chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 #17
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| NODE_VERSION: "22.22.1" | |
| # Public Clerk demo key so `next build` and the smoke specs can boot without secrets. | |
| DUMMY_CLERK_PUBLISHABLE_KEY: pk_test_dGVzdC5jbGVyay5hY2NvdW50cy5kZXYk | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run lint | |
| typecheck: | |
| name: Type Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run typecheck | |
| unit: | |
| name: Unit Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run test:unit | |
| - run: npm run test:ee-unit | |
| build: | |
| name: Build (core mode) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run build | |
| env: | |
| NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ env.DUMMY_CLERK_PUBLISHABLE_KEY }} | |
| CLERK_SECRET_KEY: dummy_clerk_secret | |
| NEXT_PUBLIC_APP_URL: http://localhost:3000 | |
| # Standard runners default to a ~2GB heap, which OOMs this build. | |
| NODE_OPTIONS: --max-old-space-size=6144 | |
| boundary: | |
| name: Open-core boundary | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Core must not import the enterprise layer directly | |
| run: | | |
| set -euo pipefail | |
| # Legacy paths that moved under src/ee must not be referenced anywhere. | |
| if git grep -nE '@/(lib/billing|lib/stripe|config/billing)' -- src scripts tests; then | |
| echo "::error::Found imports of pre-split billing paths"; exit 1 | |
| fi | |
| # Only adapters and route shims may import @/ee (mirrors the ESLint rule). | |
| # Note: git pathspec "**" requires at least one directory segment, unlike | |
| # ESLint's glob engine, so the top-level src/app/{page,layout}.tsx need | |
| # their own exclusion in addition to the src/app/**/... ones. | |
| offenders=$(git grep -ln '@/ee' -- 'src/**' \ | |
| ':!src/ee/**' ':!src/lib/access/**' \ | |
| ':!src/app/page.tsx' ':!src/app/layout.tsx' \ | |
| ':!src/app/**/page.tsx' ':!src/app/**/layout.tsx' \ | |
| ':!src/app/**/route.ts' ':!src/app/actions/**' ':!src/app/sitemap.ts' \ | |
| ':!src/lib/machine-route-bypass.ts' ':!src/components/shared/consent-banner.tsx' || true) | |
| if [ -n "$offenders" ]; then | |
| echo "::error::Core files importing @/ee outside the allowlist:"; echo "$offenders"; exit 1 | |
| fi | |
| audit: | |
| name: Dependency Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: npm | |
| - run: npm ci | |
| # Scope the gate to production dependencies: dev-only tooling never ships | |
| # to the deployed app, so this blocks real advisories without going | |
| # permanently red on dev-only ones upstream cannot yet fix. | |
| - run: npm audit --omit=dev --audit-level=high | |
| e2e: | |
| name: Playwright E2E | |
| runs-on: ubuntu-latest | |
| needs: [lint, typecheck, unit, build] | |
| # Forked PRs never receive repository secrets; skip instead of failing. | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| CI: true | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: npm | |
| - run: npm ci | |
| - name: Check for e2e secrets | |
| id: secrets | |
| env: | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| run: | | |
| if [ -n "$DATABASE_URL" ]; then echo "available=true" >> "$GITHUB_OUTPUT"; else echo "available=false" >> "$GITHUB_OUTPUT"; fi | |
| - name: Skip notice | |
| if: steps.secrets.outputs.available != 'true' | |
| run: echo "::notice::E2E skipped — repository secrets are not configured" | |
| - name: Install Playwright | |
| if: steps.secrets.outputs.available == 'true' | |
| run: npx playwright install chromium --with-deps | |
| - name: Run Playwright smoke tests | |
| if: steps.secrets.outputs.available == 'true' | |
| run: npm run test:e2e:ci | |
| env: | |
| DATABASE_URL: ${{ secrets.DATABASE_URL }} | |
| NEXT_PUBLIC_APP_URL: http://localhost:3000 | |
| NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ secrets.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }} | |
| CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }} | |
| CLERK_TESTING_TOKEN: ${{ secrets.CLERK_TESTING_TOKEN }} | |
| STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }} | |
| UPSTASH_REDIS_REST_URL: ${{ secrets.UPSTASH_REDIS_REST_URL }} | |
| UPSTASH_REDIS_REST_TOKEN: ${{ secrets.UPSTASH_REDIS_REST_TOKEN }} | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: ${{ steps.secrets.outputs.available == 'true' && !cancelled() }} | |
| with: | |
| name: playwright-report | |
| path: playwright-report/ | |
| retention-days: 14 | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| if: ${{ steps.secrets.outputs.available == 'true' && failure() }} | |
| with: | |
| name: test-results | |
| path: test-results/ | |
| retention-days: 7 |