Repository navigation
Make Yourself to Science agent-ready on Cloudflare Workers #44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OpenNext security | |
| on: | |
| pull_request: | |
| paths: | |
| - 'src/**' | |
| - 'scripts/**' | |
| - 'public/**' | |
| - 'test/**' | |
| - 'next.config.mjs' | |
| - 'open-next.config.ts' | |
| - 'wrangler.jsonc' | |
| - 'package.json' | |
| - 'package-lock.json' | |
| - '.node-version' | |
| - '.github/workflows/agent-api-security.yml' | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'src/**' | |
| - 'scripts/**' | |
| - 'public/**' | |
| - 'test/**' | |
| - 'next.config.mjs' | |
| - 'open-next.config.ts' | |
| - 'wrangler.jsonc' | |
| - 'package.json' | |
| - 'package-lock.json' | |
| - '.node-version' | |
| - '.github/workflows/agent-api-security.yml' | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate-worker: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22.23.1' | |
| cache: npm | |
| - name: Install locked dependencies | |
| run: npm ci | |
| - name: Validate migration invariants | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| node --check next.config.mjs | |
| node --check src/middleware.js | |
| node --check src/lib/agentApi.js | |
| node --check scripts/extendAgentOpenApi.js | |
| node --check scripts/validateAgentArtifacts.js | |
| node --check scripts/enforceRuntimeAudit.js | |
| if grep -RInE --include='*.js' --include='*.jsx' --include='*.ts' --include='*.tsx' \ | |
| "export const runtime[[:space:]]*=[[:space:]]*['\"]edge['\"]" src; then | |
| echo 'OpenNext does not support route-level Edge Runtime declarations.' >&2 | |
| exit 1 | |
| fi | |
| if grep -q '"@cloudflare/next-on-pages"' package.json package-lock.json; then | |
| echo 'Archived next-on-pages dependency remains in the repository.' >&2 | |
| exit 1 | |
| fi | |
| - name: Run security regression tests | |
| run: npm test | |
| - name: Regenerate and validate agent contracts | |
| run: | | |
| npm run update-openapi | |
| npm run extend-openapi | |
| npm run validate-agent-artifacts | |
| - name: Build OpenNext Worker | |
| env: | |
| NEXTJS_ENV: production | |
| NEXT_TELEMETRY_DISABLED: '1' | |
| run: npx opennextjs-cloudflare build | |
| - name: Validate Worker bundle and Free-plan size | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| npx wrangler deploy --dry-run --outdir .wrangler-dry-run 2>&1 | tee wrangler-dry-run.log | |
| node <<'NODE' | |
| import fs from 'node:fs'; | |
| const log = fs.readFileSync('wrangler-dry-run.log', 'utf8'); | |
| const match = log.match(/gzip:\s*([0-9.]+)\s*(KiB|MiB)/i); | |
| if (!match) { | |
| throw new Error('Could not determine compressed Worker size from Wrangler output.'); | |
| } | |
| const value = Number(match[1]); | |
| const kib = match[2].toLowerCase() === 'mib' ? value * 1024 : value; | |
| console.log(`Compressed Worker size: ${kib.toFixed(2)} KiB`); | |
| if (kib > 3072) { | |
| throw new Error(`Compressed Worker exceeds the Workers Free 3 MiB limit: ${kib.toFixed(2)} KiB`); | |
| } | |
| NODE | |
| - name: Generate dependency audit reports | |
| run: | | |
| npm audit --omit=dev --json > npm-audit-runtime.json || true | |
| npm audit --json > npm-audit-full.json || true | |
| - name: Upload validation reports | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: open-next-validation | |
| path: | | |
| npm-audit-runtime.json | |
| npm-audit-full.json | |
| wrangler-dry-run.log | |
| if-no-files-found: error | |
| retention-days: 14 | |
| - name: Enforce runtime dependency audit | |
| run: node scripts/enforceRuntimeAudit.js npm-audit-runtime.json npm-audit-full.json |