fd2def684fThe "Check formatting" step in main.yml ran `npx prettier --check .` before `npm install`, so npx fetched the LATEST prettier rather than the version pinned in package-lock.json. This made the format check non-deterministic and red on open PRs whenever the latest published prettier differed from the pinned one. - Pin prettier to exact 3.9.5 in devDependencies and update the lockfile - Reformat the repo with the pinned prettier (expected source churn) - Move the format check after `npm install --no-package-lock` and run it via `npm run prettier-check` so CI uses the locally-installed pinned prettier Claude-Session: https://claude.ai/code/session_01HiccCEh9mwCfVzE8qYcop1 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
119 lines
2.9 KiB
YAML
119 lines
2.9 KiB
YAML
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
pull_request:
|
|
release:
|
|
types: [published]
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: package.json
|
|
cache: npm
|
|
|
|
# Working around https://github.com/npm/cli/issues/4828
|
|
# - run: npm ci
|
|
- run: npm install --no-package-lock
|
|
|
|
- name: Check formatting
|
|
run: npm run prettier-check
|
|
|
|
- name: Check version consistency
|
|
run: npm run check-version
|
|
|
|
- name: Check linting
|
|
working-directory: ./client
|
|
run: npm run lint
|
|
|
|
- name: Run client tests
|
|
working-directory: ./client
|
|
run: npm test
|
|
|
|
- run: npm run build
|
|
|
|
publish:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'release'
|
|
environment: release
|
|
needs: build
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version-file: package.json
|
|
cache: npm
|
|
registry-url: "https://registry.npmjs.org"
|
|
|
|
# Working around https://github.com/npm/cli/issues/4828
|
|
# - run: npm ci
|
|
- run: npm install --no-package-lock
|
|
|
|
# OIDC trusted publishing requires npm >=11.5.1; Node 22's bundled npm is 10.x.
|
|
- name: Ensure npm CLI supports OIDC trusted publishing
|
|
run: npm install -g npm@^11.5.1
|
|
|
|
- run: npm run publish-all
|
|
env:
|
|
NPM_CONFIG_PROVENANCE: "true"
|
|
|
|
publish-github-container-registry:
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'release'
|
|
environment: release
|
|
needs: build
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
attestations: write
|
|
id-token: write
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Log in to the Container registry
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Extract metadata (tags, labels) for Docker
|
|
id: meta
|
|
uses: docker/metadata-action@v6
|
|
with:
|
|
images: ghcr.io/${{ github.repository }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@v3
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v4
|
|
|
|
- name: Build and push Docker image
|
|
id: push
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
push: true
|
|
platforms: linux/amd64,linux/arm64
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
|
|
- name: Generate artifact attestation
|
|
uses: actions/attest-build-provenance@v4
|
|
with:
|
|
subject-name: ghcr.io/${{ github.repository }}
|
|
subject-digest: ${{ steps.push.outputs.digest }}
|
|
push-to-registry: true
|