mzizi/.github/workflows/ci.yml at main · nyuchi/mzizi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Top-level default keeps the entire workflow read-only. Each job
# re-declares its own permissions so CodeQL
# (`actions/missing-workflow-permissions`) is satisfied per-job.
permissions:
  contents: read

# Job names below are the BARE names ("Build", "Lint", "Test",
# "Type Check", "Security Audit", "Registry Snapshot") because the
# org-wide branch-protection rule on `main` requires CI checks under
# their bare names. NB: this is the OPPOSITE convention from
# `.github/workflows/lint.yml`, which requires "lint / *" prefixed
# names. The asymmetry is intentional at the org level — see CLAUDE.md
# §14 "Org-wide required checks" for the authoritative table of
# required check names per workflow.

jobs:
  audit:
    name: Security Audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # --ignore-registry-errors keeps CI green when npmjs.org's audit
      # endpoint is degraded (the "quick" endpoint was retired in April 2026;
      # pnpm 10.x still calls it). Remove once pnpm ships a fix.
      - run: pnpm audit --audit-level=moderate --ignore-registry-errors

  registry:
    name: Registry Snapshot
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Verify registry.json matches Supabase
        env:
          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
        if: env.NEXT_PUBLIC_SUPABASE_URL != ''
        run: pnpm registry:verify

  lint:
    name: Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint
      - name: Format check
        run: pnpm exec prettier --check "**/*.{ts,tsx,js,mjs,json,md,css,yaml,yml}" --ignore-path .prettierignore

  typecheck:
    name: Type Check
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm typecheck

  test:
    name: Test
    runs-on: ubuntu-latest
    # Tests depend on the code being structurally sound — no point burning
    # runner minutes on `pnpm test` if eslint or tsc already failed.
    needs: [lint, typecheck]
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm test

  build:
    name: Build
    runs-on: ubuntu-latest
    # Build is the terminal gate — runs only when every other CI job
    # has finished successfully. Order in `needs:` is: structural
    # (lint, typecheck) → behavioural (test) → integrity (audit,
    # registry). Adding a job above? Add it here too so build still
    # gates everything.
    needs: [audit, lint, typecheck, test, registry]
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 22
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build