ci: add review app and artifact publish workflow (#1) #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trunk Pipeline | |
| on: | |
| push: | |
| branches: [main] | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| concurrency: | |
| group: trunk-${{ github.sha }} | |
| cancel-in-progress: false | |
| jobs: | |
| config: | |
| name: CI Strategy | |
| runs-on: ubuntu-latest | |
| outputs: | |
| ci-matrix: ${{ steps.ci-matrix.outputs.matrix }} | |
| runner-count: ${{ steps.ci-matrix.outputs.count }} | |
| steps: | |
| # Shallow checkout so GH Actions can resolve local composite actions. | |
| # The setup action re-checks out with full history for moon's affected detection. | |
| # TODO: Remove once composite actions are published to a shared repo. | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - uses: ./.github/actions/setup | |
| - id: ci-matrix | |
| uses: ./.github/actions/moon-ci-matrix | |
| ci: | |
| name: Moon CI | |
| needs: [config] | |
| if: ${{ fromJson(needs.config.outputs.runner-count || '0') > 0 }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| shard: ${{ fromJson(needs.config.outputs.ci-matrix) }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/actions/setup | |
| - uses: ./.github/actions/moon-ci | |
| with: | |
| access-token: ${{ secrets.GITHUB_TOKEN }} | |
| audit: | |
| name: Audit & SCA | |
| needs: [ci] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/actions/setup | |
| - name: Run Moon Audit Tasks (OSV, Cargo, Gitleaks) | |
| run: moon run :audit | |
| codeql: | |
| name: CodeQL | |
| needs: [ci] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/actions/setup | |
| with: | |
| cache-cargo: "false" | |
| cache-pnpm: "false" | |
| - uses: github/codeql-action/init@v3 | |
| with: | |
| languages: javascript | |
| - uses: github/codeql-action/autobuild@v3 | |
| - uses: github/codeql-action/analyze@v3 | |
| release-please: | |
| name: Release Please | |
| needs: [ci, audit, codeql] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - uses: googleapis/release-please-action@v4 | |
| with: | |
| manifest-file: .release-please-manifest.json | |
| config-file: release-please-config.json |