docs: astro block on landing #1045
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tests | |
| on: | |
| push: | |
| branches: [ master ] | |
| pull_request: | |
| branches: [ master ] | |
| repository_dispatch: | |
| types: [ semantic-release ] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| installtest: | |
| name: installtest | |
| timeout-minutes: 20 | |
| runs-on: ubuntu-24.04 | |
| container: | |
| image: mcr.microsoft.com/playwright:v1.57.0-noble | |
| env: | |
| HUSKY: 0 | |
| PLAYWRIGHT_BROWSERS_PATH: 0 | |
| permissions: | |
| contents: read | |
| steps: | |
| # - uses: google/wireit@setup-github-actions-caching/v2 | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 | |
| with: | |
| version: 10.26.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| # - name: Test exports | |
| # run: npm run test:exports | |
| # The design-token contract at this repo's own hues — no browser, ~0.1s. | |
| # `tests/landing/a11y.spec.ts` proves the pages use those tokens; | |
| # this proves the tokens themselves still clear WCAG 2 AA and APCA. | |
| - name: Design token contract | |
| run: pnpm --filter example-nextjs16 test:tokens | |
| - name: Unit tests | |
| # Through wireit: the examples import `state-in-url`, so the typecheck | |
| # needs a built `dist/`, and `tsc` depends on `build`. | |
| run: pnpm run tsc && pnpm exec vitest --run --coverage | |
| - name: Run codacy-coverage-reporter | |
| uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1.3.0 | |
| continue-on-error: true | |
| with: | |
| project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} | |
| coverage-reports: coverage-reports/lcov.info | |
| build: | |
| name: build | |
| needs: [ installtest ] | |
| timeout-minutes: 20 | |
| runs-on: ubuntu-24.04 | |
| container: | |
| image: mcr.microsoft.com/playwright:v1.57.0-noble | |
| permissions: | |
| contents: read | |
| env: | |
| HUSKY: 0 | |
| PLAYWRIGHT_BROWSERS_PATH: 0 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 | |
| with: | |
| version: 10.26.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: build packages | |
| run: pnpm cross-env TEST=true pnpm run build:packages | |
| - name: Cache dependencies | |
| id: cache | |
| uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| if: always() | |
| with: | |
| path: | | |
| ./dist | |
| **/dist | |
| **/package.json | |
| ./package.json | |
| **/build | |
| **/.next | |
| key: modules-2-${{ github.sha }}-${{ github.run_id }} | |
| testint: | |
| needs: [ build ] | |
| name: testint | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| container: | |
| image: mcr.microsoft.com/playwright:v1.57.0-noble | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shardIndex: [ 1, 2, 3 ] | |
| shardTotal: [ 3 ] | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 | |
| with: | |
| version: 10.26.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile && pnpm exec playwright install --with-deps | |
| - uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| id: cache | |
| with: | |
| path: | | |
| ./dist | |
| **/dist | |
| **/package.json | |
| ./package.json | |
| **/build | |
| **/.next | |
| key: modules-2-${{ github.sha }}-${{ github.run_id }} | |
| - name: Run Playwright tests | |
| run: | | |
| pnpm run start:ci & \ | |
| pnpm wait-on -t 3m http://example-nextjs16.localhost:1355 && \ | |
| HOME=/root pnpm exec playwright test --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }} | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: always() | |
| with: | |
| name: blob-report-${{ matrix.shardIndex }} | |
| path: blob-report | |
| retention-days: 5 | |
| merge-reports: | |
| # Merge reports after playwright-tests | |
| if: ${{ always() && contains(needs.*.result, 'failure') }} | |
| needs: [ testint ] | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 | |
| with: | |
| version: 10.26.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Download blob reports from GitHub Actions Artifacts | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| path: all-blob-reports | |
| pattern: blob-report-* | |
| merge-multiple: true | |
| - name: Merge into HTML Report | |
| run: pnpm exec playwright merge-reports --reporter html ./all-blob-reports | |
| - name: Upload HTML report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: html-report--attempt-${{ github.run_attempt }} | |
| path: playwright-report | |
| retention-days: 14 | |
| release: | |
| name: release | |
| needs: [ testint ] | |
| if: github.ref == 'refs/heads/master' | |
| timeout-minutes: 20 | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: write # to be able to publish a GitHub release and push CHANGELOG | |
| issues: write # to comment on released issues | |
| pull-requests: write # to comment on released pull requests | |
| id-token: write # OIDC for npm Trusted Publishing & provenance | |
| env: | |
| HUSKY: 0 # skip husky hook installation; semantic-release runs `git commit` | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| objects.githubusercontent.com:443 | |
| registry.npmjs.org:443 | |
| fulcio.sigstore.dev:443 | |
| rekor.sigstore.dev:443 | |
| tuf-repo-cdn.sigstore.dev:443 | |
| nodejs.org:443 | |
| registry.yarnpkg.com:443 | |
| context7.com:443 | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@d15e628ca66d93ee5f352c71671a7bc6a97af5c9 # v6.0.8 | |
| with: | |
| version: 10.26.0 | |
| # No `cache:` here on purpose: the release job has `id-token: write` and | |
| # publishes to npm, so it must not share a cache namespace with PR jobs | |
| # (cache poisoning across the PR↔release trust boundary). | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version-file: '.nvmrc' | |
| package-manager-cache: false | |
| - name: Upgrade npm | |
| # Trusted Publishing requires npm >= 11.5.1; provenance requires >= 9.5.0 | |
| run: npm install -g npm@latest | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: build package | |
| run: pnpm run build | |
| - name: Initialize Git user | |
| run: | | |
| git config --global user.email "github-release-bot@example.com" | |
| git config --global user.name "Release Workflow" | |
| - name: Release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} | |
| # NPM_TOKEN not needed when using OIDC Trusted Publishing | |
| # Read by the successCmd in release.config.cjs to refresh Context7. | |
| CONTEXT7_API_KEY: ${{ secrets.CONTEXT7_API_KEY }} | |
| run: pnpm exec semantic-release |