build(deps): bump actions/setup-node from 6 to 7 (#488) #1364
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| packages: read | |
| jobs: | |
| # Build once, enumerate the test groups (unit + per-domain/house a11y), and | |
| # hand both to the fan-out below. dist/ is the a11y suite's input. | |
| build: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| groups: ${{ steps.list.outputs.groups }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: "npm" | |
| - name: install | |
| run: npm ci | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: prettier check | |
| run: npm run format:check | |
| - name: build | |
| run: npm run build | |
| - name: enumerate test groups | |
| id: list | |
| run: echo "groups=$(node scripts/khai-tests.mjs --list)" >> "$GITHUB_OUTPUT" | |
| - name: upload built site | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: dist | |
| path: dist | |
| retention-days: 1 | |
| # One check per group ("khai-tests (unit)", "khai-tests (plays-grimm-1)", ...), | |
| # run in parallel. Each downloads the prebuilt site and runs only its group, so | |
| # the per-page jsdom heap stays bounded however large a house grows. | |
| khai-tests: | |
| needs: build | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| group: ${{ fromJSON(needs.build.outputs.groups) }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: "npm" | |
| - name: install | |
| run: npm ci | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: download built site | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: dist | |
| path: dist | |
| - name: ${{ matrix.group }} | |
| run: node scripts/khai-tests.mjs --group "${{ matrix.group }}" | |
| # Single required status check: green only when build and EVERY group passed. | |
| # `if: always()` is essential -- a `needs` job is skipped when a dependency | |
| # fails, and branch protection treats a skipped required check as passing, so | |
| # the gate must run regardless and fail explicitly. Point branch protection at | |
| # THIS job (khai-tests-gate), not the matrix, whose check names vary by group. | |
| khai-tests-gate: | |
| needs: [build, khai-tests] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: require build + all groups to pass | |
| run: | | |
| echo "build=${{ needs.build.result }} khai-tests=${{ needs.khai-tests.result }}" | |
| [ "${{ needs.build.result }}" = "success" ] || { echo "build failed"; exit 1; } | |
| [ "${{ needs.khai-tests.result }}" = "success" ] || { echo "a test group failed"; exit 1; } | |
| khai-guard: | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: "npm" | |
| - name: install | |
| run: npm ci | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: source/test separation gate | |
| run: npx khai-guard --base "${{ github.event.pull_request.base.sha }}" --head "${{ github.event.pull_request.head.sha }}" | |
| branch-scope: | |
| # The branch-NAME-to-lane gate (see docs/BRANCHING.md). ENFORCED: with no | |
| # KHAI_GUARD_BRANCH_ADVISORY env, branch-check exits 1 on a violation and | |
| # this job fails. To make it BLOCK merges, add "branch-scope" to the | |
| # required status checks in branch protection (an admin setting; no change | |
| # to @chbrain/khai-guard is needed). To temporarily relax, set | |
| # KHAI_GUARD_BRANCH_ADVISORY=1 here again. | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: "npm" | |
| - name: install | |
| run: npm ci | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: branch-scope lane gate | |
| # On a PR, actions/checkout leaves a detached HEAD (the merge commit), | |
| # so pass the PR head ref via --branch for the lane classification and | |
| # the PR base/head as the diff range (matching the source/test gate). | |
| run: npx khai-guard branch-check --branch "${{ github.head_ref }}" --base "${{ github.event.pull_request.base.sha }}" --head "${{ github.event.pull_request.head.sha }}" |