log cleanup #22
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: MDK Core CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "core/**" | |
| - ".github/workflows/core.yaml" | |
| - ".github/scripts/**" | |
| pull_request: | |
| branches: [main] | |
| types: [opened, reopened, synchronize] | |
| paths: | |
| - "core/**" | |
| - ".github/workflows/core.yaml" | |
| - ".github/scripts/**" | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| NODE_VERSION: "lts/*" | |
| CORE_DIR: core | |
| jobs: | |
| dependency-review: | |
| name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| with: | |
| fail-on-severity: moderate | |
| vulnerability-check: true | |
| license-check: true | |
| comment-summary-in-pr: always | |
| core-setup: | |
| name: Core Setup Dependencies | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: ${{ env.CORE_DIR }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup runtime | |
| uses: ./.github/actions/setup-runtime | |
| with: | |
| node_version: ${{ env.NODE_VERSION }} | |
| package_manager: npm | |
| cache_dependency_path: ${{ env.CORE_DIR }}/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| core-lint: | |
| name: Core Lint | |
| runs-on: ubuntu-latest | |
| needs: [core-setup] | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: ${{ env.CORE_DIR }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup runtime | |
| uses: ./.github/actions/setup-runtime | |
| with: | |
| node_version: ${{ env.NODE_VERSION }} | |
| package_manager: npm | |
| cache_dependency_path: ${{ env.CORE_DIR }}/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint | |
| continue-on-error: true | |
| run: npm run lint --if-present | |
| core-typecheck: | |
| name: Core Typecheck | |
| runs-on: ubuntu-latest | |
| needs: [core-setup] | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: ${{ env.CORE_DIR }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup runtime | |
| uses: ./.github/actions/setup-runtime | |
| with: | |
| node_version: ${{ env.NODE_VERSION }} | |
| package_manager: npm | |
| cache_dependency_path: ${{ env.CORE_DIR }}/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Typecheck | |
| run: npm run typecheck --if-present | |
| core-test: | |
| name: Core Test | |
| runs-on: ubuntu-latest | |
| needs: [core-setup] | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: ${{ env.CORE_DIR }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup runtime | |
| uses: ./.github/actions/setup-runtime | |
| with: | |
| node_version: ${{ env.NODE_VERSION }} | |
| package_manager: npm | |
| cache_dependency_path: ${{ env.CORE_DIR }}/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Test with coverage | |
| run: npm run test:coverage --if-present || npm test --if-present | |
| - name: Enforce coverage threshold (>=80%) | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| MIN=80 | |
| if [ -f coverage/coverage-final.json ]; then | |
| rm -rf .nyc_output | |
| mkdir -p .nyc_output | |
| cp coverage/coverage-final.json .nyc_output/out.json | |
| set +e | |
| echo "Running nyc check-coverage (threshold ${MIN}%)..." | |
| npx --yes nyc check-coverage --lines=$MIN --statements=$MIN --functions=$MIN --branches=$MIN | |
| EXIT=$? | |
| set -e | |
| echo "Running nyc report (text-summary)..." | |
| NYC_REPORT="$(npx --yes nyc report --reporter=text-summary 2>&1)" | |
| echo "$NYC_REPORT" | |
| STMT=$(echo "$NYC_REPORT" | sed -n 's/^Statements[^:]*: *\([0-9.]*\)%.*/\1/p') | |
| BRANCH=$(echo "$NYC_REPORT" | sed -n 's/^Branches[^:]*: *\([0-9.]*\)%.*/\1/p') | |
| FN=$(echo "$NYC_REPORT" | sed -n 's/^Functions[^:]*: *\([0-9.]*\)%.*/\1/p') | |
| LINES=$(echo "$NYC_REPORT" | sed -n 's/^Lines[^:]*: *\([0-9.]*\)%.*/\1/p') | |
| [ -z "$STMT" ] && STMT="—"; [ -z "$BRANCH" ] && BRANCH="—"; [ -z "$FN" ] && FN="—"; [ -z "$LINES" ] && LINES="—" | |
| [ $EXIT -eq 0 ] && ICON="✅ PASS" || ICON="❌ FAIL" | |
| SRC="coverage-final.json" | |
| { | |
| echo "## Core Coverage Summary" | |
| echo "" | |
| echo "| Scope | Status | Threshold | Statements | Branches | Functions | Lines | Source | Gate |" | |
| echo "|---|---|---:|---:|---:|---:|---:|---|---|" | |
| echo "| Core | ${ICON} | ${MIN}% | ${STMT}% | ${BRANCH}% | ${FN}% | ${LINES}% | ${SRC} | NYC check-coverage |" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| exit $EXIT | |
| else | |
| echo "::error::No coverage report found (expected coverage-final.json)." | |
| exit 1 | |
| fi | |
| core-build: | |
| name: Core Build | |
| runs-on: ubuntu-latest | |
| needs: [core-setup] | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| working-directory: ${{ env.CORE_DIR }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Setup runtime | |
| uses: ./.github/actions/setup-runtime | |
| with: | |
| node_version: ${{ env.NODE_VERSION }} | |
| package_manager: npm | |
| cache_dependency_path: ${{ env.CORE_DIR }}/package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lockfile consistency check | |
| continue-on-error: true | |
| run: | | |
| npm install --package-lock-only --no-audit --no-fund | |
| git diff --exit-code package-lock.json || ( | |
| echo "::error::package-lock.json is out of sync with package.json. Run 'npm install' and commit the updated lockfile." | |
| exit 1 | |
| ) | |
| - name: Security audit | |
| run: | | |
| set +e | |
| npm audit signatures 2>&1 | |
| SIGNATURES_EXIT=$? | |
| npm audit --audit-level=moderate 2>&1 | |
| MODERATE_EXIT=$? | |
| npm exec --yes -- audit-ci@7 --config audit-ci.jsonc 2>&1 | |
| HIGH_EXIT=$? | |
| set -e | |
| [ $SIGNATURES_EXIT -eq 0 ] && SIGNATURES_STATUS="PASS" || SIGNATURES_STATUS="WARN" | |
| [ $MODERATE_EXIT -eq 0 ] && MODERATE_STATUS="PASS" || MODERATE_STATUS="WARN" | |
| [ $HIGH_EXIT -eq 0 ] && HIGH_STATUS="PASS" || HIGH_STATUS="WARN" | |
| AUD_JSON="${RUNNER_TEMP:-/tmp}/mdk-core-npm-audit.json" | |
| npm audit --json > "${AUD_JSON}" 2>/dev/null || true | |
| { | |
| echo "## Core Security Audit Summary" | |
| echo "" | |
| echo "| Scope | Signatures Audit | Moderate Audit | High/Critical (audit-ci) | Gate |" | |
| echo "|---|---|---|---|---|" | |
| echo "| Core | ${SIGNATURES_STATUS} | ${MODERATE_STATUS} | ${HIGH_STATUS} | High/Critical (audit-ci + allowlist) |" | |
| echo "" | |
| echo "High/Critical gate uses \`audit-ci\` with \`core/audit-ci.jsonc\` (allowlists GHSA-wvh9-3hgj-7f22 for internal \`tether-wrk-base\` from git)." | |
| echo "" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| bash "${GITHUB_WORKSPACE}/.github/scripts/github-summary-npm-audit-high-critical.sh" "${AUD_JSON}" >> "$GITHUB_STEP_SUMMARY" || true | |
| { | |
| echo "" | |
| echo "**Note:** Package rows are from **\`npm audit --json\`**. Job success still depends on **audit-ci** (\`audit-ci.jsonc\`); allowlisted GHSA IDs may remain listed." | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| if [ $SIGNATURES_EXIT -ne 0 ]; then | |
| echo "::warning::npm audit signatures reported issues" | |
| fi | |
| if [ $MODERATE_EXIT -ne 0 ]; then | |
| echo "::warning::npm audit reported moderate-level issues" | |
| fi | |
| if [ $HIGH_EXIT -ne 0 ]; then | |
| echo "::error::audit-ci reported high/critical issues (see core/audit-ci.jsonc allowlist)" | |
| fi | |
| [ $HIGH_EXIT -eq 0 ] | |
| - name: Build | |
| run: npm run build --if-present |