alisaza
a307400f83
Move workflows under .gitea/workflows and publish images to git.ghabilee.ir instead of ghcr.io so deploy runs on self-hosted Gitea.
69 lines
1.7 KiB
YAML
69 lines
1.7 KiB
YAML
name: Admin quality
|
|
|
|
on:
|
|
workflow_call:
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: admin-quality-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
dependency-scan:
|
|
name: Dependency vulnerability scan
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: google/osv-scanner-action/osv-scanner-action@v2.3.8
|
|
with:
|
|
scan-args: --lockfile=pnpm-lock.yaml
|
|
|
|
secret-scan:
|
|
name: Secret scan
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: gitleaks/gitleaks-action@v3
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
verify:
|
|
name: Build, test, and quality checks
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 10.28.2
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: pnpm
|
|
cache-dependency-path: pnpm-lock.yaml
|
|
- run: pnpm install --frozen-lockfile
|
|
- name: Generate API client from committed OpenAPI
|
|
run: pnpm exec orval --config orval.config.ts
|
|
- run: pnpm typecheck
|
|
- run: pnpm lint
|
|
- name: Production build and bundle budget
|
|
run: pnpm exec next build && pnpm bundle:check
|
|
env:
|
|
NEXT_PUBLIC_API_URL: http://127.0.0.1:3000
|
|
- name: Verify generated API client
|
|
run: |
|
|
set -euo pipefail
|
|
pnpm exec orval --config orval.config.ts
|
|
git diff --exit-code -- api/generated
|
|
- run: pnpm test
|
|
- run: pnpm architecture:check
|
|
- run: pnpm unused:check
|