This repository was archived by the owner on Jun 14, 2026. It is now read-only.
Bump the workflow-actions group across 1 directory with 12 updates #42
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| actions: read | |
| jobs: | |
| prepare: | |
| name: Prepare | |
| runs-on: ubuntu-24.04-arm | |
| timeout-minutes: 5 | |
| outputs: | |
| # Per-surface filter outputs, passed as `with:` inputs to reusables. | |
| rust: ${{ steps.filter.outputs.rust }} | |
| ts: ${{ steps.filter.outputs.ts }} | |
| landing: ${{ steps.filter.outputs.landing }} | |
| web: ${{ steps.filter.outputs.web }} | |
| api: ${{ steps.filter.outputs.api }} | |
| embedding: ${{ steps.filter.outputs.embedding }} | |
| docker: ${{ steps.filter.outputs.docker }} | |
| workflows: ${{ steps.filter.outputs.workflows }} | |
| terraform: ${{ steps.filter.outputs.terraform }} | |
| shell: ${{ steps.filter.outputs.shell }} | |
| markdown: ${{ steps.filter.outputs.markdown }} | |
| openapi: ${{ steps.filter.outputs.openapi }} | |
| astro: ${{ steps.filter.outputs.astro }} | |
| lint_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.shell == 'true' || steps.filter.outputs.markdown == 'true' || steps.filter.outputs.terraform == 'true' || steps.filter.outputs.astro == 'true' || steps.filter.outputs.openapi == 'true' || steps.filter.outputs.workflows == 'true' }} | |
| type_check_needed: ${{ steps.filter.outputs.ts == 'true' || steps.filter.outputs.workflows == 'true' }} | |
| unit_test_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.shell == 'true' || steps.filter.outputs.workflows == 'true' }} | |
| integration_test_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.workflows == 'true' }} | |
| security_audit_needed: ${{ steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true' || steps.filter.outputs.workflows == 'true' }} | |
| lhci_needed: ${{ steps.filter.outputs.landing == 'true' || steps.filter.outputs.workflows == 'true' }} | |
| docker_build_needed: ${{ (steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true') && github.event.pull_request.head.repo.full_name == github.repository }} | |
| e2e_test_needed: ${{ (steps.filter.outputs.rust == 'true' || steps.filter.outputs.ts == 'true' || steps.filter.outputs.docker == 'true') && github.event.pull_request.head.repo.full_name == github.repository }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Per-surface inclusions | |
| id: filter | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| with: | |
| # dorny/paths-filter evaluates each list entry as an independent | |
| # picomatch pattern and OR's the results, so a standalone negation | |
| # like '!**/*.md' fires as a positive match on every non-`.md` file. | |
| # Embed the negation as an extglob suffix on the parent path instead | |
| # so it constrains that one pattern's filename match. | |
| filters: | | |
| rust: | |
| - 'apps/api/**/!(*.md|*.mdx)' | |
| - 'apps/embedding_service/**/!(*.md|*.mdx)' | |
| - 'apps/so_tag_sync/**/!(*.md|*.mdx)' | |
| - 'integrations/**' | |
| - 'Cargo.toml' | |
| - 'Cargo.lock' | |
| ts: | |
| - 'apps/web/**/!(*.md|*.mdx)' | |
| - 'apps/landing/**/!(*.md|*.mdx)' | |
| - 'packages/**/!(*.md|*.mdx)' | |
| - 'apps/api/openapi.json' | |
| - 'package.json' | |
| - 'bun.lock' | |
| - 'bunfig.toml' | |
| - 'turbo.json' | |
| landing: | |
| - 'apps/landing/**/!(*.md|*.mdx)' | |
| web: | |
| - 'apps/web/**/!(*.md|*.mdx)' | |
| api: | |
| - 'apps/api/**/!(*.md|*.mdx)' | |
| embedding: | |
| - 'apps/embedding_service/**/!(*.md|*.mdx)' | |
| docker: | |
| - 'docker-compose.yml' | |
| - 'apps/*/Dockerfile' | |
| - 'infra/docker/**/!(*.md|*.mdx)' | |
| workflows: | |
| - '.github/workflows/**/!(*.md|*.mdx)' | |
| - '.github/actions/**/!(*.md|*.mdx)' | |
| terraform: | |
| - 'terraform/**' | |
| - '**/*.tf' | |
| - '**/*.tftpl' | |
| shell: | |
| - '**/*.sh' | |
| - 'scripts/**' | |
| markdown: | |
| - '**/*.md' | |
| - '**/*.mdx' | |
| openapi: | |
| - 'apps/api/openapi.json' | |
| astro: | |
| - 'apps/landing/**/*.astro' | |
| lint: | |
| needs: prepare | |
| if: needs.prepare.outputs.lint_needed == 'true' | |
| uses: ./.github/workflows/lint.yml | |
| with: | |
| rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| shell: ${{ needs.prepare.outputs.shell == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| markdown: ${{ needs.prepare.outputs.markdown == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| terraform: ${{ needs.prepare.outputs.terraform == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| astro: ${{ needs.prepare.outputs.astro == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| openapi: ${{ needs.prepare.outputs.openapi == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| workflows: ${{ needs.prepare.outputs.workflows == 'true' }} | |
| secrets: inherit | |
| type_check: | |
| needs: prepare | |
| if: needs.prepare.outputs.type_check_needed == 'true' | |
| uses: ./.github/workflows/type_check.yml | |
| with: | |
| ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| secrets: inherit | |
| unit_test: | |
| needs: prepare | |
| if: needs.prepare.outputs.unit_test_needed == 'true' | |
| uses: ./.github/workflows/unit_test.yml | |
| with: | |
| rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| shell: ${{ needs.prepare.outputs.shell == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| secrets: inherit | |
| integration_test: | |
| needs: prepare | |
| if: needs.prepare.outputs.integration_test_needed == 'true' | |
| uses: ./.github/workflows/integration_test.yml | |
| with: | |
| rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| secrets: inherit | |
| security_audit: | |
| needs: prepare | |
| if: needs.prepare.outputs.security_audit_needed == 'true' | |
| uses: ./.github/workflows/security_audit.yml | |
| with: | |
| rust: ${{ needs.prepare.outputs.rust == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| ts: ${{ needs.prepare.outputs.ts == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| docker: ${{ needs.prepare.outputs.docker == 'true' || needs.prepare.outputs.workflows == 'true' }} | |
| secrets: inherit | |
| lhci: | |
| needs: prepare | |
| if: needs.prepare.outputs.lhci_needed == 'true' | |
| uses: ./.github/workflows/lhci.yml | |
| secrets: inherit | |
| # Same-repo only: forks cannot write to GHCR via `secrets.GITHUB_TOKEN`. | |
| docker_build: | |
| needs: [ prepare, lint, type_check, unit_test, integration_test, security_audit ] | |
| if: needs.prepare.outputs.docker_build_needed == 'true' | |
| # Job-level permissions override the workflow-level ceiling so the called | |
| # reusable can declare `packages: write` without it being capped to `none`. | |
| permissions: | |
| contents: read | |
| packages: write | |
| uses: ./.github/workflows/docker_build.yml | |
| secrets: inherit | |
| # Same-repo only: forks cannot pull from GHCR via `secrets.GITHUB_TOKEN`. | |
| e2e_test: | |
| needs: [ prepare, docker_build ] | |
| if: needs.prepare.outputs.e2e_test_needed == 'true' | |
| permissions: | |
| contents: read | |
| packages: read | |
| uses: ./.github/workflows/e2e_test.yml | |
| secrets: inherit | |
| required: | |
| name: Required | |
| needs: [ prepare, lint, type_check, unit_test, integration_test, security_audit, lhci, docker_build, e2e_test ] | |
| if: always() | |
| runs-on: ubuntu-24.04-arm | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Fail if conditional jobs failed | |
| if: | | |
| needs.prepare.result != 'success' || | |
| (needs.prepare.outputs.lint_needed == 'true' && needs.lint.result != 'success') || | |
| (needs.prepare.outputs.type_check_needed == 'true' && needs.type_check.result != 'success') || | |
| (needs.prepare.outputs.unit_test_needed == 'true' && needs.unit_test.result != 'success') || | |
| (needs.prepare.outputs.integration_test_needed == 'true' && needs.integration_test.result != 'success') || | |
| (needs.prepare.outputs.security_audit_needed == 'true' && needs.security_audit.result != 'success') || | |
| (needs.prepare.outputs.lhci_needed == 'true' && needs.lhci.result != 'success') || | |
| (needs.prepare.outputs.docker_build_needed == 'true' && needs.docker_build.result != 'success') || | |
| (needs.prepare.outputs.e2e_test_needed == 'true' && needs.e2e_test.result != 'success') | |
| run: exit 1 |