ci: cache SonarScanner CLI to avoid flaky CDN download #4885
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: build | |
| on: | |
| push: | |
| tags-ignore: | |
| - '**' | |
| branches: | |
| - master | |
| pull_request: | |
| jobs: | |
| yamllint: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6.0.3 | |
| - uses: ibiqlik/action-yamllint@2576378a8e339169678f9939646ee3ee325e845c # v3.1.1 | |
| with: | |
| strict: true | |
| smoke-test: | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| matrix: | |
| node-version: [24, 25] | |
| bun-version: [1.2.23, 1.3.10] | |
| steps: | |
| - uses: actions/checkout@v6.0.3 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: ${{ matrix.bun-version }} | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| - run: bun install --frozen-lockfile | |
| - run: bun run build:linux-amd64 | |
| - run: bin/linux-amd64/gitlab-ci-local --version | |
| - run: bin/linux-amd64/gitlab-ci-local --help | |
| - run: bun run build:node | |
| - run: node dist/index.js --version | |
| - run: node dist/index.js --help | |
| - run: head -1 dist/index.js | grep -q '#!/usr/bin/env node' | |
| typecheck: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6.0.3 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.14 | |
| - run: bun install --frozen-lockfile | |
| - run: bun run typecheck | |
| eslint: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6.0.3 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.14 | |
| - run: bun install --frozen-lockfile | |
| - run: bun run lint | |
| unused-deps: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6.0.3 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.14 | |
| - run: bun install --frozen-lockfile | |
| - run: bunx depcheck --ignores depcheck,@types/bun,@types/bun-types,vitest,@vitest/coverage-v8 | |
| test: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.14 | |
| - run: bun install --frozen-lockfile | |
| - name: Run Tests | |
| run: bun run coverage | |
| # Persist the scanner CLI across runs so the action restores it from cache | |
| # (tc.find short-circuits the download) instead of fetching it from the | |
| # intermittently-403ing binaries.sonarsource.com on every run. | |
| - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| if: ${{ env.SONAR_TOKEN != '' }} | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| with: | |
| path: ${{ runner.tool_cache }}/sonar-scanner-cli | |
| key: sonar-scanner-cli-${{ runner.os }}-${{ runner.arch }}-8.1.0.6389 | |
| - uses: sonarsource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1 | |
| with: | |
| scannerVersion: 8.1.0.6389 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| if: ${{ env.SONAR_TOKEN != '' }} | |
| code-ql: | |
| name: CodeQL | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6.0.3 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4.36.1 | |
| with: | |
| languages: 'typescript' | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v4.36.1 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4.36.1 |