deps: Bump the workspace-dependencies group across 1 directory with 29 updates #150
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_call: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify: | |
| name: Verify (Node ${{ matrix.node-version }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: [22.x, 24.x] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| - name: Enable pnpm | |
| run: corepack enable | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile --ignore-scripts | |
| - name: Check toolchain | |
| run: pnpm run doctor | |
| - name: Check repository hygiene | |
| run: pnpm run hygiene | |
| - name: Lint workspace | |
| run: pnpm run lint | |
| - name: Build packages | |
| run: pnpm run build | |
| - name: Build browser bundle | |
| run: pnpm run build:web | |
| - name: Run unit tests | |
| run: pnpm run test:unit | |
| supply-chain: | |
| name: Supply Chain Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # `pnpm audit` calls npm's retired /security/audits endpoint (HTTP 410), so | |
| # scan the lockfile with Trivy instead, failing on HIGH/CRITICAL. Accepted | |
| # advisories are documented in .trivyignore. | |
| - name: Trivy vulnerability scan (high/critical) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: pnpm-lock.yaml | |
| scanners: vuln | |
| severity: HIGH,CRITICAL | |
| exit-code: '1' | |
| trivyignores: .trivyignore | |
| package-inspection: | |
| name: Package Inspection | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node.js 20.x | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22.x | |
| - name: Enable pnpm | |
| run: corepack enable | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile --ignore-scripts | |
| - name: Build packages | |
| run: pnpm run build | |
| - name: Build browser bundles | |
| run: pnpm run build:web | |
| - name: Inspect package tarballs | |
| run: pnpm run release:inspect-packages | |
| - name: Pack package tarballs | |
| run: pnpm run release:pack-packages | |
| - name: Smoke test package tarballs | |
| run: pnpm run release:smoke-tarballs dist/released-packages.tsv dist/tarballs | |
| coverage: | |
| name: Unit Coverage | |
| runs-on: ubuntu-latest | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node.js 20.x | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22.x | |
| - name: Enable pnpm | |
| run: corepack enable | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile --ignore-scripts | |
| - name: Run unit coverage | |
| run: pnpm run test:coverage:unit | |
| - name: Upload unit coverage to Codecov | |
| if: env.CODECOV_TOKEN != '' && github.event_name == 'push' | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| token: ${{ env.CODECOV_TOKEN }} | |
| files: ./packages/*/.coverage/unit/*.json,./tools/*/.coverage/unit/*.json | |
| disable_search: true | |
| flags: unit | |
| name: qrl-web3-unit | |
| fail_ci_if_error: true | |
| - name: Upload unit coverage to Codecov (PR) | |
| if: env.CODECOV_TOKEN != '' && github.event_name == 'pull_request' | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| token: ${{ env.CODECOV_TOKEN }} | |
| files: ./packages/*/.coverage/unit/*.json,./tools/*/.coverage/unit/*.json | |
| disable_search: true | |
| flags: unit | |
| name: qrl-web3-unit | |
| fail_ci_if_error: false | |
| - name: Skip Codecov upload without token | |
| if: env.CODECOV_TOKEN == '' | |
| run: echo "Skipping Codecov upload because CODECOV_TOKEN is not available in this workflow context." | |
| docs: | |
| name: Docs Build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Use Node.js 20.x | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22.x | |
| - name: Enable pnpm | |
| run: corepack enable | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile --ignore-scripts | |
| - name: Build docs | |
| run: pnpm run build:docs |