FilesExpand file tree

develop

/

github-scripts-ci.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

76 lines (70 loc) · 3.35 KB

develop

/

github-scripts-ci.yml

Copy path

Top

File metadata and controls

• Code
• Blame

76 lines (70 loc) · 3.35 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

name: GitHub Scripts CI

# `.github/scripts/**` ships hand-rolled TypeScript (the AI review pipeline,

# the contribution gate) with its own `bun:test` suites, but `bun test` skips

# dot-directories by default and nothing previously type-checked this code in

# CI. This is a small, non-required check dedicated to that surface — it does

# not gate branch protection and never runs in `merge_group`.

on:

pull_request:

paths:

- ".github/scripts/**"

- "apps/cli/src/shared/services/Dockerfile"

- "apps/cli/src/shared/services/parse-dockerfile-service-images.ts"

- "apps/cli/src/shared/services/slim-images.ts"

- "packages/stack/src/Artifacts.ts"

- ".github/workflows/ai-review.yml"

- ".github/workflows/fast-forward.yml"

- ".github/workflows/lint-pull-request.yml"

- ".github/workflows/sync-branches.yml"

- "apps/cli/scripts/analyze-commits-title.js"

- ".github/workflows/github-scripts-ci.yml"

- ".github/workflows/mirror-slim-image.yml"

permissions: {}

concurrency:

group: github-scripts-ci-${{ github.event.pull_request.number }}

cancel-in-progress: true

jobs:

test:

name: Test and type-check

runs-on: ubuntu-latest

# The shared setup installs the full workspace + Go toolchain via mise, which

# runs ~9-10 min; a 10-minute cap raced the install and got cancelled on a

# cold cache. 20 gives that install headroom. (This check is heavier than it

# needs to be for two scripts — slimming the setup is a possible follow-up.)

timeout-minutes: 20

permissions:

contents: read

steps:

- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

with:

persist-credentials: false

# The shared setup installs the toolchain (bun/pnpm/node via mise) AND the

# workspace dependencies, so the type-check below can resolve

# `@tsconfig/bun` + `@types/bun` from `node_modules`. `setup-bun` alone

# left those uninstalled, which is what failed this check originally. On

# fork PRs the firewall token is empty and the shared setup falls back to

# the public npm registry, so this stays fork-safe.

- uses: ./.github/actions/setup

with:

dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}

- name: Run tests

run: |

set -uo pipefail

# The root `test:github-scripts` script runs `bun test ./.github/scripts`;

# its leading "./" is load-bearing, since `bun test .github/scripts`

# silently discovers ZERO tests and still exits 0. Capture output to a

# file instead of piping it, so `test_exit` below is the script's own

# exit code, not `tee`/`grep`'s.

pnpm run test:github-scripts > /tmp/github-scripts-test-output.txt 2>&1

test_exit=$?

cat /tmp/github-scripts-test-output.txt

if [ "$test_exit" -ne 0 ]; then

echo "::error ::bun test failed (exit $test_exit)." >&2

exit 1

fi

if ! grep -Eq 'Ran [1-9][0-9]* tests' /tmp/github-scripts-test-output.txt; then

echo "::error ::bun test reported no tests ran (missing 'Ran N tests' with N>0) — the leading './' may have been dropped, or test discovery is otherwise broken." >&2

exit 1

fi

- name: Type-check

run: bun x tsc --noEmit -p .github/scripts/tsconfig.json