fix(deps): update dependency @astrojs/starlight to ^0.41.0 #90
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, dev] | |
| pull_request: | |
| branches: [main, dev] | |
| jobs: | |
| check: | |
| name: Lint, Type-check & Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Download fonts | |
| run: bun run fonts:download | |
| - name: Lint | |
| run: bun run lint | |
| - name: Type-check | |
| run: bun run type-check | |
| - name: Test | |
| run: bun run test | |
| env: | |
| AUTH_ENABLED: "false" | |
| publish-sdk: | |
| name: Publish SDK to GitHub Packages | |
| runs-on: ubuntu-latest | |
| needs: check | |
| if: github.ref == 'refs/heads/dev' && github.event_name == 'push' | |
| permissions: | |
| contents: read | |
| packages: write | |
| defaults: | |
| run: | |
| working-directory: sdk | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| registry-url: https://npm.pkg.github.com | |
| scope: '@atypical-consulting' | |
| - name: Install dependencies | |
| run: bun install | |
| - name: Build SDK | |
| run: bun run build | |
| - name: Check if version is already published | |
| id: version-check | |
| run: | | |
| PACKAGE_NAME=$(node -p "require('./package.json').name") | |
| PACKAGE_VERSION=$(node -p "require('./package.json').version") | |
| if npm view "${PACKAGE_NAME}@${PACKAGE_VERSION}" version 2>/dev/null; then | |
| echo "published=true" >> "$GITHUB_OUTPUT" | |
| echo "Version ${PACKAGE_VERSION} already published — skipping" | |
| else | |
| echo "published=false" >> "$GITHUB_OUTPUT" | |
| echo "Version ${PACKAGE_VERSION} not yet published — will publish" | |
| fi | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Publish to GitHub Packages | |
| if: steps.version-check.outputs.published == 'false' | |
| run: npm publish | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| scan: | |
| name: Security Scan (Trivy + SARIF) | |
| runs-on: ubuntu-latest | |
| needs: check | |
| permissions: | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Build Docker image for scanning | |
| run: docker build -t og-engine:scan . | |
| - name: Scan image for vulnerabilities (table) | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: og-engine:scan | |
| format: table | |
| exit-code: '1' | |
| severity: CRITICAL,HIGH | |
| output: vuln-report.txt | |
| continue-on-error: true | |
| - name: Generate SARIF report | |
| uses: aquasecurity/trivy-action@master | |
| if: always() | |
| with: | |
| image-ref: og-engine:scan | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: CRITICAL,HIGH | |
| - name: Upload SARIF to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: trivy-results.sarif | |
| category: trivy | |
| - name: Upload scan report | |
| uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: security-scan-report | |
| path: vuln-report.txt | |
| retention-days: 30 | |
| deploy: | |
| name: Deploy to Fly.io | |
| runs-on: ubuntu-latest | |
| needs: check | |
| if: github.ref == 'refs/heads/dev' && github.event_name == 'push' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: superfly/flyctl-actions/setup-flyctl@master | |
| - name: Deploy to Fly.io | |
| run: flyctl deploy --remote-only | |
| env: | |
| FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }} |