Merge pull request #234 from chicogong/maintenance/retire-obsolete-de… #767
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| branches: [master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| env: | |
| GITLEAKS_VERSION: '8.30.1' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: '24' | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Validate release metadata | |
| run: npm run check:version | |
| - name: Audit dependencies | |
| run: npm audit --audit-level=high | |
| - name: Install pinned Gitleaks | |
| run: | | |
| archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| base_url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}" | |
| curl --retry 3 --retry-all-errors --fail --silent --show-error --location "$base_url/$archive" --output "/tmp/$archive" | |
| curl --retry 3 --retry-all-errors --fail --silent --show-error --location "$base_url/gitleaks_${GITLEAKS_VERSION}_checksums.txt" --output /tmp/gitleaks-checksums.txt | |
| (cd /tmp && grep " $archive$" gitleaks-checksums.txt | sha256sum --check --strict) | |
| tar -xzf "/tmp/$archive" -C /tmp gitleaks | |
| sudo install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks | |
| - name: Scan tracked history and personal paths | |
| run: | | |
| npm run audit:secrets | |
| npm run audit:personal-paths | |
| - name: Build SSG | |
| run: npm run build | |
| - name: Verify release artifact licenses | |
| run: | | |
| npm run check:artifact-license | |
| npm run build:release | |
| - name: Run HTMLHint | |
| run: npm run lint:html | |
| - name: Run Stylelint | |
| run: npm run lint:css | |
| - name: Run ESLint | |
| run: npm run lint:js | |
| # ESLint 配置已优化，警告不会导致失败 | |
| # 详见 docs/LINT_WARNINGS.md | |
| - name: Check formatting | |
| run: npm run format:check | |
| - name: Run tests | |
| run: npm test | |
| - name: Check tools sync | |
| run: | | |
| npm run sync:tools | |
| if [ -n "$(git diff --name-only -- index.html README.md README.en.md sitemap.xml manifest.json llms.txt i18n tools)" ]; then | |
| echo "❌ Error: generated sources are out of sync with tools.json" | |
| echo "" | |
| echo "Please run locally:" | |
| echo " npm run sync:tools" | |
| echo " git add index.html && git commit --amend --no-edit" | |
| echo " git push --force-with-lease" | |
| echo "" | |
| echo "Diff:" | |
| git diff -- index.html README.md README.en.md sitemap.xml manifest.json llms.txt i18n tools | head -100 | |
| exit 1 | |
| fi | |
| echo "✅ Tools are in sync" |