chore(deps-dev): bump the dev-dependencies group across 1 directory with 12 updates #1860
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["**"] | |
| pull_request: | |
| branches: ["**"] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| packages: ${{ steps.filter.outputs.packages }} | |
| web: ${{ steps.filter.outputs.web }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| # Root manifests + lockfile affect every workspace project - a | |
| # dependency-only change must not skip the test jobs. | |
| packages: | |
| - 'packages/**' | |
| - 'tsconfig.base.json' | |
| - 'package.json' | |
| - 'pnpm-workspace.yaml' | |
| - 'pnpm-lock.yaml' | |
| - '.github/workflows/ci.yml' | |
| web: | |
| - 'apps/web/**' | |
| - 'packages/**' | |
| - 'package.json' | |
| - 'pnpm-workspace.yaml' | |
| - 'pnpm-lock.yaml' | |
| - '.github/workflows/ci.yml' | |
| lint: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.packages == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Lint packages | |
| run: pnpm lint | |
| - name: Check formatting | |
| run: pnpm format:check | |
| typecheck-packages: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.packages == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| node-version: [20, 22] | |
| fail-fast: false | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Build abi-registry | |
| run: pnpm tsc -p packages/abi-registry/tsconfig.json | |
| - name: Build pulse-core | |
| run: pnpm tsc -p packages/pulse-core/tsconfig.json | |
| - name: Typecheck abi-registry | |
| run: pnpm tsc --noEmit -p packages/abi-registry/tsconfig.json | |
| - name: Typecheck pulse-webhooks | |
| run: pnpm tsc --noEmit -p packages/pulse-webhooks/tsconfig.json | |
| - name: Typecheck pulse-notify | |
| run: pnpm tsc --noEmit -p packages/pulse-notify/tsconfig.json | |
| - name: Typecheck anchor-sdk | |
| run: pnpm tsc --noEmit -p packages/anchor-sdk/tsconfig.json | |
| - name: Validate ABI specs | |
| run: pnpm --filter @orbital-stellar/abi-registry validate | |
| - name: Generate Horizon types & check drift | |
| run: | | |
| node scripts/generate-horizon-types.mjs | |
| git diff --exit-code packages/pulse-core/src/_raw-horizon.gen.ts || { | |
| echo "ERROR: Generated Horizon types are stale. Run 'pnpm generate:horizon-types' and commit the changes." | |
| exit 1 | |
| } | |
| - name: Test packages | |
| run: pnpm -r --if-present test | |
| bundle-size: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.packages == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Build abi-registry | |
| run: pnpm tsc -p packages/abi-registry/tsconfig.json | |
| - name: Build pulse-core | |
| run: pnpm tsc -p packages/pulse-core/tsconfig.json | |
| - name: Build pulse-notify | |
| run: pnpm tsc -p packages/pulse-notify/tsconfig.json | |
| - name: Check bundle size | |
| id: size | |
| run: pnpm --filter @orbital-stellar/pulse-notify size | |
| - name: Explain the budget failure | |
| # size-limit prints the size and the delta against the budget; --why | |
| # adds the top contributing modules, which is what you actually need to | |
| # decide whether a dependency or your own code moved the number. | |
| if: failure() && steps.size.outcome == 'failure' | |
| run: pnpm --filter @orbital-stellar/pulse-notify run size:why | |
| chaos-tests: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.packages == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| # pulse-core imports @orbital-stellar/abi-registry, which resolves to its | |
| # dist output - the suite cannot load without it built first. | |
| - name: Build abi-registry | |
| run: pnpm tsc -p packages/abi-registry/tsconfig.json | |
| # Fixed seed on PRs so a failure here is always reproducible from the | |
| # branch alone. nightly-chaos.yml runs the same suite with a random seed. | |
| - name: Reconnection chaos suite (fixed seed) | |
| env: | |
| CHAOS_SEED: "20260802" | |
| run: pnpm --filter @orbital-stellar/pulse-core exec vitest run test/chaos | |
| typecheck-web: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.web == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Build abi-registry | |
| run: pnpm tsc -p packages/abi-registry/tsconfig.json | |
| - name: Build pulse-core | |
| run: pnpm tsc -p packages/pulse-core/tsconfig.json | |
| - name: Build pulse-webhooks | |
| run: pnpm tsc -p packages/pulse-webhooks/tsconfig.json | |
| - name: Typecheck apps/web | |
| run: pnpm tsc --noEmit -p apps/web/tsconfig.json | |
| test-web: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.web == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| # apps/web imports pulse-core and pulse-webhooks from their built output. | |
| - name: Build workspace dependencies | |
| run: | | |
| pnpm tsc -p packages/abi-registry/tsconfig.json | |
| pnpm tsc -p packages/pulse-core/tsconfig.json | |
| pnpm tsc -p packages/pulse-webhooks/tsconfig.json | |
| - name: Test apps/web | |
| run: pnpm --filter orbital/web run test | |
| build-web: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.web == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| # orbital/web's prebuild builds pulse-core + pulse-webhooks (with their | |
| # workspace deps, incl. abi-registry) and generates reference docs, so | |
| # no manual dependency-order steps here. | |
| - name: Build apps/web | |
| env: | |
| # Canary secrets for the post-build client-bundle assertion. None of | |
| # these may appear in .next/static (#892, #926). | |
| DEMO_EMITTER_SECRET: SDEMOSECRET_CANARY_DO_NOT_SHIP_000000000000000000000000000 | |
| SOROBAN_INVOKER_SECRET: SINVOKER_CANARY_DO_NOT_SHIP_00000000000000000000000000000 | |
| UPSTASH_REDIS_REST_TOKEN: UPSTASH_CANARY_DO_NOT_SHIP_000000000000000000000000000 | |
| run: pnpm --filter orbital/web run build | |
| - name: Assert no secret reaches the client bundle | |
| env: | |
| # Canary values for every secret the web app can read; the assertion | |
| # greps .next/static for each. See SECURITY.md for the inventory. | |
| DEMO_EMITTER_SECRET: SDEMOSECRET_CANARY_DO_NOT_SHIP_000000000000000000000000000 | |
| SOROBAN_INVOKER_SECRET: SINVOKER_CANARY_DO_NOT_SHIP_00000000000000000000000000000 | |
| UPSTASH_REDIS_REST_TOKEN: UPSTASH_CANARY_DO_NOT_SHIP_000000000000000000000000000 | |
| run: node scripts/assert-no-secrets-in-bundle.mjs | |
| cli-smoke-test: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.packages == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Build abi-registry | |
| run: pnpm tsc -p packages/abi-registry/tsconfig.json | |
| - name: Build pulse-core | |
| run: pnpm tsc -p packages/pulse-core/tsconfig.json | |
| - name: Build pulse-webhooks | |
| run: pnpm tsc -p packages/pulse-webhooks/tsconfig.json | |
| - name: Smoke test pulse-core (--help, --version) | |
| run: | | |
| cd packages/pulse-core | |
| pnpm pack --pack-destination /tmp/orbital-smoke | |
| cd /tmp/orbital-smoke | |
| npm install -g ./orbital-stellar-pulse-core-*.tgz | |
| orbital --help | |
| orbital --version | |
| orbital cursor --help | |
| orbital typegen --help | |
| npm uninstall -g @orbital-stellar/pulse-core | |
| - name: Smoke test pulse-webhooks (--help, --version) | |
| run: | | |
| cd packages/pulse-webhooks | |
| pnpm pack --pack-destination /tmp/orbital-smoke | |
| cd /tmp/orbital-smoke | |
| npm install -g ./orbital-stellar-pulse-webhooks-*.tgz | |
| orbital-dlq --help | |
| orbital-dlq --version | |
| npm uninstall -g @orbital-stellar/pulse-webhooks | |
| - name: Smoke test abi-registry (--help, --version) | |
| run: | | |
| cd packages/abi-registry | |
| pnpm pack --pack-destination /tmp/orbital-smoke | |
| cd /tmp/orbital-smoke | |
| npm install -g ./orbital-stellar-abi-registry-*.tgz | |
| abi-registry-generate --help | |
| abi-registry-generate --version | |
| npm uninstall -g @orbital-stellar/abi-registry | |
| coverage: | |
| needs: changes | |
| if: ${{ needs.changes.outputs.packages == 'true' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6.0.9 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 20 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| # Every package must be built, not just abi-registry: workspace packages | |
| # resolve each other through their published `main` (./dist/index.js), so | |
| # a cross-package import in a test file - e.g. anchor-sdk's sep10 suite | |
| # importing WebAuth from pulse-core - fails to resolve without a dist. | |
| - name: Build packages | |
| run: pnpm build | |
| - name: Run coverage (thresholds enforced) | |
| run: pnpm -r --if-present test:coverage | |
| - name: Upload coverage reports | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage-reports | |
| path: | | |
| packages/*/coverage/ | |
| retention-days: 14 |