Bump the minor-and-patch group with 5 updates #152
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| # Cancel superseded runs on the same ref (e.g. when a PR is force-pushed). | |
| # `main` keeps in-progress runs because we usually want every commit on main | |
| # to produce a final result. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| build-and-quality: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| # Node 24 (Krypton) is the current active LTS, EOL 2028-04-30. | |
| # Node 20 went EOL 2026-04-30 and is below the floor declared by | |
| # puppeteer-core and size-limit (engines.node >= 22.12.0), which is | |
| # what the EBADENGINE warnings on every `npm ci` were about. | |
| node-version: 24 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Audit dependencies | |
| # Fails on HIGH or CRITICAL CVEs in installed packages. Escape hatches | |
| # if a transitive vuln has no upstream fix yet, in order of preference: | |
| # 1. `npm audit fix` (or `--force` only after verifying the bumps | |
| # are non-breaking) — usually resolves it. | |
| # 2. Pin the offender via `package.json` `overrides` to a patched | |
| # version if one exists. | |
| # 3. As a last resort, temporarily relax to `--audit-level=critical` | |
| # here and leave a comment pointing at the advisory + why we're | |
| # accepting it. Avoid `|| true`; that hides everything. | |
| run: npm audit --audit-level=high | |
| - name: Validate program data files | |
| run: npm run validate-data | |
| - name: Run lint checks | |
| run: npm run lint | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| - name: Build project | |
| run: npm run build | |
| - name: Check bundle size | |
| # Fails when the brotlied client JS exceeds the budget in | |
| # `package.json` → `size-limit`. Bump the limit deliberately when an | |
| # increase is justified (new feature, dep upgrade); the diff documents | |
| # why. | |
| # | |
| # The budget now covers two things that grow independently, because | |
| # production chunk names are fully hashed and size-limit cannot tell | |
| # them apart: | |
| # ~201 kB application JS | |
| # ~50 kB the committed cohort archive (src/data/cohorts/*.json), | |
| # ~2 kB brotlied per cohort file | |
| # Each cohort file is its own lazily-loaded chunk, so an unselected | |
| # cohort costs a viewer nothing — but every one counts here. When this | |
| # fails, check `du -sh src/data/cohorts` before assuming the app grew. | |
| run: npm run size |