feat: add Claude Code plugin bundling MCP server + motion/audit skills #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Least-privilege token: CI only needs to read the repo. | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs on the same ref to save runner time. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| node: [18, 20, 22] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| cache: npm | |
| - run: npm ci | |
| - run: npm test | |
| - name: Compiler smoke (deterministic artifacts) | |
| run: | | |
| node bin/motion.js compile examples/hero.motionspec.json | |
| node bin/motion.js compile examples/showcase.motionspec.json | |
| node bin/motion.js demo | |
| - name: Trust boundary smoke (must fail closed) | |
| run: | | |
| if node bin/motion.js compile examples/blocked-demo.motionspec.json; then | |
| echo "::error::blocked-demo passed the trust boundary"; exit 1 | |
| fi | |
| coverage: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Coverage gate (fails under 90% lines/functions of src/) | |
| run: npm run coverage | |
| - name: Catalog SemVer gate (ADR-0001 D2) | |
| run: npm run catalog-lock:check | |
| security: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Dependency audit (fail on any vuln) | |
| run: npm audit --audit-level=low | |
| - name: Regenerate SBOM, verify completeness, check licenses | |
| run: | | |
| npm run sbom | |
| npm run sbom:check | |
| node bin/license-check.js | |
| e2e: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Install Chromium (x86 runner — source of truth; @playwright/test is a pinned devDependency) | |
| run: npx playwright install chromium | |
| - name: Real-browser e2e (motion runs + reduced-motion path) | |
| run: npm run e2e | |
| - name: Upload Playwright report on failure | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: playwright-report | |
| path: | | |
| playwright-report/ | |
| test-results/ | |
| retention-days: 7 | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run lint |