Fix browser launch for GitHub Actions CI #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Checks | |
| on: | |
| pull_request: | |
| branches: | |
| - master | |
| - main | |
| pull_request_target: | |
| branches: | |
| - master | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint-and-type-check: | |
| name: Lint and Type Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run ESLint | |
| run: npm run lint | |
| - name: TypeScript type check | |
| run: npm run build | |
| test: | |
| name: Run Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run tests | |
| run: npm test | |
| - name: Upload test results | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: test-results | |
| path: | | |
| coverage/ | |
| junit.xml | |
| retention-days: 7 | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run npm audit | |
| run: npm audit --audit-level=high | |
| continue-on-error: true | |
| - name: Check for known vulnerabilities | |
| run: | | |
| # Run npm audit and capture output | |
| npm audit --audit-level=moderate --json > audit-results.json || true | |
| # Check if there are any vulnerabilities | |
| if [ -s audit-results.json ]; then | |
| echo "Security vulnerabilities found:" | |
| cat audit-results.json | |
| # Count vulnerabilities | |
| HIGH_VULNS=$(cat audit-results.json | jq -r '.metadata.vulnerabilities.high // 0') | |
| CRITICAL_VULNS=$(cat audit-results.json | jq -r '.metadata.vulnerabilities.critical // 0') | |
| echo "Critical vulnerabilities: $CRITICAL_VULNS" | |
| echo "High vulnerabilities: $HIGH_VULNS" | |
| # Fail if critical vulnerabilities are found | |
| if [ "$CRITICAL_VULNS" -gt 0 ]; then | |
| echo "❌ Critical vulnerabilities found. Please fix them before merging." | |
| exit 1 | |
| fi | |
| # Warn about high vulnerabilities but don't fail | |
| if [ "$HIGH_VULNS" -gt 0 ]; then | |
| echo "⚠️ High vulnerabilities found. Consider fixing them." | |
| fi | |
| else | |
| echo "✅ No security vulnerabilities found." | |
| fi | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: critical | |
| allow-licenses: MIT, ISC, Apache-2.0, BSD-2-Clause, BSD-3-Clause, 0BSD, Unlicense | |
| fail-on-scopes: runtime | |
| base-ref: ${{ github.event.pull_request.base.sha }} | |
| head-ref: ${{ github.event.pull_request.head.sha }} | |
| continue-on-error: true | |
| build-dry-run: | |
| name: Test Build and Dry Run | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build project | |
| run: npm run build | |
| - name: Test dry run execution | |
| run: timeout 60s npm run dev -- --dry-run || [ $? -eq 124 ] | |
| env: | |
| IMAGEKIT_PUBLIC_KEY: "dummy-key" | |
| IMAGEKIT_PRIVATE_KEY: "dummy-key" | |
| pr-status-check: | |
| name: PR Status Check | |
| runs-on: ubuntu-latest | |
| needs: [lint-and-type-check, test, security, dependency-review, build-dry-run] | |
| if: always() | |
| steps: | |
| - name: Check all jobs status | |
| run: | | |
| echo "Lint and Type Check: ${{ needs.lint-and-type-check.result }}" | |
| echo "Test: ${{ needs.test.result }}" | |
| echo "Security: ${{ needs.security.result }}" | |
| echo "Dependency Review: ${{ needs.dependency-review.result }}" | |
| echo "Build Dry Run: ${{ needs.build-dry-run.result }}" | |
| # Check if any required job failed | |
| if [[ "${{ needs.lint-and-type-check.result }}" == "failure" || | |
| "${{ needs.test.result }}" == "failure" || | |
| "${{ needs.security.result }}" == "failure" || | |
| "${{ needs.build-dry-run.result }}" == "failure" ]]; then | |
| echo "❌ One or more required checks failed" | |
| exit 1 | |
| else | |
| echo "✅ All critical checks passed!" | |
| # Log dependency review result but don't fail on it | |
| if [[ "${{ needs.dependency-review.result }}" == "failure" ]]; then | |
| echo "⚠️ Dependency review found issues but continuing (non-blocking)" | |
| fi | |
| fi |