chore(deps): bump the all-minor-patch group across 1 directory with 27 updates #70
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # PR quality gate — runs on every pull request targeting main. | |
| # Jobs: lint → types → skills-drift → unit+coverage → bundle-size → e2e-webview → e2e-vscode → pr-title | |
| # All jobs must pass before merge (enforced via branch protection rules). | |
| # | |
| # Conceptually, the per-job step list across this workflow == `pnpm verify:full` from the root. | |
| # CI keeps the split (parallelism + per-job failure attribution); local devs and agents run | |
| # `pnpm verify` (fast lifecycle) and `pnpm verify:full` (CI equivalent) — see AGENTS.md § Verification. | |
| # | |
| # @see docs/specs/500-ci-code-qa/spec.md [FR-1] [FR-2] [FR-3] [FR-4] [FR-5] [FR-6] [FR-7] [FR-8] [FR-9] | |
| # @see docs/specs/500-ci-code-qa/design.md [DES-CI-CODE-QA-JOB-GRAPH] | |
| # @see docs/specs/430-dx-enforcement/430-dx-enforcement.md [FR-1] [FR-2] [DES-ARCH] | |
| name: code-qa | |
| on: | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.19.0" | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm check:lint | |
| - run: pnpm check:format | |
| - run: pnpm check:md | |
| types: | |
| name: Type check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.19.0" | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm check:types | |
| skills-drift: | |
| name: Skills drift | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.19.0" | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm --filter "./apps/vscode" sync:skills -- --verify | |
| unit: | |
| name: Unit tests + coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.19.0" | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Run unit tests via vitest workspace (excludes vscode-e2e) | |
| run: pnpm test:coverage | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: coverage-report | |
| path: "**/coverage/" | |
| bundle-size: | |
| name: Bundle size | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.19.0" | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| - name: Enforce bundle-size budgets (FR-30) | |
| uses: andresz1/size-limit-action@v1 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| skip_step: build | |
| e2e-webview: | |
| name: E2E — Sidebar webview (Playwright) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.19.0" | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Install Playwright browsers | |
| run: pnpm --filter apps/chat exec playwright install --with-deps chromium | |
| - name: Run Playwright tests | |
| run: pnpm test:e2e | |
| e2e-vscode: | |
| name: E2E — Extension host | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.19.0" | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Build extension | |
| run: pnpm build:vscode | |
| - name: Run vscode-e2e | |
| uses: coactions/setup-xvfb@v1 | |
| with: | |
| run: pnpm test:e2e:vscode | |
| if: runner.os == 'Linux' | |
| - name: Run vscode-e2e (Windows) | |
| run: pnpm test:e2e:vscode | |
| if: runner.os == 'Windows' | |
| pr-title: | |
| name: PR title lint (Conventional Commit) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: amannn/action-semantic-pull-request@v6 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| requireScope: true | |
| validateSingleCommit: false | |
| # @see docs/specs/430-dx-enforcement/430-dx-enforcement.md [FR-15] [DES-SECRETS] | |
| secrets: | |
| name: Secret scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 # full history for diff scan | |
| - uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # GITLEAKS_LICENSE only required for org-owned private repos with > $25/seat plan. | |
| # For solo/public repos, leave unset; the action runs in OSS mode. | |
| # @see docs/specs/430-dx-enforcement/430-dx-enforcement.md [FR-16] [FR-18] [DES-SUPPLY] [DES-SEC] | |
| security: | |
| name: Supply chain (audit + licenses) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22.19.0" | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: pnpm audit (high+ on production deps) | |
| run: pnpm audit --audit-level=high --prod | |
| - name: Build shipped artifacts for legal inventory | |
| run: pnpm build | |
| - name: Baseline package license policy | |
| run: pnpm exec license-checker-rseidelsohn --production --onlyAllow 'MIT;ISC;Apache-2.0;BSD-2-Clause;BSD-3-Clause;CC0-1.0;CC-BY-4.0;0BSD;Unlicense;Python-2.0;BlueOak-1.0.0;OFL-1.1' | |
| - name: Artifact-aware third-party notices | |
| run: pnpm legal:check | |
| # @see docs/specs/430-dx-enforcement/430-dx-enforcement.md [FR-17] [DES-SUPPLY] | |
| osv-scan: | |
| name: OSV-Scanner (lockfile vulnerabilities) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: google/osv-scanner-action/osv-scanner-action@v2.3.8 | |
| with: | |
| scan-args: |- | |
| --lockfile=pnpm-lock.yaml | |
| # @see docs/specs/430-dx-enforcement/430-dx-enforcement.md [FR-20] [DES-SUPPLY] | |
| actionlint: | |
| name: actionlint (workflow YAML) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: reviewdog/action-actionlint@v1 | |
| with: | |
| reporter: github-pr-review | |
| fail_level: error | |
| level: error |