fix(deps): update dependency vite to ^8.3.1 #84
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code | |
| on: | |
| # Comments on a PR's conversation tab arrive as issue_comment events, so this | |
| # trigger is required for PR mentions. The job filter below limits it to PRs. | |
| issue_comment: | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| pull_request_review: | |
| types: [submitted] | |
| # Serialize runs per PR so two mentions never push to the same branch at once. | |
| # Without queue: max, GitHub keeps only one pending run per group and silently | |
| # cancels the rest, so a third mention would get no reply. | |
| concurrency: | |
| group: claude-${{ github.event.issue.number || github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| queue: max | |
| jobs: | |
| # claude-code-action checks out the PR head itself, and for fork PRs it fetches | |
| # refs/pull/N/head. The pnpm scripts allowed in the claude job would then run | |
| # the fork's code with the app token and API key in the environment, so fork | |
| # PRs stop here. Claude could not push to a fork anyway. The issue_comment | |
| # payload has no head-repo info, so this needs an API call rather than an if:. | |
| gate: | |
| # The action itself also refuses actors without write access and blocks bots | |
| # (allowed_bots is unset). This filter avoids spinning up a runner for | |
| # comments that never mention Claude, for bot comments that the action would | |
| # reject anyway (including its own tracking comment), and for GitHub Issues, | |
| # which this repo does not use. | |
| if: | | |
| (github.event_name == 'issue_comment' && github.event.issue.pull_request && github.event.comment.user.type != 'Bot' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && github.event.comment.user.type != 'Bot' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && github.event.review.user.type != 'Bot' && contains(github.event.review.body, '@claude')) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| pull-requests: write | |
| issues: write | |
| outputs: | |
| fork: ${{ steps.check.outputs.fork }} | |
| steps: | |
| - name: Check whether the pull request is from a fork | |
| id: check | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR: ${{ github.event.issue.number || github.event.pull_request.number }} | |
| NOTICE: Claude mentions are disabled on pull requests from forks. Push the branch to this repository to use them. | |
| run: | | |
| set -euo pipefail | |
| pr_json="$(gh pr view "$PR" --repo "$GITHUB_REPOSITORY" --json isCrossRepository,comments)" | |
| is_fork="$(jq -r '.isCrossRepository' <<<"$pr_json")" | |
| # Anything other than an explicit false is a failure. Treating a | |
| # missing or unexpected value as "not a fork" would let the job below | |
| # run when the API call did not actually answer. | |
| if [ "$is_fork" = "false" ]; then | |
| exit 0 | |
| fi | |
| if [ "$is_fork" != "true" ]; then | |
| echo "::error::Unexpected isCrossRepository value: $is_fork" | |
| exit 1 | |
| fi | |
| echo "fork=true" >> "$GITHUB_OUTPUT" | |
| echo "::notice::$NOTICE" | |
| # Post the notice once per PR. Exiting cleanly and not repeating the | |
| # comment means a fork author gains nothing by mentioning Claude again. | |
| if [ "$(jq --arg n "$NOTICE" '[.comments[] | select(.body == $n)] | length' <<<"$pr_json")" = "0" ]; then | |
| gh pr comment "$PR" --repo "$GITHUB_REPOSITORY" --body "$NOTICE" | |
| fi | |
| claude: | |
| needs: gate | |
| # A custom if replaces the default requirement that needed jobs succeeded, so | |
| # this must check the gate's result. Otherwise a skipped gate (a comment that | |
| # never mentioned Claude) would still start this job. | |
| if: needs.gate.result == 'success' && needs.gate.outputs.fork != 'true' | |
| runs-on: ubuntu-latest | |
| # GitHub's default job timeout is 360 minutes (6 hours). Real runs take | |
| # 2 to 7 minutes, so this caps a stuck run's API spend without cutting | |
| # off normal work. | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| id-token: write | |
| actions: read # Lets Claude read CI results on PRs | |
| steps: | |
| - name: Generate GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3 | |
| with: | |
| client-id: ${{ secrets.ECOSPARK_APP_ID }} | |
| private-key: ${{ secrets.ECOSPARK_APP_PRIVATE_KEY }} | |
| # Deliberately checks out the default branch, not the PR head. Checking out a | |
| # PR ref here would trip CodeQL's untrusted-checkout rule for issue_comment | |
| # workflows. The allowed pnpm scripts do run PR code once the action switches | |
| # to the PR branch; the gate job above is what limits that to same-repo PRs. | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 1 | |
| token: ${{ steps.app-token.outputs.token }} | |
| # Installs pnpm and primes the pnpm store so Claude can run the repo's test, | |
| # type check, lint, and fallow commands. Without this the runner has no pnpm. | |
| # These are the default branch's dependencies; the system prompt below has | |
| # Claude reinstall from the PR's lockfile once the action switches branches. | |
| - name: Setup Environment | |
| uses: ./.github/actions/setup | |
| with: | |
| node-version: 22 | |
| - name: Run Claude Code | |
| uses: anthropics/claude-code-action@6b082c41935b4c8a3b8b0ef85ba4ba4d9eeb8975 # v1 | |
| with: | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | |
| github_token: ${{ steps.app-token.outputs.token }} | |
| additional_permissions: | | |
| actions: read | |
| # The action already grants read, edit, and git commit/push tools. This | |
| # adds the repo's own scripts plus read-only gh commands, and nothing | |
| # else. Keep Bash scoped; a bare Bash(*) would let injected PR content | |
| # run arbitrary commands with the app token in the environment. The | |
| # install rule is an exact match on purpose: a prefix rule would also | |
| # allow "pnpm install <any-package>", which runs that package's scripts. | |
| claude_args: | | |
| --append-system-prompt "node_modules in this checkout was installed from the default branch before the switch to the PR branch. Run pnpm install --frozen-lockfile --no-runtime before the first pnpm script you run so dependencies match the lockfile on the PR branch. Keep the --no-runtime flag: without it pnpm downloads a different Node version than this job is pinned to." | |
| --allowedTools "Bash(pnpm install --frozen-lockfile --no-runtime),Bash(pnpm build:*),Bash(pnpm test:*),Bash(pnpm ts:check:*),Bash(pnpm lint:*),Bash(pnpm format:*),Bash(pnpm fallow:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr checks:*),Bash(gh issue view:*)" |