feat(deps): bump dompurify from 3.4.12 to 3.4.13 in the npm_and_yarn group across 1 directory #356
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Least-privilege default GITHUB_TOKEN. Every job here only checks out the repo | |
| # and runs build/test — none writes back to GitHub — so read-only contents is | |
| # all that's needed. Set at the top level so it applies to all jobs (satisfies | |
| # CodeQL actions/missing-workflow-permissions); a job that ever needs more can | |
| # override with its own permissions: block. | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Version-independent quality gates. These don't depend on the Node runtime, | |
| # so they run once on the latest LTS rather than once per matrix entry. See | |
| # AGENTS.md ("Node version policy") for why single-version jobs pin Node 24. | |
| quality: | |
| runs-on: ubuntu-latest | |
| # Real runtime is ~1 min; this bound just fails a hung/stuck job fast | |
| # instead of letting it ride GitHub's 6-hour default. | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # pnpm version comes from the "packageManager" field in package.json. | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install | |
| - name: Lint | |
| run: pnpm lint | |
| # Also the typecheck gate, and a prerequisite for the docs build below. | |
| - name: Build | |
| run: pnpm -r build | |
| # Prove the @mermaid-lint/core API reference still builds. The docs.yml | |
| # workflow deploys this output to Cloudflare Pages on push to main. | |
| # Build the API reference, then fail if the output gains a Cloudflare Pages | |
| # reserved path (e.g. a top-level functions/ dir) that would break the deploy. | |
| - name: API docs build + Cloudflare Pages safety check (typedoc) | |
| run: | | |
| pnpm --filter @mermaid-lint/core docs | |
| node scripts/check-docs-cloudflare-safe.mjs packages/core/docs | |
| # Runtime test matrix. Proves the published packages actually run on every | |
| # Node we declare support for (engines.node ">=22"), not just the LTS the | |
| # quality gates use. Keep this list in sync with the supported range. | |
| test-matrix: | |
| # Render matrix legs as "test (node-22)" … "test (node-26)" rather than | |
| # bare "test (22)", so the Node version is unambiguous in the checks list. | |
| # The job id is test-matrix; the single required "test" check is the | |
| # aggregate gate job below (matrix check names change with the matrix, so | |
| # branch protection targets the stable gate instead of the legs). | |
| name: test (node-${{ matrix.node-version }}) | |
| runs-on: ubuntu-latest | |
| # A leg normally finishes in ~1 min; the vitest step has been seen to hang | |
| # (test run completes but the process never exits), which without a bound | |
| # would occupy a runner for GitHub's full 6-hour default. Fail fast instead. | |
| timeout-minutes: 10 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: ['22', '24', '26'] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # pnpm version comes from the "packageManager" field in package.json. | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install | |
| # Tests execute the built dist, so build is a per-Node prerequisite here. | |
| - name: Build | |
| run: pnpm -r build | |
| - name: Test (vitest — core, cli, vitest adapter) | |
| run: pnpm test --reporter=verbose | |
| - name: Test (jest adapter) | |
| run: pnpm --filter @mermaid-lint/jest test | |
| # Aggregate gate. The branch ruleset requires a single "test" status check; | |
| # this job provides that stable context and passes only if the quality gate | |
| # and every Node matrix leg succeeded. `needs.<job>.result` is "success" only | |
| # when all of a matrix job's legs pass, so one check covers the whole matrix. | |
| # if: always() ensures it runs (and can fail) even when a dependency fails, | |
| # instead of being skipped. | |
| test: | |
| name: test | |
| runs-on: ubuntu-latest | |
| # Just evaluates upstream results; seconds in practice. | |
| timeout-minutes: 5 | |
| needs: [quality, test-matrix] | |
| if: always() | |
| steps: | |
| - name: Require quality and all Node legs to pass | |
| env: | |
| QUALITY_RESULT: ${{ needs.quality.result }} | |
| TEST_MATRIX_RESULT: ${{ needs.test-matrix.result }} | |
| run: | | |
| echo "quality: $QUALITY_RESULT" | |
| echo "test-matrix: $TEST_MATRIX_RESULT" | |
| [ "$QUALITY_RESULT" = "success" ] && [ "$TEST_MATRIX_RESULT" = "success" ] | |
| e2e: | |
| # Real VS Code Extension Host test for mermaid-lint-vscode. Runs the | |
| # @vscode/test-electron suite headlessly under xvfb (Electron needs a | |
| # display); xvfb is preinstalled on ubuntu-latest runners. The extension | |
| # host bundles its own Electron/Node, so this stays on a single Node. | |
| runs-on: ubuntu-latest | |
| # Electron-under-xvfb is the slowest job and can wedge on a stuck display or | |
| # extension host; give it more headroom than the others but still cap it. | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| # pnpm version comes from the "packageManager" field in package.json. | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '24' | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install | |
| - name: Build | |
| run: pnpm -r build | |
| - name: VS Code extension e2e (@vscode/test-electron) | |
| run: xvfb-run -a pnpm --filter mermaid-lint-vscode test:e2e |