Reorganize GitHub Workflows to enable running on PRs (#906)

Author: Lezurex

.github/workflows/code-scan-update-mirror.yml

@@ -0,0 +1,49 @@
+name: Code Scanning
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  njsscan:
+    name: njsscan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@v6
+      - name: nodejsscan scan
+        id: njsscan
+        uses: ajinabraham/njsscan-action@master
+        with:
+          args: ". --sarif --output results.sarif || true"
+      - name: Upload njsscan report
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif
+  codeql:
+    needs: njsscan
+    name: CodeQL
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript"]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+      - name: Set up Nodejs
+        uses: actions/setup-node@v6
+        with:
+          node-version: 26
+          cache: "npm"
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4

.github/workflows/code-scanning.yml

@@ -0,0 +1,39 @@
+name: Mirror to opencode.net and update Flathub commit id
+on:
+  workflow_run:
+    workflows:
+      - "Execute tests"
+    types:
+      - completed
+    branches:
+      - main
+
+jobs:
+  mirror:
+    name: Mirror code to opencode.net
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.conclusion == 'success'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+          fetch-depth: 0
+          fetch-tags: true
+      - name: Push to GitLab mirror
+        run: |
+          git push --force \
+            "https://ransome:${{ secrets.GITLAB_PAT }}@www.opencode.net/ransome/sleek.git" \
+            "HEAD:refs/heads/main" \
+            "refs/tags/*:refs/tags/*"
+  flathub:
+    name: Update commit id in Flathub repo
+    runs-on: ubuntu-latest
+    needs: mirror
+    steps:
+      - name: Trigger Flathub build
+        uses: peter-evans/repository-dispatch@v4
+        with:
+          token: ${{ secrets.TRIGGER_FLATHUB_BUILD }}
+          repository: ransome1/com.github.ransome1.sleek
+          event-type: trigger-flathub-build
+          client-payload: '{"commit_id": "${{ github.event.workflow_run.head_sha }}"}'

.github/workflows/mirror-flathub.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Install Node and NPM
         uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26
           cache: "npm"
       - name: Install and build
         run: |
@@ -47,7 +47,7 @@ jobs:
       - name: Install Node and NPM
         uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26
           cache: "npm"
       - name: Install and build
         run: |
@@ -73,7 +73,7 @@ jobs:
       - name: Install Node and NPM
         uses: actions/setup-node@v6
         with:
-          node-version: 25
+          node-version: 26
           cache: "npm"
       - name: Install and build
         run: |

.github/workflows/prepare-release.yml

@@ -0,0 +1,18 @@
+name: Snyk Dependency Scanning
+on: push
+
+jobs:
+  snyk:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/node@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --sarif-file-output=snyk.sarif
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: snyk.sarif

.github/workflows/snyk.yml

@@ -0,0 +1,37 @@
+name: Execute tests
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  test:
+    name: Run tests and formatting
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      - name: Set up Nodejs
+        uses: actions/setup-node@v6
+        with:
+          node-version: 26
+          cache: "npm"
+      - name: Install dependencies
+        run: npm install
+      - name: Build
+        run: npm run build
+      - name: Check formatting
+        run: npm run format
+      - name: Lint with ESLint
+        run: npm run lint
+      - name: Check TypeScript typings
+        run: npm run typecheck
+      - name: Run unit tests
+        run: npm run coverage
+      - name: Upload coverage reports to Codecov
+        uses: codecov/codecov-action@v7
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}