ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 in the actions group … #303
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI CI | |
| on: | |
| push: | |
| branches: [ dev, production ] | |
| pull_request: | |
| # `production` is included so the dev→production promotion PR is also gated | |
| # by lint/typecheck/build (and is required by the production ruleset). | |
| branches: [ dev, production ] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (full history) | |
| uses: actions/checkout@v7 | |
| with: | |
| # Full history so gitleaks scans every commit, not just the tip. | |
| fetch-depth: 0 | |
| - name: Run gitleaks | |
| env: | |
| # Pinned release; bump deliberately. Run the binary directly rather than | |
| # gitleaks/gitleaks-action@v2, which requires a paid GITLEAKS_LICENSE for | |
| # organization-owned repos. | |
| GITLEAKS_VERSION: 8.30.1 | |
| run: | | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz gitleaks | |
| # --log-opts=HEAD scopes the scan to commits reachable from what's | |
| # checked out: the whole history of this branch (or of the PR merge | |
| # commit, i.e. base + PR commits), but NOT unrelated branches. | |
| # `fetch-depth: 0` fetches refs/heads/* — every branch — and gitleaks | |
| # otherwise scans all of them, so an open branch that legitimately | |
| # commits a high-entropy value plus its own .gitleaks.toml allowlist | |
| # would fail every OTHER branch's scan, which is judged against the | |
| # allowlist at its own tip. Each branch is still fully scanned by its | |
| # own PR, and pushes to dev/production scan their full history. | |
| ./gitleaks git . --redact --verbose --no-banner --log-opts=HEAD | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| # The mock-api lives in the private devicecloud-dev/dcd repo, checked out via an | |
| # SSH deploy key. GitHub does NOT expose secrets to pull_request workflows | |
| # triggered from forks, so that checkout (and the integration tests that need | |
| # it) can only run for same-repo events. Fork PRs still run lint/typecheck/build. | |
| # | |
| # Dependabot PRs branch from this repo (so the fork check passes) but ALSO run | |
| # without secrets — treat them like forks and skip the private checkout, or | |
| # the mock-api clone fails with an empty DCD_SSH_DEPLOY_KEY. | |
| env: | |
| HAS_PRIVATE_ACCESS: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && github.actor != 'dependabot[bot]' }} | |
| steps: | |
| - name: Checkout CLI | |
| uses: actions/checkout@v7 | |
| with: | |
| path: cli | |
| - name: Checkout dcd (mock-api) | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: devicecloud-dev/dcd | |
| path: dcd | |
| ssh-key: ${{ secrets.DCD_SSH_DEPLOY_KEY }} | |
| # api/swagger.json is a file, which cone-mode sparse checkout rejects | |
| # as of git 2.51 ("is not a directory") — use non-cone patterns. | |
| sparse-checkout-cone-mode: false | |
| sparse-checkout: | | |
| /mock-api/ | |
| /api/swagger.json | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6.0.10 | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: 'pnpm' | |
| cache-dependency-path: './cli/pnpm-lock.yaml' | |
| - name: Install CLI dependencies | |
| working-directory: ./cli | |
| run: pnpm install --frozen-lockfile | |
| - name: Install Mock API dependencies | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| working-directory: ./dcd/mock-api | |
| run: pnpm install --frozen-lockfile | |
| - name: Run CLI linter | |
| working-directory: ./cli | |
| run: pnpm lint | |
| - name: Type check (strict, src + tests) | |
| working-directory: ./cli | |
| run: pnpm typecheck | |
| - name: Run CLI tests | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| working-directory: ./cli | |
| env: | |
| MOCK_API_DIR: ${{ github.workspace }}/dcd/mock-api | |
| run: pnpm test | |
| - name: Skip integration tests (fork PR — no mock-api access) | |
| if: env.HAS_PRIVATE_ACCESS != 'true' | |
| run: echo "::notice::Integration tests skipped — the mock-api (private devicecloud-dev/dcd) is not accessible from fork PRs. Lint, typecheck, and build still ran." | |
| - name: Build CLI | |
| working-directory: ./cli | |
| run: pnpm build | |
| - name: Security audit | |
| working-directory: ./cli | |
| run: pnpm audit --audit-level moderate |