mirror of
https://github.com/garrytan/gstack.git
synced 2026-08-31 18:30:39 +02:00
Garry TanandClaude Fable 5
2e693a5918
'bun run test' silently appended up to two 120s npx slop-scan runs plus a git worktree add/remove after the suite (2>/dev/null || true) — invisible in the documented '~90-100s' timing and pure friction in the pre-commit loop. Decoupling is not coverage removal: quality-gate.yml now runs slop:diff on every PR (advisory, matching its in-repo 'never blocking' contract), and /review already invokes it explicitly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
96 lines
3.9 KiB
YAML
96 lines
3.9 KiB
YAML
# Quality gate (fork port wave 2, adapted from time-attack/gstack GStack 2).
|
|
#
|
|
# Three generic hygiene checks the repo previously had nowhere in CI:
|
|
# 1. Credential scan of the PR diff's ADDED lines through our own
|
|
# bin/gstack-redact (HIGH fails the check; MEDIUM is an advisory count —
|
|
# there is no human in CI to confirm, so it never fails here).
|
|
# 2. bun audit at critical severity.
|
|
# 3. ShellCheck (errors only) on the setup/build shell boundary.
|
|
#
|
|
# Trigger is `pull_request`, NEVER `pull_request_target`: fork PRs must not
|
|
# get secret-bearing contexts. Diff excludes cover the planted-bug fixtures
|
|
# and eval baselines that intentionally contain credential-shaped strings.
|
|
name: Quality gate
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: quality-gate-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubicloud-standard-8
|
|
timeout-minutes: 10
|
|
steps:
|
|
# Shallow checkout: fetch-depth:0 cost 74s of a 92s job for checks that
|
|
# take ~12s combined. The one history consumer (the added-lines diff)
|
|
# fetches its exact base/head SHAs below — an exact-SHA fetch, not a
|
|
# guessed depth, so long-lived branches and merge queues still resolve.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
|
|
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
|
|
with:
|
|
bun-version: 1.3.13
|
|
|
|
- name: Install frozen dependencies
|
|
run: bun install --frozen-lockfile --ignore-scripts
|
|
|
|
# Advisory slop scan of branch-changed files. Lived inside `bun run
|
|
# test` before (silently appended, up to 240s invisible in the "~90s
|
|
# suite" claim); decoupling it from the pre-commit loop is only honest
|
|
# if a per-PR path still runs it — this is that path. || true: quality
|
|
# signal, never a gate (/review runs it interactively too).
|
|
- name: Slop scan (changed files, advisory)
|
|
run: bun run slop:diff || true
|
|
|
|
- name: Scan changed text for credentials (added lines, own redact engine)
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Exact-SHA shallow fetches: the checkout above is depth-1 of the
|
|
# merge ref; the diff needs the PR head + base objects specifically.
|
|
git fetch --no-tags --depth=1 origin "$HEAD_SHA" 2>/dev/null || true
|
|
git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null \
|
|
|| git fetch --no-tags --depth=1 origin "$BASE_SHA" 2>/dev/null || true
|
|
if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
|
|
# push with an unusable `before` (branch create / force push):
|
|
# deepen once so HEAD^ exists as the fallback base.
|
|
git fetch --no-tags --deepen=1 origin 2>/dev/null || true
|
|
BASE_SHA=$(git rev-parse HEAD^)
|
|
fi
|
|
git diff --unified=0 --no-color "$BASE_SHA" "$HEAD_SHA" -- \
|
|
. \
|
|
':(exclude)test/fixtures/**' \
|
|
':(exclude)browse/test/fixtures/**' \
|
|
':(exclude)docs/evals/**' \
|
|
':(exclude)test/helpers/security-bench*' \
|
|
| node .github/scripts/gate-secret-scan.mjs
|
|
|
|
- name: Gate critical dependency advisories
|
|
run: bun audit --audit-level=critical
|
|
|
|
- name: Install ShellCheck
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y shellcheck
|
|
shellcheck --version
|
|
|
|
- name: ShellCheck setup and build boundaries
|
|
run: >-
|
|
shellcheck --severity=error
|
|
setup
|
|
scripts/build.sh
|
|
scripts/build-app.sh
|
|
scripts/write-version-files.sh
|
|
browse/scripts/build-node-server.sh
|