT_COMMITTER_NAME: github-actions[bot]

0 commit comments

Comments
 (0)