fix(deps): lock file maintenance #4220
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| branches: [main] | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| - ready_for_review | |
| pull_request_target: | |
| branches: [main] | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| - ready_for_review | |
| push: | |
| branches: [main] | |
| issues: | |
| types: | |
| - opened | |
| - reopened | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| # ============================================================================ | |
| # PR Title Lint (Conventional Commits subset) | |
| # ============================================================================ | |
| # Squash-merge uses the PR title as the commit subject and bypasses the | |
| # local enforce-commit pre-commit commit-msg hook (bot PRs never run local | |
| # git hooks). Without a server-side check, a bot title like | |
| # "Sentinel: [HIGH] Fix ..." squash-merges with a non-conventional subject | |
| # -> PSR's commit parser silently ignores it -> no version bump, even for a | |
| # security fix. This job only surfaces a red check; it does not block | |
| # merge (no required-status-check rule), so the person merging still must | |
| # retype the squash-commit subject to start with fix:/feat: when this is red. | |
| pr-title: | |
| name: Validate PR title (Conventional Commits subset) | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pull-requests: read | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| # Repo rule: only feat: and fix: (feedback_commit_prefix.md). This is | |
| # narrower than PSR's own default allowed_tags (which also treats | |
| # perf: as patch-worthy) -- we enforce the project convention here, | |
| # not just what PSR itself would accept. | |
| types: | | |
| fix | |
| feat | |
| requireScope: false | |
| subjectPattern: ^(?![A-Z]).+$ | |
| subjectPatternError: | | |
| The subject must not start with an uppercase character. | |
| lint-and-test: | |
| name: Lint, Test & Build (${{ matrix.os }}) | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Harden Runner | |
| if: matrix.os == 'ubuntu-latest' | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24" | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Run Biome check | |
| run: bun run check | |
| - name: Run tests with coverage | |
| run: bun run test -- --coverage | |
| - name: Upload coverage to Codecov | |
| if: github.event_name == 'push' && matrix.os == 'ubuntu-latest' | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| files: coverage/lcov.info | |
| - name: Run live MCP protocol test (stdio handshake + tools/list) | |
| run: bun run test:live | |
| dependency-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: moderate | |
| comment-summary-in-pr: always | |
| email-notify: | |
| name: Email Notification | |
| if: >- | |
| (github.event_name == 'issues' || github.event_name == 'pull_request_target') | |
| && github.actor != 'n24q02m' | |
| && github.event.sender.type != 'Bot' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - name: Parse SMTP credential | |
| run: | | |
| echo "SMTP_USER=${SMTP_CREDENTIAL%%:*}" >> $GITHUB_ENV | |
| echo "SMTP_PASS=${SMTP_CREDENTIAL#*:}" >> $GITHUB_ENV | |
| env: | |
| SMTP_CREDENTIAL: ${{ secrets.SMTP_CREDENTIAL }} | |
| - name: Send email notification | |
| uses: dawidd6/action-send-mail@94de994a9f6fffee200243214e17002e2920bb59 # v18 | |
| with: | |
| server_address: smtp.gmail.com | |
| server_port: 587 | |
| username: ${{ env.SMTP_USER }} | |
| password: ${{ env.SMTP_PASS }} | |
| subject: >- | |
| [${{ github.event.repository.name }}] | |
| ${{ github.event_name == 'issues' && 'Issue' || 'PR' }} | |
| #${{ github.event.issue.number || github.event.pull_request.number }}: | |
| ${{ github.event.issue.title || github.event.pull_request.title }} | |
| to: ${{ env.SMTP_USER }} | |
| from: GitHub Notify <${{ env.SMTP_USER }}> | |
| body: | | |
| ${{ github.event_name == 'issues' && 'New issue' || 'New pull request' }} in ${{ github.repository }} | |
| Title: ${{ github.event.issue.title || github.event.pull_request.title }} | |
| Author: ${{ github.actor }} | |
| URL: ${{ github.event.issue.html_url || github.event.pull_request.html_url }} | |
| Action: ${{ github.event.action }} | |
| --- | |
| ${{ github.event.issue.body || github.event.pull_request.body || 'No description provided.' }} |