Measure a worktree against where it lands, not the repo default (SPEC-51) #356
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Server Security + Lint CI | |
| on: | |
| push: | |
| branches: [ main ] | |
| paths: | |
| - 'server/**' | |
| - '.github/workflows/server-ci.yml' | |
| pull_request: | |
| branches: [ main ] | |
| paths: | |
| - 'server/**' | |
| - '.github/workflows/server-ci.yml' | |
| jobs: | |
| lint-and-typecheck: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: server | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '22' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Prepare pnpm | |
| run: corepack prepare pnpm@11.8.0 --activate | |
| - name: Cache pnpm store | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.local/share/pnpm/store | |
| key: ${{ runner.os }}-pnpm-${{ hashFiles('server/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm- | |
| - name: Install dependencies (lockfile-locked) | |
| run: pnpm secure:install | |
| - name: Run typecheck | |
| run: pnpm typecheck | |
| - name: Build | |
| run: pnpm build | |
| - name: Verify pnpm-lock.yaml integrity | |
| run: | | |
| if ! git diff --exit-code pnpm-lock.yaml > /dev/null; then | |
| echo "ERROR: pnpm-lock.yaml would be modified by pnpm install" | |
| echo "This indicates a lockfile inconsistency or manual edit." | |
| echo "Run: pnpm install && git add pnpm-lock.yaml" | |
| exit 1 | |
| fi | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: server | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '22' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Prepare pnpm | |
| run: corepack prepare pnpm@11.8.0 --activate | |
| - name: Cache pnpm store | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.local/share/pnpm/store | |
| key: ${{ runner.os }}-pnpm-${{ hashFiles('server/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm- | |
| - name: Install dependencies | |
| run: pnpm secure:install | |
| - name: Run tests | |
| run: pnpm test | |
| security-audit: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| defaults: | |
| run: | |
| working-directory: server | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '22' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Prepare pnpm | |
| run: corepack prepare pnpm@11.8.0 --activate | |
| - name: Cache pnpm store | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.local/share/pnpm/store | |
| key: ${{ runner.os }}-pnpm-${{ hashFiles('server/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm- | |
| - name: Install dependencies | |
| run: pnpm secure:install | |
| - name: Audit production dependencies | |
| run: pnpm secure:audit |