release: v1.3.1 #24
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Cross-SDK parity and asset-drift gate on every push to main and PR. | |
| # Actions pinned to full commit SHAs for supply-chain hardening. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| assets: | |
| name: Asset sync (no drift across SDKs) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 24 | |
| - run: npm ci | |
| - run: npm run assets:check | |
| secret-scan: | |
| name: Secret scan (TruffleHog) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| fetch-depth: 0 # full history so the scanner sees every commit | |
| # TruffleHog installed as a pinned, checksum-verified release binary | |
| # (not a third-party Action), run over full history. | |
| - name: TruffleHog (verified secrets, full history) | |
| env: | |
| TRUFFLEHOG_VERSION: "3.95.6" | |
| run: | | |
| asset="trufflehog_${TRUFFLEHOG_VERSION}_linux_amd64.tar.gz" | |
| base="https://github.com/trufflesecurity/trufflehog/releases/download/v${TRUFFLEHOG_VERSION}" | |
| curl -sSfL "${base}/${asset}" -o "$asset" | |
| curl -sSfL "${base}/trufflehog_${TRUFFLEHOG_VERSION}_checksums.txt" -o checksums.txt | |
| grep " ${asset}$" checksums.txt | sha256sum -c - | |
| tar -xzf "$asset" trufflehog | |
| ./trufflehog git "file://$PWD" --only-verified --fail --no-update | |
| lint: | |
| name: Prettier | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 24 | |
| - run: npm ci | |
| - run: npm run lint | |
| node-sdk: | |
| name: Node SDK (build + test) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 24 | |
| - run: npm ci | |
| - run: npm run build -w packages/sdk | |
| - run: npm test -w packages/sdk | |
| mcp: | |
| name: MCP server (build + test) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 24 | |
| - run: npm ci | |
| - run: npm run build -w packages/sdk | |
| - run: npm run build -w packages/mcp | |
| - run: npm test -w packages/mcp | |
| python-sdk: | |
| name: Python SDK (lint + type + test) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install | |
| working-directory: packages/sdk-py | |
| run: python -m pip install --upgrade pip && pip install -e ".[dev]" | |
| - name: Ruff | |
| working-directory: packages/sdk-py | |
| run: ruff check . && ruff format --check . | |
| - name: Mypy | |
| working-directory: packages/sdk-py | |
| run: mypy src | |
| - name: Pytest | |
| working-directory: packages/sdk-py | |
| run: pytest -q | |
| go-sdk: | |
| name: Go SDK (fmt + vet + test) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version: "1.23" | |
| - name: gofmt | |
| working-directory: packages/sdk-go | |
| run: test -z "$(gofmt -l .)" || (gofmt -l . && exit 1) | |
| - name: go vet | |
| working-directory: packages/sdk-go | |
| run: go vet ./... | |
| - name: go test | |
| working-directory: packages/sdk-go | |
| run: go test ./... | |
| # Catch a broken .goreleaser.yaml on PR, not at the release tag. | |
| - name: goreleaser check | |
| uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 | |
| with: | |
| version: "~> v2" | |
| workdir: packages/sdk-go | |
| args: check | |
| parity: | |
| name: Cross-SDK parity (golden CLI output) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 24 | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 | |
| with: | |
| go-version: "1.23" | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - run: npm ci | |
| # Node, Go, Python CLIs on identical inputs; asserts byte-identical output. | |
| - run: npm run parity | |
| site: | |
| name: Site (build) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 24 | |
| - run: npm ci | |
| - run: npm run build -w leji-site | |
| dogfood: | |
| name: Dogfood (repo conforms to its own spec) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 24 | |
| - run: npm ci | |
| - run: npm run build -w packages/sdk | |
| # Run the reference CLI against this repo's own context layer. | |
| - run: npm run dogfood |