feat: replace polystrat banner with connect banner #231
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint and Scan | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| # Least-privilege default for GITHUB_TOKEN: every job in this workflow only | |
| # needs to read the repo (checkout + install + run local tooling). Any job | |
| # that later needs to write (e.g. commenting on PRs, creating releases) must | |
| # opt in explicitly at the job level. | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: 'yarn' | |
| - name: Activate pinned Yarn via Corepack | |
| run: | | |
| corepack enable | |
| corepack prepare yarn@1.22.22 --activate | |
| - name: Install modules | |
| run: yarn install --frozen-lockfile | |
| - name: Run ESLint | |
| run: yarn lint | |
| audit: | |
| name: Dependency audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: 'yarn' | |
| - name: Activate pinned Yarn via Corepack | |
| run: | | |
| corepack enable | |
| corepack prepare yarn@1.22.22 --activate | |
| - name: Run audit gate | |
| # Wrapper handles the Yarn 1.x severity bitmask and the | |
| # .supply-chain/audit-allowlist.json suppressions. See SUPPLY-CHAIN-SECURITY.md §5. | |
| run: yarn audit:prod | |
| lockfile-lint: | |
| name: Lockfile lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: 'yarn' | |
| - name: Activate pinned Yarn via Corepack | |
| run: | | |
| corepack enable | |
| corepack prepare yarn@1.22.22 --activate | |
| - name: Install modules | |
| run: yarn install --frozen-lockfile | |
| - name: Validate yarn.lock registry URLs and integrity | |
| run: yarn lint:lockfile | |
| install-hooks: | |
| name: Install-hook diff | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: 'yarn' | |
| - name: Activate pinned Yarn via Corepack | |
| run: | | |
| corepack enable | |
| corepack prepare yarn@1.22.22 --activate | |
| - name: Install (skip lifecycle scripts) | |
| run: yarn install --frozen-lockfile --ignore-scripts | |
| - name: Diff install-hook surface | |
| run: yarn audit:install-hooks | |
| license-check: | |
| name: License allowlist gate | |
| # License allowlist gate (PARANOID): every production dependency's license | |
| # must be on the allowlist in .supply-chain/license-allowlist.json, or be a | |
| # reasoned exemption. | |
| # NON-BLOCKING PILOT: deliberately NOT in `all-checks-passed.needs` below, so | |
| # it reports without gating merges. Promote to required by adding it to that | |
| # `needs:` array (+ branch protection). See .plans/license-check-gate.md. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version-file: .nvmrc | |
| - name: Activate pinned Yarn via Corepack | |
| run: | | |
| corepack enable | |
| corepack prepare yarn@1.22.22 --activate | |
| - name: Install modules | |
| run: yarn install --frozen-lockfile | |
| - name: Check production dependency licenses | |
| run: yarn license-check | |
| all-checks-passed: | |
| # Single aggregate gate for branch protection. Keep this job's `needs` | |
| # list in sync with every mandatory job above — branch protection requires | |
| # only this context, so adding/removing a mandatory job is a workflow | |
| # edit, not a branch-protection edit. | |
| # | |
| # The step below treats `failure`, `cancelled`, AND `skipped` as non-pass. | |
| # None of the jobs above use `if:` conditions today, so they cannot skip — | |
| # but if one is ever added, this guard prevents a `skipped` result from | |
| # silently satisfying the required status check. | |
| name: All checks passed | |
| needs: [lint, audit, lockfile-lint, install-hooks] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify all dependencies succeeded | |
| run: | | |
| if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]] || \ | |
| [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]] || \ | |
| [[ "${{ contains(needs.*.result, 'skipped') }}" == "true" ]]; then | |
| echo "::error::One or more required jobs did not succeed" | |
| exit 1 | |
| fi |