ci: use GitHub App token to push sync branch (workflow files) #15
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Repository CI | |
| on: | |
| pull_request: | |
| # `ready_for_review` is not a default type, so without it marking a draft PR | |
| # ready would not start CI. The jobs below additionally skip while the PR is | |
| # still a draft, so CI only runs once a PR is marked ready for review. | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| concurrency: | |
| group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}' | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| # Skip while the PR is a draft. `test` and `verify` need `build`, so they are | |
| # skipped automatically when this is skipped. | |
| if: github.event.pull_request.draft == false | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| cache: pnpm | |
| node-version-file: '.nvmrc' | |
| - run: pnpm install --frozen-lockfile | |
| env: | |
| PUPPETEER_SKIP_DOWNLOAD: true | |
| # lex-cli code generation can be a bottleneck. The "prebuild" script in | |
| # the "api" and "ozone" packages only re-runs lex-cli when needed: if the | |
| # generated output is missing, or if any lexicon JSON has a newer mtime | |
| # than the generated files. We cache the generated output keyed on the | |
| # content of the lexicon JSONs (plus the package.json files that define | |
| # the codegen command), so unchanged lexicons restore from cache. | |
| # | |
| # However, on a cache hit we have to fix mtimes by hand. | |
| # `actions/checkout` writes every checked-out file (including | |
| # lexicons/**/*.json) with mtime = checkout time, while `actions/cache` | |
| # restores files with their original archived mtime (older). Without | |
| # intervention, every lexicon JSON looks "newer" than the restored | |
| # generated files and the prebuild script would re-run lex-cli even though | |
| # nothing has changed. Touching the restored files brings their mtime to | |
| # "now", so the prebuild's `find -newer` check correctly reports no newer | |
| # lexicons. | |
| - uses: actions/cache@v4 | |
| id: lex-cli-cache | |
| with: | |
| path: | | |
| packages/api/src/client | |
| packages/ozone/src/lexicon | |
| key: lex-cli-${{ hashFiles('lexicons/**/*.json', 'packages/api/package.json', 'packages/ozone/package.json') }} | |
| - if: steps.lex-cli-cache.outputs.cache-hit == 'true' | |
| run: find packages/api/src/client packages/ozone/src/lexicon -exec touch {} + | |
| - run: pnpm build | |
| - uses: actions/upload-artifact@v4 | |
| with: | |
| # Preserve the result of codegen and build steps. | |
| name: dist | |
| retention-days: 2 | |
| path: | | |
| packages/*/dist | |
| packages/*/*/dist | |
| packages/*/src/proto | |
| packages/*/src/lexicons | |
| packages/lex/*/src/lexicons | |
| packages/lex/*/tests/lexicons | |
| packages/oauth/*/src/lexicons | |
| packages/oauth/*/src/locales/*/messages.ts | |
| packages/api/src/client | |
| packages/api/src/moderation/const/labels.ts | |
| packages/ozone/src/lexicon | |
| changeset: | |
| name: Changeset | |
| runs-on: ubuntu-latest | |
| if: false | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # needed for git diff against base branch | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| cache: pnpm | |
| node-version-file: '.nvmrc' | |
| - run: pnpm install --frozen-lockfile | |
| env: | |
| PUPPETEER_SKIP_DOWNLOAD: true | |
| - run: pnpm changeset status --since=origin/${{ github.base_ref }} | |
| test: | |
| name: Test | |
| needs: build | |
| runs-on: ubuntu-22.04 | |
| # Puppeteer does not work in recent Ubuntu versions without a workaround due | |
| # to sandboxing issues. Using "ubuntu-latest" results in the following | |
| # error: | |
| # | |
| # No usable sandbox! If you are running on Ubuntu 23.10+ or another Linux | |
| # distro that has disabled unprivileged user namespaces with AppArmor, see | |
| # https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md. | |
| # Otherwise see | |
| # https://chromium.googlesource.com/chromium/src/+/main/docs/linux/suid_sandbox_development.md | |
| # for more information on developing with the (older) SUID sandbox. If you | |
| # want to live dangerously and need an immediate workaround, you can try | |
| # using --no-sandbox. | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1/8, 2/8, 3/8, 4/8, 5/8, 6/8, 7/8, 8/8] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| cache: pnpm | |
| node-version-file: '.nvmrc' | |
| - run: echo "CURRENT_MONTH=$(date +'%Y-%m')" >> $GITHUB_ENV | |
| - uses: actions/cache@v4 | |
| name: Cache Puppeteer browser binaries | |
| with: | |
| path: ~/.cache/puppeteer | |
| key: ${{ env.CURRENT_MONTH }}-${{ runner.os }}-${{ runner.arch }} | |
| - run: pnpm install --frozen-lockfile | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: dist | |
| path: packages | |
| - run: pnpm test:withFlags --maxWorkers=1 --shard=${{ matrix.shard }} --passWithNoTests | |
| verify: | |
| name: Verify | |
| needs: build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| cache: pnpm | |
| node-version-file: '.nvmrc' | |
| - run: pnpm install --frozen-lockfile | |
| env: | |
| PUPPETEER_SKIP_DOWNLOAD: true | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: dist | |
| path: packages | |
| - run: pnpm verify |