deps(deps-dev): bump postcss from 8.5.18 to 8.5.19 #6632
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Keiko for Quality — the CANONICAL execution shell since the ADR-0142 cutover (2026-07-19). | |
| # The Cloudflare Worker (cron, webhook secret, D1) is retired; rollback = `wrangler deploy` from | |
| # infrastructure/keiko-for-quality/ plus reverting the identity env block below. | |
| # | |
| # Trust split (ADR-0142 D3): the authoritative `evaluate` job runs only when the executing | |
| # definition is the default branch's own — check_run / issue_comment always are, and a manual | |
| # workflow_dispatch is accepted only from the `dev` ref (job-level ref pin below) — so | |
| # pull-request code can never alter the definition that holds write permissions and App auth. | |
| # The `pull_request`-triggered `preview` job runs the pull's own copy and is therefore untrusted: | |
| # read-only, dry-run, no App credentials, and its implicit job token carries read-only | |
| # permissions, so pull-controlled code can neither exfiltrate publishing credentials nor publish | |
| # any identity. | |
| name: Keiko for Quality (Action) | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, labeled] | |
| branches: | |
| - dev | |
| check_run: | |
| types: [completed] | |
| issue_comment: | |
| types: [created, edited] | |
| workflow_dispatch: | |
| inputs: | |
| pr: | |
| description: "Pull request number to evaluate" | |
| required: true | |
| type: string | |
| permissions: {} | |
| jobs: | |
| # Authoritative path: default-branch-defined triggers only. Pull-request code cannot alter this | |
| # definition, so it is safe to hold write permissions and App auth here. | |
| evaluate: | |
| name: Evaluate quality aggregate | |
| # Never runs for pull_request. Skip comment events on plain issues (only pull-request comments | |
| # carry review evidence). The ref pin closes the workflow_dispatch gap: a manual dispatch from | |
| # any non-default ref would execute that ref's workflow definition, so the privileged job runs | |
| # only when the definition is the default branch's own. | |
| if: >- | |
| github.event_name != 'pull_request' && | |
| (github.event_name != 'issue_comment' || github.event.issue.pull_request) && | |
| github.ref == 'refs/heads/dev' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| checks: write | |
| contents: read | |
| issues: write | |
| pull-requests: write | |
| # One in-flight authoritative evaluation per pull request. For check_run events the group must | |
| # resolve to the pull number (not the per-check id) or concurrent completions for the same pull | |
| # would race to PATCH the aggregate. Runs are not cancelled mid-flight so a publish always | |
| # completes; GitHub keeps only the newest queued run, which re-evaluates the exact current head. | |
| concurrency: | |
| group: >- | |
| kfq-action-eval-${{ github.event.issue.number || | |
| github.event.check_run.pull_requests[0].number || github.event.inputs.pr || github.run_id }} | |
| cancel-in-progress: false | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24.18.0" | |
| package-manager-cache: false | |
| - name: Evaluate Keiko for Quality | |
| env: | |
| # App auth (preferred) keeps the check bound to the Keiko for Quality App id, preserving the | |
| # exact branch-protection pin. Absent the App secrets the shell falls back to GITHUB_TOKEN | |
| # and the check is produced under the GitHub Actions App id (documented in the evaluation). | |
| # These secrets are only ever exposed on this default-branch-defined path. | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| KFQ_APP_ID: ${{ secrets.KFQ_APP_ID }} | |
| KFQ_PRIVATE_KEY_PKCS8: ${{ secrets.KFQ_PRIVATE_KEY_PKCS8 }} | |
| KFQ_PR: ${{ github.event.inputs.pr }} | |
| # Non-secret configuration, mirroring the live Worker variables. | |
| TARGET_REPOSITORIES_JSON: >- | |
| [{"repository":"oscharko-dev/Keiko","baseBranch":"dev","profile":"keiko"}, | |
| {"repository":"oscharko-dev/Keiko-Native","baseBranch":"dev","profile":"keiko-native"}] | |
| STABILITY_WINDOW_MS: "60000" | |
| # ADR-0142 cutover (2026-07-19): the Action is the canonical producer. The empty label | |
| # disables the proof-of-concept opt-in gate (every pull is evaluated), and the canonical | |
| # check name + dashboard marker replace the "(Action)" PoC identity. The Worker is | |
| # retired in the same change set; rollback is `wrangler deploy` from | |
| # infrastructure/keiko-for-quality/ plus reverting this block to the PoC identity. | |
| KFQ_ACTION_LABEL: "" | |
| KFQ_CHECK_NAME: Keiko for Quality | |
| KFQ_DASHBOARD_MARKER: "<!-- keiko-for-quality-dashboard:v1 -->" | |
| run: node scripts/keiko-for-quality-action.mjs | |
| # Untrusted path: pull_request runs the pull's own workflow/script copy. Read-only, no secrets, and | |
| # dry-run (KFQ_DRY_RUN logs the verdict to the run log and performs no writes), so pull-controlled | |
| # code cannot exfiltrate credentials or publish under any identity. Fast feedback only; the | |
| # authoritative verdict comes from the default-branch triggers above. | |
| preview: | |
| name: Preview quality aggregate (dry-run) | |
| if: ${{ github.event_name == 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| checks: read | |
| contents: read | |
| issues: read | |
| pull-requests: read | |
| concurrency: | |
| group: kfq-action-preview-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "24.18.0" | |
| package-manager-cache: false | |
| - name: Preview Keiko for Quality (dry-run, no writes) | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| KFQ_DRY_RUN: "1" | |
| TARGET_REPOSITORIES_JSON: >- | |
| [{"repository":"oscharko-dev/Keiko","baseBranch":"dev","profile":"keiko"}, | |
| {"repository":"oscharko-dev/Keiko-Native","baseBranch":"dev","profile":"keiko-native"}] | |
| STABILITY_WINDOW_MS: "60000" | |
| run: node scripts/keiko-for-quality-action.mjs |