chore(deps): bump vulnerable transitives (brace-expansion, ws) #182
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| jobs: | |
| lint: | |
| name: Lint & Format | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: biomejs/setup-biome@v2 | |
| with: | |
| version: "2.4.6" | |
| - run: biome ci . | |
| typecheck: | |
| name: Type Check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: "22" | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: actions/cache@v5 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: bun-${{ runner.os }}- | |
| - uses: actions/cache@v5 | |
| with: | |
| path: .turbo | |
| key: turbo-check-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: turbo-check-${{ runner.os }}- | |
| - run: bun install --frozen-lockfile | |
| - name: Run typecheck (affected only on PRs) | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| bunx turbo run check-types --filter='...[origin/main...HEAD]' | |
| else | |
| bunx turbo run check-types | |
| fi | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: "22" | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: actions/cache@v5 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: bun-${{ runner.os }}- | |
| - uses: actions/cache@v5 | |
| with: | |
| path: .turbo | |
| key: turbo-build-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: turbo-build-${{ runner.os }}- | |
| - run: bun install --frozen-lockfile | |
| - run: bunx turbo build | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: "22" | |
| - uses: oven-sh/setup-bun@v2 | |
| - uses: actions/cache@v5 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: bun-${{ runner.os }}- | |
| - uses: actions/cache@v5 | |
| with: | |
| path: .turbo | |
| key: turbo-test-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: turbo-test-${{ runner.os }}- | |
| - run: bun install --frozen-lockfile | |
| - name: Run tests (affected only on PRs) | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| bunx turbo run test --filter='...[origin/main...HEAD]' | |
| else | |
| bunx turbo run test | |
| fi | |
| lockfile: | |
| name: Lockfile Integrity | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Verify lockfile is up to date | |
| run: | | |
| bun install --frozen-lockfile | |
| git diff --exit-code bun.lock || { | |
| echo "::error::bun.lock is out of sync with package.json files. Run 'bun install' and commit the lockfile." | |
| exit 1 | |
| } | |
| actions-lint: | |
| name: Lint GitHub Actions | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: rhysd/actionlint@v1.7.12 | |
| - uses: zizmorcore/zizmor-action@v0.5.2 | |
| with: | |
| config: .zizmor.yml | |
| security: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| - uses: google/osv-scanner-action/osv-scanner-action@v2.3.3 | |
| with: | |
| scan-args: |- | |
| --config=osv-scanner.toml | |
| --lockfile=bun.lock |