olas-website/.github/workflows/main.yml at 8a7d7ca5bb88bb07f3a8a3f7ae0ab87cede7a94e · valory-xyz/olas-website · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: Lint and Scan
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

# Least-privilege default for GITHUB_TOKEN: every job in this workflow only
# needs to read the repo (checkout + install + run local tooling). Any job
# that later needs to write (e.g. commenting on PRs, creating releases) must
# opt in explicitly at the job level.
permissions:
  contents: read

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .nvmrc
          cache: 'yarn'
      - name: Activate pinned Yarn via Corepack
        run: |
          corepack enable
          corepack prepare yarn@1.22.22 --activate
      - name: Install modules
        run: yarn install --frozen-lockfile
      - name: Run ESLint
        run: yarn lint

  audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .nvmrc
          cache: 'yarn'
      - name: Activate pinned Yarn via Corepack
        run: |
          corepack enable
          corepack prepare yarn@1.22.22 --activate
      - name: Run audit gate
        # Wrapper handles the Yarn 1.x severity bitmask and the
        # .supply-chain/audit-allowlist.json suppressions. See SUPPLY-CHAIN-SECURITY.md §5.
        run: yarn audit:prod

  lockfile-lint:
    name: Lockfile lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .nvmrc
          cache: 'yarn'
      - name: Activate pinned Yarn via Corepack
        run: |
          corepack enable
          corepack prepare yarn@1.22.22 --activate
      - name: Install modules
        run: yarn install --frozen-lockfile
      - name: Validate yarn.lock registry URLs and integrity
        run: yarn lint:lockfile

  install-hooks:
    name: Install-hook diff
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .nvmrc
          cache: 'yarn'
      - name: Activate pinned Yarn via Corepack
        run: |
          corepack enable
          corepack prepare yarn@1.22.22 --activate
      - name: Install (skip lifecycle scripts)
        run: yarn install --frozen-lockfile --ignore-scripts
      - name: Diff install-hook surface
        run: yarn audit:install-hooks

  license-check:
    name: License allowlist gate
    # License allowlist gate (PARANOID): every production dependency's license
    # must be on the allowlist in .supply-chain/license-allowlist.json, or be a
    # reasoned exemption.
    # NON-BLOCKING PILOT: deliberately NOT in `all-checks-passed.needs` below, so
    # it reports without gating merges. Promote to required by adding it to that
    # `needs:` array (+ branch protection). See .plans/license-check-gate.md.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version-file: .nvmrc
      - name: Activate pinned Yarn via Corepack
        run: |
          corepack enable
          corepack prepare yarn@1.22.22 --activate
      - name: Install modules
        run: yarn install --frozen-lockfile
      - name: Check production dependency licenses
        run: yarn license-check

  all-checks-passed:
    # Single aggregate gate for branch protection. Keep this job's `needs`
    # list in sync with every mandatory job above — branch protection requires
    # only this context, so adding/removing a mandatory job is a workflow
    # edit, not a branch-protection edit.
    #
    # The step below treats `failure`, `cancelled`, AND `skipped` as non-pass.
    # None of the jobs above use `if:` conditions today, so they cannot skip —
    # but if one is ever added, this guard prevents a `skipped` result from
    # silently satisfying the required status check.
    name: All checks passed
    needs: [lint, audit, lockfile-lint, install-hooks]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Verify all dependencies succeeded
        run: |
          if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" ]] || \
             [[ "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]] || \
             [[ "${{ contains(needs.*.result, 'skipped') }}" == "true" ]]; then
            echo "::error::One or more required jobs did not succeed"
            exit 1
          fi