ci: bulletproof pipeline (parallel jobs, ci-gate, CODEOWNERS, security workflows) #101
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [dev, main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| defaults: | |
| run: | |
| working-directory: extension | |
| jobs: | |
| typecheck: | |
| name: Type check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: extension/package-lock.json | |
| - run: npm ci | |
| - run: npm run check-types | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: extension/package-lock.json | |
| - run: npm ci | |
| - run: npm run lint | |
| test: | |
| name: Unit tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: extension/package-lock.json | |
| - run: npm ci | |
| - run: npx vitest run | |
| knip: | |
| name: Dead code (knip) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: extension/package-lock.json | |
| - run: npm ci | |
| - run: npm run knip | |
| build: | |
| name: Build & VSIX package | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: extension/package-lock.json | |
| - run: npm ci | |
| - run: npm run package | |
| - run: npx @vscode/vsce package --no-dependencies | |
| ci-gate: | |
| name: CI gate | |
| needs: [typecheck, lint, test, knip, build] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 1 | |
| if: always() | |
| defaults: | |
| run: | |
| working-directory: . | |
| steps: | |
| - name: Verify all required jobs succeeded | |
| env: | |
| NEEDS: ${{ toJSON(needs) }} | |
| run: | | |
| set -euo pipefail | |
| echo "Job results: $NEEDS" | |
| if echo "$NEEDS" | jq -e '[.[] | .result] | any(. != "success")' > /dev/null; then | |
| echo "::error::One or more required CI jobs did not succeed" | |
| exit 1 | |
| fi | |
| echo "All CI jobs passed." |