fix(ci): make targeted format-check base fetch non-fast-forward safe … #37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI Quality Gates | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| NX_DAEMON: 'false' | |
| TMPDIR: /tmp | |
| TMP: /tmp | |
| TEMP: /tmp | |
| jobs: | |
| security-checklist-gate: | |
| name: security-checklist-gate | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm security-checklist:gate | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| format-check: | |
| name: format:check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - name: format check (targeted) | |
| shell: bash | |
| run: | | |
| BASE_BRANCH="${GITHUB_BASE_REF:-main}" | |
| git fetch origin "refs/heads/${BASE_BRANCH}" --depth=1 | |
| pnpm nx format:check --base=FETCH_HEAD --head=HEAD | |
| lint: | |
| name: lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm lint | |
| typecheck: | |
| name: typecheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm typecheck | |
| unit-test: | |
| name: unit-test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm unit-test | |
| integration-test: | |
| name: integration-test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm integration-test | |
| e2e-smoke: | |
| name: e2e-smoke | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm exec playwright install --with-deps chromium | |
| - run: pnpm e2e-smoke | |
| a11y-e2e: | |
| name: a11y-e2e | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm exec playwright install --with-deps chromium | |
| - run: pnpm a11y-e2e | |
| i18n-check: | |
| name: i18n-check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm i18n-check | |
| build-renderer: | |
| name: build-renderer | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm build-renderer | |
| build-desktop: | |
| name: build-desktop | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm build-desktop | |
| dependency-audit: | |
| name: dependency-audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm dependency-audit --audit-level=high | |
| license-compliance: | |
| name: license-compliance | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm license-compliance | |
| perf-check: | |
| name: perf-check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm perf:check | |
| - name: Upload perf report | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: perf-report-${{ github.sha }} | |
| path: tmp/perf/perf-check.json | |
| artifact-publish: | |
| name: artifact-publish | |
| runs-on: windows-latest | |
| needs: | |
| - format-check | |
| - security-checklist-gate | |
| - lint | |
| - typecheck | |
| - unit-test | |
| - integration-test | |
| - e2e-smoke | |
| - a11y-e2e | |
| - i18n-check | |
| - build-renderer | |
| - build-desktop | |
| - dependency-audit | |
| - license-compliance | |
| - perf-check | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| env: | |
| RELEASE_CHANNEL: dev | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10.14.0 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24.13.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile=false | |
| - run: pnpm build | |
| - run: pnpm forge:make | |
| - name: Upload packaged desktop artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: desktop-${{ env.RELEASE_CHANNEL }}-${{ github.sha }} | |
| path: out/** |