fix: remove /vercel/import + archive non-required CI workflows #1110
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Secret scan — blocks commits that leak keys/tokens. Uses gitleaks; for a | |
| # public repo the default GITHUB_TOKEN is sufficient (no license key needed). | |
| secret-scan: | |
| name: Secret scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # gitleaks-action needs pull-requests: write to post review comments on | |
| # PRs. Without it the scan still runs and fails on leaks, but PR | |
| # annotations silently don't appear. | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| # Full history so gitleaks can scan past commits, not just the diff. | |
| fetch-depth: 0 | |
| - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| config-path: .github/gitleaks.toml | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Typecheck | |
| run: npx tsc --noEmit | |
| - name: Canonical test (11/11, Υ 18436.98) | |
| run: node --test __tests__/ingest/canonical.test.mjs | |
| - name: Anti-gaming claim tests (RS.06 dead code, Benford vacuous, SIGNA ceiling, contamination bypass) | |
| run: node --test __tests__/ingest/rs06-wiring.test.mjs __tests__/ingest/benford-vacuous.test.mjs __tests__/scoring/signa-ceiling.test.mjs __tests__/ingest/contamination-bypass.test.mjs | |
| - name: Hardening tests (Jensen fix, codename guard, throttle TOCTOU, baseline labels, board exclusion) | |
| run: node --test __tests__/data/the-field-jensen.test.mjs __tests__/ingest/codename-guard-bypass.test.mjs __tests__/ingest/throttle-toctou.test.mjs __tests__/data/baseline-labels.test.mjs __tests__/data/the-field-board-exclusion.test.mjs __tests__/ingest/tightened-plausibility.test.mjs | |
| - name: Test coverage report | |
| run: npm run test:coverage | |
| - name: Upload coverage report | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: coverage-report | |
| path: coverage/ | |
| retention-days: 14 | |
| - name: UI component tests (vitest) | |
| run: npm run test:ui | |
| - name: Build | |
| run: npm run build | |
| # Cross-repo contract test — catches platform-enum drift between the web app | |
| # and the MCP server. The codex landing was triple-blocked because these enums | |
| # drifted (one repo accepted a platform the other didn't). This job checks out | |
| # the MCP repo and diffs the two enums. Fails if they don't match. | |
| cross-repo-contract: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Checkout sigrank-mcp (the other half of the contract) | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| repository: SunrisesIllNeverSee/sigrank-mcp | |
| path: _sigrank-mcp | |
| # Public repo — no token needed. If it goes private, add a PAT secret. | |
| # token: ${{ secrets.CROSS_REPO_PAT }} | |
| - name: Cross-repo platform-enum contract test | |
| run: node __tests__/contract/platform-enum-contract.test.mjs ${{ github.workspace }}/_sigrank-mcp | |
| - name: Cross-repo window-enum contract test | |
| run: node __tests__/contract/window-enum-contract.test.mjs ${{ github.workspace }}/_sigrank-mcp | |
| - name: Cross-repo MCP version + platform-count drift test | |
| run: node __tests__/contract/mcp-version-drift.test.mjs ${{ github.workspace }}/_sigrank-mcp | |
| - name: Intra-repo mock/seed sync contract (dev fallback ↔ prod seed) | |
| run: node --test __tests__/contract/mock-seed-sync.test.mjs | |
| - name: Install sigrank-mcp dependencies | |
| run: npm ci --prefix _sigrank-mcp | |
| - name: Generated Standard record validates against public schema | |
| env: | |
| OTHER_REPO_ROOT: ${{ github.workspace }}/_sigrank-mcp | |
| run: node --test __tests__/standard/generated-record-contract.test.mjs | |
| # Standalone Standard conformance gate — validates the HTTP MCP producer | |
| # against the authoritative fixture pack from sigrank-standard. The | |
| # Standard ref is pinned via SIGRANK_STANDARD_REF so upstream changes | |
| # cannot silently alter consumer builds. | |
| - name: Checkout sigrank-standard (authoritative fixture pack) | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| repository: SunrisesIllNeverSee/sigrank-standard | |
| path: _sigrank-standard | |
| ref: main | |
| fetch-depth: 0 | |
| - name: Pin sigrank-standard to pinned ref | |
| working-directory: _sigrank-standard | |
| run: git reset --hard ${{ vars.SIGRANK_STANDARD_REF || 'c73f152' }} | |
| - name: Standalone Standard conformance gate | |
| env: | |
| SIGRANK_STANDARD_REF: ${{ vars.SIGRANK_STANDARD_REF || 'c73f152' }} | |
| SIGRANK_STANDARD_PATH: ${{ github.workspace }}/_sigrank-standard | |
| run: node --test __tests__/mcp/standalone-conformance.test.mjs | |
| # Migration parity guardrail — fails if the Supabase migration ledger has | |
| # drifted from the local migrations/ directory. Prevents the catastrophic | |
| # db-push scenario (re-running all migrations) from silently returning. | |
| # Only runs on push to main (not on PRs) to avoid exposing the | |
| # SUPABASE_ACCESS_TOKEN secret in a pull_request context on a public repo. | |
| # For PRs, the build job's local migration syntax check is sufficient. | |
| migration-parity: | |
| name: Supabase migration parity | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Install Supabase CLI | |
| run: | | |
| npm install -g supabase | |
| supabase --version | |
| - name: Link project | |
| env: | |
| SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }} | |
| run: | | |
| supabase link --project-ref copqtaqzsdvpdbhpwjmt | |
| - name: Check migration parity (guardrail) | |
| env: | |
| SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }} | |
| run: npm run db:parity:ci | |
| # One-time repair job — COMPLETED (commit feac0058). Removed to fix YAML | |
| # syntax error caused by Python triple-quoted string indentation inside the | |
| # YAML literal block scalar. The repair already ran; this job was dead code | |
| # that broke every CI run since Aug 24. |