chore(deps): bump actions/checkout from 6 to 7 #634
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Least-privilege token: we only need to clone + upload artifacts. A | |
| # default install token has broader write scopes we don't consume, | |
| # so explicitly narrow to read + the actions scope for upload/download. | |
| permissions: | |
| contents: read | |
| actions: write | |
| jobs: | |
| build-daemon: | |
| name: Build Daemon (.NET) | |
| runs-on: windows-latest | |
| # Build+test+publish typically ~4m; 25m catches a hang (e.g. NuGet | |
| # restore DNS timeout, runaway xunit test) well before GH's default 6h. | |
| timeout-minutes: 25 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup .NET 9 | |
| uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: '9.0.x' | |
| - name: Cache NuGet packages | |
| uses: actions/cache@v5 | |
| with: | |
| path: ~/.nuget/packages | |
| key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} | |
| restore-keys: | | |
| nuget-${{ runner.os }}- | |
| - name: Restore dependencies | |
| run: dotnet restore WebDevConsole.sln | |
| - name: Build | |
| run: dotnet build WebDevConsole.sln --no-restore -c Release | |
| - name: Test | |
| run: dotnet test WebDevConsole.sln -c Release --verbosity normal | |
| - name: Publish Daemon | |
| # CiBuild=true swaps app.manifest (requireAdministrator) for | |
| # app.ci.manifest (asInvoker). Release workflow (build.yml) omits | |
| # this flag so shipped installers keep the UAC-at-launch model. | |
| run: dotnet publish src/daemon/NKS.WebDevConsole.Daemon -c Release -r win-x64 --self-contained -o publish/daemon -p:CiBuild=true | |
| - name: Publish CLI | |
| run: dotnet publish src/daemon/NKS.WebDevConsole.Cli -c Release -r win-x64 --self-contained -o publish/cli | |
| - name: Upload Daemon artifact | |
| uses: actions/upload-artifact@v5 | |
| with: | |
| name: daemon-win-x64 | |
| path: publish/daemon/ | |
| retention-days: 14 | |
| - name: Upload CLI artifact | |
| uses: actions/upload-artifact@v5 | |
| with: | |
| name: cli-win-x64 | |
| path: publish/cli/ | |
| retention-days: 14 | |
| build-frontend: | |
| name: Build Frontend (Electron) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '24' | |
| - name: Cache npm dependencies | |
| uses: actions/cache@v5 | |
| with: | |
| path: src/frontend/node_modules | |
| key: npm-${{ runner.os }}-${{ hashFiles('src/frontend/package-lock.json') }} | |
| restore-keys: | | |
| npm-${{ runner.os }}- | |
| - name: Install dependencies | |
| working-directory: src/frontend | |
| run: npm ci | |
| - name: Type check (vue-tsc) | |
| working-directory: src/frontend | |
| run: npm run type-check | |
| - name: Build | |
| working-directory: src/frontend | |
| run: npm run build | |
| - name: Upload frontend artifact | |
| uses: actions/upload-artifact@v5 | |
| with: | |
| name: frontend-out | |
| path: src/frontend/dist-electron/ | |
| retention-days: 14 | |
| package: | |
| name: Package Electron Installer | |
| runs-on: windows-latest | |
| needs: [build-daemon, build-frontend] | |
| if: github.event_name == 'push' | |
| # electron-builder + smoke typically ~6m; 25m allows for a slow npm ci | |
| # or an occasional nsis packer stall on hosted runners. | |
| timeout-minutes: 25 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js 24 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '24' | |
| - name: Download daemon artifact | |
| uses: actions/download-artifact@v5 | |
| with: | |
| name: daemon-win-x64 | |
| path: src/frontend/resources/daemon | |
| - name: Install frontend dependencies | |
| working-directory: src/frontend | |
| run: npm ci | |
| - name: Build renderer and main process bundles | |
| working-directory: src/frontend | |
| run: npm run build | |
| # Pull prebuilt plugin DLLs from nks-hub/webdev-console-plugins | |
| # releases before packaging. Plugin sources left this monorepo | |
| # when src/plugins was removed; stage-plugins.mjs is the only | |
| # path that gets DLLs into resources/daemon/plugins on a CI | |
| # runner that has no sibling plugins-repo checkout. GITHUB_TOKEN | |
| # is passed so the anonymous-rate-limit on unauth'd release API | |
| # calls doesn't trip a packed matrix of concurrent runs. | |
| - name: Stage plugin DLLs from plugins repo releases | |
| working-directory: src/frontend | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: node ../../scripts/stage-plugins.mjs | |
| - name: Build Electron installer | |
| working-directory: src/frontend | |
| # CI builds on every push just verify the packaged installer builds and | |
| # passes the smoke step — they must NEVER touch GitHub releases. Real | |
| # release publishing is owned by .github/workflows/build.yml on tag | |
| # push (softprops/action-gh-release). `--publish never` short-circuits | |
| # electron-builder's auto-publish path and GH_TOKEN is intentionally | |
| # omitted so the builder has no credentials to race the tag job. | |
| # Previously this step tried to upload assets to the existing v0.1.61 | |
| # release and hit 403 "Resource not accessible by integration" because | |
| # the push-triggered GITHUB_TOKEN has no releases: write scope. | |
| # CLI override --config.win.requestedExecutionLevel=asInvoker drops | |
| # the UAC manifest just for this smoke build so headless runners | |
| # can launch the packaged app. Release workflow (build.yml) omits | |
| # the override → shipped installers keep requireAdministrator. | |
| # (Short -c form doesn't parse nested keys — needs --config.<path>.) | |
| run: npx electron-builder --config electron-builder.yml --win --publish never --config.win.requestedExecutionLevel=asInvoker | |
| - name: Verify release artifacts | |
| run: node scripts/verify-electron-release.mjs --dir src/frontend/release --target win | |
| - name: Smoke packaged Electron runtime | |
| working-directory: src/frontend | |
| run: npm run smoke:packaged:win | |
| - name: Upload installer artifact | |
| uses: actions/upload-artifact@v5 | |
| with: | |
| name: installer-win-x64 | |
| path: src/frontend/release/ | |
| retention-days: 30 | |
| # Cross-repo validation: clone nks-hub/webdev-console-plugins as a | |
| # sibling checkout, pack the LOCAL SDK csproj (this branch, not the | |
| # last published tag) into .local-nuget, rewrite nuget.config to pull | |
| # the SDK from that folder, and build every plugin. Catches drift | |
| # between SDK surface changes in this repo and the plugin csprojs | |
| # consuming them, without waiting for a new v* tag + publish-sdk | |
| # workflow. Non-blocking (continue-on-error) so a plugins-repo glitch | |
| # doesn't red-line the monorepo pipeline. | |
| cross-repo-plugins: | |
| name: Cross-repo plugin build | |
| runs-on: ubuntu-latest | |
| needs: build-daemon | |
| continue-on-error: true | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| path: nks-ws | |
| - uses: actions/checkout@v7 | |
| with: | |
| repository: nks-hub/webdev-console-plugins | |
| path: webdev-console-plugins | |
| - uses: actions/setup-dotnet@v5 | |
| with: | |
| dotnet-version: '9.0.x' | |
| - name: Pack local SDK + Core | |
| working-directory: nks-ws | |
| run: | | |
| # Plugin.SDK PackageReferences Core, so the plugins' restore | |
| # needs both in the local feed — otherwise NU1101 on Core even | |
| # when SDK is present. | |
| dotnet pack src/daemon/NKS.WebDevConsole.Core/NKS.WebDevConsole.Core.csproj \ | |
| -c Release -p:PackageVersion=0.0.0-ci.${{ github.run_id }} \ | |
| -o "$GITHUB_WORKSPACE/.local-nuget" | |
| dotnet pack src/daemon/NKS.WebDevConsole.Plugin.SDK/NKS.WebDevConsole.Plugin.SDK.csproj \ | |
| -c Release -p:PackageVersion=0.0.0-ci.${{ github.run_id }} \ | |
| -o "$GITHUB_WORKSPACE/.local-nuget" | |
| ls -la "$GITHUB_WORKSPACE/.local-nuget" | |
| - name: Point plugins repo at local feed | |
| working-directory: webdev-console-plugins | |
| run: | | |
| cat > nuget.config <<EOF | |
| <?xml version="1.0" encoding="utf-8"?> | |
| <configuration> | |
| <packageSources> | |
| <clear /> | |
| <add key="nuget.org" value="https://api.nuget.org/v3/index.json" /> | |
| <add key="local-sdk" value="$GITHUB_WORKSPACE/.local-nuget" /> | |
| </packageSources> | |
| </configuration> | |
| EOF | |
| # Pin the SDK PackageReference to this run's CI-packaged version. | |
| # In the plugins repo the version actually lives in | |
| # Directory.Build.props (one central PackageReference inherited by | |
| # every plugin csproj), not in individual csprojs — so rewriting | |
| # just the csprojs leaves the 0.1.82 inherited from the props | |
| # file, which the local feed can't resolve. Rewrite both for | |
| # safety in case the scheme changes again. | |
| for f in Directory.Build.props NKS.WebDevConsole.Plugin.*/*.csproj; do | |
| [ -f "$f" ] || continue | |
| sed -i 's|\("NKS.WebDevConsole.Plugin.SDK" Version=\)"[^"]*"|\1"0.0.0-ci.${{ github.run_id }}"|' "$f" || true | |
| done | |
| - name: Restore + build every plugin | |
| working-directory: webdev-console-plugins | |
| run: | | |
| set -e | |
| for proj in NKS.WebDevConsole.Plugin.*/*.csproj; do | |
| echo "::group::build $proj" | |
| dotnet build "$proj" -c Release | |
| echo "::endgroup::" | |
| done |