CyberCoveandClaude Sonnet 5.5
3f2be6fab0
- Lockfile-only/overrides bumps within the same major for vulnerable transitive build/test tooling (see pnpm-overrides.md) - electron 42.0.1 -> 42.11.12 (same major) for runtime advisories - .gitea/workflows/ci.yml: single job (build admin, tests, audit) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
85 lines
3.0 KiB
YAML
85 lines
3.0 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags-ignore: ["**"]
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "41 5 * * *" # nightly: dependency audit + full test run
|
|
|
|
# One job on purpose: the shared runner pool is small, so everything runs
|
|
# sequentially on a single runner instead of a matrix.
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 90
|
|
env:
|
|
CI: "true"
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
|
|
- name: install pnpm
|
|
run: |
|
|
npm install -g pnpm@10.33.3
|
|
pnpm --version
|
|
|
|
- name: install dependencies
|
|
# Lifecycle scripts are skipped: the desktop postinstall compiles
|
|
# electron-app native modules, which the admin build and ember tests
|
|
# do not need.
|
|
run: pnpm install --frozen-lockfile --ignore-scripts
|
|
|
|
- name: install headless chrome
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
if ! command -v google-chrome >/dev/null 2>&1; then
|
|
SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
|
|
$SUDO apt-get update -qq || true
|
|
$SUDO apt-get install -y -qq --no-install-recommends \
|
|
libnss3 libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libgbm1 \
|
|
libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
|
|
libpango-1.0-0 libcairo2 libx11-6 libxcb1 libxext6 fonts-liberation \
|
|
|| true
|
|
$SUDO apt-get install -y -qq --no-install-recommends libasound2t64 \
|
|
|| $SUDO apt-get install -y -qq --no-install-recommends libasound2 || true
|
|
npx --yes @puppeteer/browsers@2 install chrome@stable --path "$RUNNER_TEMP/chrome"
|
|
CHROME_BIN=$(find "$RUNNER_TEMP/chrome" -type f -name chrome -perm -u+x | head -n 1)
|
|
mkdir -p "$HOME/bin"
|
|
ln -sf "$CHROME_BIN" "$HOME/bin/google-chrome"
|
|
echo "$HOME/bin" >> "$GITHUB_PATH"
|
|
fi
|
|
"${HOME}/bin/google-chrome" --version 2>/dev/null || google-chrome --version
|
|
|
|
- name: build admin ui
|
|
run: pnpm --filter admin build
|
|
|
|
- name: test addons
|
|
run: |
|
|
for a in core auth rose; do
|
|
echo "::group::addons/$a"
|
|
(cd addons/$a && npx ember test --test-port 0)
|
|
echo "::endgroup::"
|
|
done
|
|
echo "::group::addons/api"
|
|
(cd addons/api && npx ember exam --test-port 0 --split=4 --parallel=1)
|
|
echo "::endgroup::"
|
|
|
|
- name: test desktop ui
|
|
run: cd ui/desktop && npx ember test --test-port 0
|
|
|
|
- name: test admin ui
|
|
run: cd ui/admin && npx ember exam --test-port 0 --split=4 --parallel=1
|
|
|
|
- name: dependency audit
|
|
# Fails on critical advisories only; remaining high/moderate advisories
|
|
# are build/test tooling and are tracked in pnpm-overrides.md.
|
|
run: |
|
|
pnpm audit --audit-level=critical
|
|
(cd ui/desktop/electron-app && pnpm audit --audit-level=critical)
|