ci: add a dependency-free license gate and AI security review #110
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_call: | |
| permissions: | |
| contents: read | |
| jobs: | |
| ci: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scan for secrets | |
| env: | |
| # Bump together; checksum from | |
| # https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_checksums.txt | |
| GITLEAKS_VERSION: 8.30.1 | |
| GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tgz | |
| echo "${GITLEAKS_SHA256} /tmp/gitleaks.tgz" | sha256sum -c - | |
| tar xz -C /tmp -f /tmp/gitleaks.tgz | |
| /tmp/gitleaks detect --source . --verbose --redact | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: 'npm' | |
| - name: Check for large files | |
| run: | | |
| LARGE=$(find . -not -path './.git/*' -not -path './node_modules/*' -type f -size +5M) | |
| if [ -n "$LARGE" ]; then | |
| echo "::error::Large files detected (>5 MB):" | |
| echo "$LARGE" | |
| exit 1 | |
| fi | |
| - name: Install dependencies | |
| run: npm ci --ignore-scripts | |
| - name: Audit high-severity vulnerabilities | |
| run: npm audit --audit-level=high | |
| # Reads package-lock.json directly — no extra dependency to install, so | |
| # the license gate itself adds nothing to the supply chain. Currently the | |
| # tree is dev-only (nothing from node_modules ships to Pages), but the | |
| # gate is here so it has teeth the moment you add real dependencies. | |
| - name: Check licenses | |
| run: npm run license:check | |
| # `eslint --cache` writes to .eslintcache at cwd; persist it across | |
| # runs so warm CI lints incrementally instead of rescanning the tree. | |
| - name: Restore ESLint cache | |
| uses: actions/cache@v6 | |
| with: | |
| path: .eslintcache | |
| key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}-${{ hashFiles('src/**/*.js', 'functions/**/*.js', 'tests/**/*.js') }} | |
| restore-keys: | | |
| eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}- | |
| eslint-${{ runner.os }}- | |
| - name: Lint | |
| run: npm run lint | |
| - name: Test | |
| run: npm test | |
| - name: Build contract | |
| run: npm run build |