yourselftoscience.org/.github/workflows/agent-api-security.yml at d231fda4da211177afb8384dc87a027c8cf1d5d7 · yourselftoscience/yourselftoscience.org · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: OpenNext security

on:
  pull_request:
    paths:
      - 'src/**'
      - 'scripts/**'
      - 'public/**'
      - 'test/**'
      - 'next.config.mjs'
      - 'open-next.config.ts'
      - 'wrangler.jsonc'
      - 'package.json'
      - 'package-lock.json'
      - '.node-version'
      - '.github/workflows/agent-api-security.yml'
  push:
    branches: [main]
    paths:
      - 'src/**'
      - 'scripts/**'
      - 'public/**'
      - 'test/**'
      - 'next.config.mjs'
      - 'open-next.config.ts'
      - 'wrangler.jsonc'
      - 'package.json'
      - 'package-lock.json'
      - '.node-version'
      - '.github/workflows/agent-api-security.yml'

permissions:
  contents: read

jobs:
  validate-worker:
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Check out repository
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.23.1'
          cache: npm

      - name: Install locked dependencies
        run: npm ci

      - name: Validate migration invariants
        shell: bash
        run: |
          set -euo pipefail
          node --check next.config.mjs
          node --check src/middleware.js
          node --check src/lib/agentApi.js
          node --check scripts/extendAgentOpenApi.js
          node --check scripts/validateAgentArtifacts.js
          node --check scripts/enforceRuntimeAudit.js

          if grep -RInE --include='*.js' --include='*.jsx' --include='*.ts' --include='*.tsx' \
            "export const runtime[[:space:]]*=[[:space:]]*['\"]edge['\"]" src; then
            echo 'OpenNext does not support route-level Edge Runtime declarations.' >&2
            exit 1
          fi

          if grep -q '"@cloudflare/next-on-pages"' package.json package-lock.json; then
            echo 'Archived next-on-pages dependency remains in the repository.' >&2
            exit 1
          fi

      - name: Run security regression tests
        run: npm test

      - name: Regenerate and validate agent contracts
        run: |
          npm run update-openapi
          npm run extend-openapi
          npm run validate-agent-artifacts

      - name: Build OpenNext Worker
        env:
          NEXTJS_ENV: production
          NEXT_TELEMETRY_DISABLED: '1'
        run: npx opennextjs-cloudflare build

      - name: Validate Worker bundle and Free-plan size
        shell: bash
        run: |
          set -euo pipefail
          npx wrangler deploy --dry-run --outdir .wrangler-dry-run 2>&1 | tee wrangler-dry-run.log

          node <<'NODE'
          import fs from 'node:fs';

          const log = fs.readFileSync('wrangler-dry-run.log', 'utf8');
          const match = log.match(/gzip:\s*([0-9.]+)\s*(KiB|MiB)/i);
          if (!match) {
            throw new Error('Could not determine compressed Worker size from Wrangler output.');
          }

          const value = Number(match[1]);
          const kib = match[2].toLowerCase() === 'mib' ? value * 1024 : value;
          console.log(`Compressed Worker size: ${kib.toFixed(2)} KiB`);

          if (kib > 3072) {
            throw new Error(`Compressed Worker exceeds the Workers Free 3 MiB limit: ${kib.toFixed(2)} KiB`);
          }
          NODE

      - name: Generate dependency audit reports
        run: |
          npm audit --omit=dev --json > npm-audit-runtime.json || true
          npm audit --json > npm-audit-full.json || true

      - name: Upload validation reports
        uses: actions/upload-artifact@v4
        with:
          name: open-next-validation
          path: |
            npm-audit-runtime.json
            npm-audit-full.json
            wrangler-dry-run.log
          if-no-files-found: error
          retention-days: 14

      - name: Enforce runtime dependency audit
        run: node scripts/enforceRuntimeAudit.js npm-audit-runtime.json npm-audit-full.json