chore(dev): release 5.3.1-beta.3 #327
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI CI | |
| on: | |
| push: | |
| branches: [ dev, production ] | |
| pull_request: | |
| # `production` is included so the dev→production promotion PR is also gated | |
| # by lint/typecheck/build (and is required by the production ruleset). | |
| branches: [ dev, production ] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (full history) | |
| uses: actions/checkout@v7 | |
| with: | |
| # Full history so gitleaks scans every commit, not just the tip. | |
| fetch-depth: 0 | |
| - name: Run gitleaks | |
| env: | |
| # Pinned release; bump deliberately. Run the binary directly rather than | |
| # gitleaks/gitleaks-action@v2, which requires a paid GITLEAKS_LICENSE for | |
| # organization-owned repos. | |
| GITLEAKS_VERSION: 8.30.1 | |
| run: | | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz gitleaks | |
| # --log-opts=HEAD scopes the scan to commits reachable from what's | |
| # checked out: the whole history of this branch (or of the PR merge | |
| # commit, i.e. base + PR commits), but NOT unrelated branches. | |
| # `fetch-depth: 0` fetches refs/heads/* — every branch — and gitleaks | |
| # otherwise scans all of them, so an open branch that legitimately | |
| # commits a high-entropy value plus its own .gitleaks.toml allowlist | |
| # would fail every OTHER branch's scan, which is judged against the | |
| # allowlist at its own tip. Each branch is still fully scanned by its | |
| # own PR, and pushes to dev/production scan their full history. | |
| ./gitleaks git . --redact --verbose --no-banner --log-opts=HEAD | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| # This repo is PUBLIC and runs no step that reaches into the private | |
| # devicecloud-dev/dcd repo. It used to check out that repo's mock-api over an | |
| # SSH deploy key to run test/integration/*, which meant a private-repo | |
| # credential lived in a public repo's secrets and the API's OpenAPI spec was | |
| # pulled onto the runner on every same-repo PR. dcd#1036 deleted that mock-api; | |
| # rather than re-point at it, the linkage is gone. | |
| # | |
| # The consequence is deliberate: test/integration/* does NOT run here, and | |
| # neither does the swagger contract-drift check it provided (spec drift used to | |
| # surface as a Prism 422). Only test/unit/* runs — pure, no backend. To run the | |
| # integration suite locally, point MOCK_API_DIR at a mock; see CLAUDE.md. | |
| steps: | |
| - name: Checkout CLI | |
| uses: actions/checkout@v7 | |
| with: | |
| path: cli | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6.0.10 | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: 'pnpm' | |
| cache-dependency-path: './cli/pnpm-lock.yaml' | |
| - name: Install CLI dependencies | |
| working-directory: ./cli | |
| run: pnpm install --frozen-lockfile | |
| - name: Run CLI linter | |
| working-directory: ./cli | |
| run: pnpm lint | |
| - name: Type check (strict, src + tests) | |
| working-directory: ./cli | |
| run: pnpm typecheck | |
| - name: Run CLI unit tests | |
| working-directory: ./cli | |
| run: pnpm test:unit | |
| - name: Note skipped integration tests | |
| run: echo "::notice::Integration tests are not run in CI — they need a mock of the dcd API, and this public repo does not reach into the private one. Lint, typecheck, unit tests, build and audit all ran." | |
| - name: Build CLI | |
| working-directory: ./cli | |
| run: pnpm build | |
| - name: Security audit | |
| working-directory: ./cli | |
| run: pnpm audit --audit-level moderate |