mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-07 17:28:23 +01:00
Garry Tan
042daeee71
Pin every CI surface to Bun 1.4.0 to avoid extra-stdio finalizers closing reused live sockets. Add an isolated GC/listener regression that fails on Bun 1.3.13, and prevent coordinated rollback to an affected CI runtime. Check renderer cleanup against the render's own staging directory so concurrent renders cannot invalidate the assertion. Make the no-pgrep process-tree walk tolerate disappearing /proc entries, and synchronize its test fixture through child readiness and pipe EOF instead of sleeps. Validation: 9,157 passed, 31 skipped, zero failures across 556 files with retries disabled. Build, all-host generation freshness, and skill checks passed. All three races have failing-before/passing-after regressions.
96 lines
3.9 KiB
YAML
96 lines
3.9 KiB
YAML
# Quality gate (fork port wave 2, adapted from time-attack/gstack GStack 2).
|
|
#
|
|
# Three generic hygiene checks the repo previously had nowhere in CI:
|
|
# 1. Credential scan of the PR diff's ADDED lines through our own
|
|
# bin/gstack-redact (HIGH fails the check; MEDIUM is an advisory count —
|
|
# there is no human in CI to confirm, so it never fails here).
|
|
# 2. bun audit at critical severity.
|
|
# 3. ShellCheck (errors only) on the setup/build shell boundary.
|
|
#
|
|
# Trigger is `pull_request`, NEVER `pull_request_target`: fork PRs must not
|
|
# get secret-bearing contexts. Diff excludes cover the planted-bug fixtures
|
|
# and eval baselines that intentionally contain credential-shaped strings.
|
|
name: Quality gate
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: quality-gate-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubicloud-standard-8
|
|
timeout-minutes: 10
|
|
steps:
|
|
# Shallow checkout: fetch-depth:0 cost 74s of a 92s job for checks that
|
|
# take ~12s combined. The one history consumer (the added-lines diff)
|
|
# fetches its exact base/head SHAs below — an exact-SHA fetch, not a
|
|
# guessed depth, so long-lived branches and merge queues still resolve.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
|
|
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
|
|
with:
|
|
bun-version: 1.4.0
|
|
|
|
- name: Install frozen dependencies
|
|
run: bun install --frozen-lockfile --ignore-scripts
|
|
|
|
# Advisory slop scan of branch-changed files. Lived inside `bun run
|
|
# test` before (silently appended, up to 240s invisible in the "~90s
|
|
# suite" claim); decoupling it from the pre-commit loop is only honest
|
|
# if a per-PR path still runs it — this is that path. || true: quality
|
|
# signal, never a gate (/review runs it interactively too).
|
|
- name: Slop scan (changed files, advisory)
|
|
run: bun run slop:diff || true
|
|
|
|
- name: Scan changed text for credentials (added lines, own redact engine)
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Exact-SHA shallow fetches: the checkout above is depth-1 of the
|
|
# merge ref; the diff needs the PR head + base objects specifically.
|
|
git fetch --no-tags --depth=1 origin "$HEAD_SHA" 2>/dev/null || true
|
|
git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null \
|
|
|| git fetch --no-tags --depth=1 origin "$BASE_SHA" 2>/dev/null || true
|
|
if ! git cat-file -e "${BASE_SHA}^{commit}" 2>/dev/null; then
|
|
# push with an unusable `before` (branch create / force push):
|
|
# deepen once so HEAD^ exists as the fallback base.
|
|
git fetch --no-tags --deepen=1 origin 2>/dev/null || true
|
|
BASE_SHA=$(git rev-parse HEAD^)
|
|
fi
|
|
git diff --unified=0 --no-color "$BASE_SHA" "$HEAD_SHA" -- \
|
|
. \
|
|
':(exclude)test/fixtures/**' \
|
|
':(exclude)browse/test/fixtures/**' \
|
|
':(exclude)docs/evals/**' \
|
|
':(exclude)test/helpers/security-bench*' \
|
|
| node .github/scripts/gate-secret-scan.mjs
|
|
|
|
- name: Gate critical dependency advisories
|
|
run: bun audit --audit-level=critical
|
|
|
|
- name: Install ShellCheck
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y shellcheck
|
|
shellcheck --version
|
|
|
|
- name: ShellCheck setup and build boundaries
|
|
run: >-
|
|
shellcheck --severity=error
|
|
setup
|
|
scripts/build.sh
|
|
scripts/build-app.sh
|
|
scripts/write-version-files.sh
|
|
browse/scripts/build-node-server.sh
|