Test/watchlist 01 component (#581) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| build-and-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "20" | |
| cache: "npm" | |
| # Lockfile-drift guard: verify the committed lockfile is in sync with | |
| # package.json by regenerating it and comparing (ignoring the | |
| # platform-specific fsevents entry which varies across Node versions). | |
| - name: Check lockfile is in sync | |
| run: | | |
| cp package-lock.json /tmp/pkg-lock-orig.json | |
| npm install --package-lock-only --ignore-scripts | |
| # Restore the fsevents block from the original so the diff only | |
| # reflects substantive changes. | |
| node -e " | |
| const orig = require('fs').readFileSync('/tmp/pkg-lock-orig.json','utf8'); | |
| const curr = require('fs').readFileSync('package-lock.json','utf8'); | |
| const re = /\"node_modules\\/playwright\\/node_modules\\/fsevents\": \{[\s\S]*?\n \},?\n?/g; | |
| const origClean = orig.replace(re, ''); | |
| const currClean = curr.replace(re, ''); | |
| if (origClean !== currClean) { | |
| console.error('Lockfile is out of sync with package.json'); | |
| process.exit(1); | |
| } | |
| " | |
| echo 'Lockfile is in sync' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Format Check | |
| run: npm run format:check | |
| - name: Build | |
| run: npm run build | |
| - name: Test Accessibility | |
| run: npm test --silent | |
| security-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7.0.0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: "20" | |
| # Audit dependencies for high or critical vulnerabilities. | |
| # As the app handles financial flows and wallet integration, | |
| # keeping dependencies secure is critical. | |
| # To waive a false-positive, use 'npm audit fix' or update the package manually. | |
| - name: Dependency Audit | |
| run: npm audit --audit-level=high | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # fetch-depth: 0 is required for gitleaks to scan the full history/diff. | |
| - uses: actions/checkout@v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| # Run Gitleaks to detect hardcoded secrets (API keys, tokens, etc.) in the repository. | |
| - name: Secret Scan | |
| run: | | |
| curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.24.3/gitleaks_8.24.3_linux_x64.tar.gz \ | |
| | tar xz -C /usr/local/bin gitleaks | |
| gitleaks detect --no-banner --source . -v |