mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-21 04:10:47 +02:00
80 lines
2.5 KiB
YAML
80 lines
2.5 KiB
YAML
name: Release quality gate
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: quality-gate-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
|
|
with:
|
|
bun-version: 1.3.14
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
|
with:
|
|
node-version: 22.23.1
|
|
|
|
- name: Install frozen dependencies
|
|
run: bun install --frozen-lockfile --ignore-scripts
|
|
|
|
- name: Release and package contract tests
|
|
run: bun run check:release
|
|
|
|
- name: Scan changed production text for credentials
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
|
|
BASE_SHA=$(git rev-parse HEAD^)
|
|
fi
|
|
git diff --unified=0 --no-color "$BASE_SHA" "$HEAD_SHA" -- \
|
|
. \
|
|
':(exclude)test/**' \
|
|
':(exclude)evals/**' \
|
|
':(exclude)outputs/**' \
|
|
':(exclude)lib/diagram-render/dist/**' \
|
|
':(exclude)skills/*/references/support/**' \
|
|
':(exclude)docs/gstack-2/BACKLOG-MAP.json' \
|
|
| node .github/scripts/gate-secret-scan.mjs
|
|
|
|
- name: Pack, install, and invoke the npm runtime-control package
|
|
run: node .github/scripts/smoke-packed-package.mjs "$GITHUB_WORKSPACE"
|
|
|
|
- name: Gate critical dependency advisories
|
|
run: bun audit --audit-level=critical
|
|
|
|
- name: Syntax-check runtime JavaScript
|
|
run: find runtime -type f \( -name '*.js' -o -name '*.mjs' \) -print0 | xargs -0 -n1 node --check
|
|
|
|
- name: Install ShellCheck
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y shellcheck=0.9.0-1
|
|
shellcheck --version
|
|
|
|
- name: ShellCheck release and setup boundaries
|
|
run: >-
|
|
shellcheck --severity=error
|
|
setup
|
|
scripts/build.sh
|
|
scripts/write-version-files.sh
|
|
scripts/gstack2/runtime-install-smoke.sh
|
|
browse/scripts/build-node-server.sh
|