chore: update yarn and improve security settings #12457
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Bundle size | |
| on: | |
| pull_request: | |
| concurrency: | |
| # see https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#example-only-cancel-in-progress-jobs-or-runs-for-the-current-workflow | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| NX_PARALLEL: 6 # ubuntu-latest = 4-core CPU / 16 GB of RAM | macos-14-xlarge (arm) = 6-core CPU / 14 GB of RAM | |
| NX_PREFER_TS_NODE: true | |
| NX_VERBOSE_LOGGING: true | |
| BROWSERSLIST_IGNORE_OLD_DATA: true | |
| jobs: | |
| bundle-size: | |
| if: ${{ github.repository_owner == 'microsoft' }} | |
| runs-on: macos-14-xlarge | |
| permissions: | |
| contents: 'read' | |
| actions: 'read' | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Derive appropriate SHAs for base and head for `nx affected` commands | |
| uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3 | |
| with: | |
| main-branch-name: 'master' | |
| - uses: actions/setup-node@v6 | |
| with: | |
| cache: 'yarn' | |
| node-version: '22' | |
| - run: echo number of CPUs "$(getconf _NPROCESSORS_ONLN)" | |
| - run: yarn install --immutable | |
| - name: Build packages & create reports | |
| run: yarn nx affected -t bundle-size --nxBail | |
| # NOTE: base bundle size reports are only produced by the "Bundle size Base" workflow on the | |
| # default branch (master), so compare-reports will fail for PRs targeting other branches. | |
| - name: Skip bundle size comparison notice | |
| if: ${{ github.event.pull_request.base.ref != 'master' }} | |
| run: echo "::warning::Bundle size comparison skipped — base reports are only produced for the default branch (master). PR targets '${{ github.event.pull_request.base.ref }}'." | |
| # `compare-reports` exits 1 when an entry exceeds the size threshold, but its stdout is the | |
| # markdown report - without echoing it the job fails with a bare "exit code 1" and no reason. | |
| - name: Compare bundle size with base | |
| if: ${{ github.event.pull_request.base.ref == 'master' }} | |
| run: | | |
| exit_code=0 | |
| npx monosize compare-reports --branch=${{ github.event.pull_request.base.ref }} --output=markdown --quiet > ./monosize-report.md || exit_code=$? | |
| cat ./monosize-report.md >> "$GITHUB_STEP_SUMMARY" | |
| if [ "$exit_code" -ne 0 ]; then | |
| echo "::error::Bundle size threshold exceeded - see the job summary for the full report." | |
| cat ./monosize-report.md | |
| fi | |
| exit "$exit_code" | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Save PR number | |
| if: ${{ github.event.pull_request.base.ref == 'master' }} | |
| run: echo ${{ github.event.number }} > pr.txt | |
| - uses: actions/upload-artifact@v6 | |
| if: ${{ github.event.pull_request.base.ref == 'master' }} | |
| with: | |
| name: monosize-report | |
| retention-days: 1 | |
| if-no-files-found: error | |
| path: | | |
| monosize-report.md | |
| pr.txt |