Repository navigation
Bump the "monthly-maintenance" group with 2 updates across multiple ecosystems #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Actions are pinned to commit SHAs rather than tags. A tag is mutable: whoever | |
| # controls the action repository can repoint it at different code. Dependabot is | |
| # configured to bump these pins, so the maintenance cost is a review, not a chore. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify: | |
| name: Lint, typecheck, test, build | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: ['22', '24'] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node ${{ matrix.node-version }} | |
| uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: npm | |
| - name: Install clean packages | |
| run: npm clean-install | |
| - name: Lint | |
| run: npm run lint | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Unit tests | |
| run: npm run test -- --run | |
| - name: Build | |
| run: npm run build | |
| - name: Report bundle size | |
| run: | | |
| { | |
| echo "### Bundle size" | |
| echo '```' | |
| du -sh dist | |
| find dist -name '*.js' -exec sh -c 'printf "%s bytes gzipped %s\n" "$(gzip -c "$1" | wc -c)" "$1"' _ {} \; \ | |
| | sort -rn | head -10 | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Upload build output | |
| if: matrix.node-version == '22' | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | |
| with: | |
| name: dist | |
| path: dist | |
| retention-days: 7 | |
| dependency-review: | |
| name: Dependency review | |
| runs-on: ubuntu-24.04 | |
| if: github.event_name == 'pull_request' | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # Blocks a pull request that introduces a known-vulnerable dependency or a | |
| # license incompatible with Apache-2.0 redistribution. | |
| - name: Review dependency changes | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: high | |
| deny-licenses: AGPL-3.0, GPL-2.0, GPL-3.0, LGPL-2.1, LGPL-3.0, SSPL-1.0 | |
| comment-summary-in-pr: on-failure | |
| audit: | |
| name: Dependency audit | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node LTS | |
| uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| - name: Install clean packages | |
| run: npm clean-install | |
| # Fails on high and critical advisories only. Moderate and below are | |
| # reported but do not block, to keep the signal actionable. | |
| - name: Audit | |
| run: npm audit --audit-level=high |