João Salavisa
f26befdc33
Co-authored-by: Kandev Agent <agent@kandev.dev> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
207 lines
8.1 KiB
YAML
207 lines
8.1 KiB
YAML
name: Frontend Tests
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "apps/cli/**"
|
|
- "apps/package.json"
|
|
- "apps/prettier.config.mjs"
|
|
- "apps/.prettierignore"
|
|
- "apps/web/**"
|
|
- "apps/packages/**"
|
|
- "apps/pnpm-lock.yaml"
|
|
- "apps/backend/go.mod"
|
|
- "apps/backend/go.sum"
|
|
- ".github/workflows/frontend-tests.yml"
|
|
- "!**/*.md"
|
|
- "!**/*.mdx"
|
|
- "!**/*.markdown"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- "apps/cli/**"
|
|
- "apps/package.json"
|
|
- "apps/prettier.config.mjs"
|
|
- "apps/.prettierignore"
|
|
- "apps/web/**"
|
|
- "apps/packages/**"
|
|
- "apps/pnpm-lock.yaml"
|
|
- "apps/backend/go.mod"
|
|
- "apps/backend/go.sum"
|
|
- ".github/workflows/frontend-tests.yml"
|
|
- "!**/*.md"
|
|
- "!**/*.mdx"
|
|
- "!**/*.markdown"
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
# Least-privilege: the `frontend` job only reads source and runs tests.
|
|
# `packages: read` lets the container job pull the kandev-ci image from GHCR.
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
|
|
jobs:
|
|
frontend:
|
|
name: Run Frontend Lint, Tests, and Build
|
|
runs-on: ubuntu-latest
|
|
# Pre-baked image bundles Node 24, pnpm 9.15.9, Go, and go-licenses —
|
|
# see .github/docker/ci-base/Dockerfile.
|
|
container: ghcr.io/kdlbs/kandev-ci:build-latest
|
|
defaults:
|
|
run:
|
|
# Container jobs default to `sh` (dash); pin to bash for `set -euo
|
|
# pipefail` and other bash-isms used by the formatting / licenses steps.
|
|
shell: bash
|
|
working-directory: apps
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Mark workspace safe for git
|
|
shell: bash
|
|
working-directory: ${{ github.workspace }}
|
|
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
|
|
- name: Cache pnpm store
|
|
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
|
|
with:
|
|
path: ~/.local/share/pnpm/store
|
|
key: pnpm-${{ runner.os }}-${{ hashFiles('apps/pnpm-lock.yaml') }}
|
|
restore-keys: pnpm-${{ runner.os }}-
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Regenerate OSS licenses manifest
|
|
run: pnpm --filter @kandev/web licenses:gen
|
|
|
|
- name: Verify licenses manifest is fresh
|
|
shell: bash
|
|
continue-on-error: true
|
|
run: |
|
|
set -euo pipefail
|
|
# `defaults.run.working-directory` is `apps`, so the path is relative.
|
|
# The diff is reported as a warning, not a hard failure: `go-licenses`
|
|
# resolves slightly different license metadata across platforms (macOS
|
|
# dev vs. ubuntu CI) for the same Go modules, and we have not yet
|
|
# eliminated that drift. The committed file is still the source of
|
|
# truth for what the page renders.
|
|
if ! git diff --quiet --exit-code web/generated/licenses.json; then
|
|
echo "::warning::apps/web/generated/licenses.json differs from a fresh re-run."
|
|
echo "::warning::Run 'pnpm --filter @kandev/web licenses:gen' and commit if the drift is real."
|
|
git --no-pager diff --stat web/generated/licenses.json || true
|
|
fi
|
|
|
|
- name: Check formatting
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# On `pull_request` the checkout is the MERGE REF, whose first parent is
|
|
# the base branch tip. `pull_request.base.sha` is the base tip from when
|
|
# the PR event fired, so it is an ANCESTOR of that merge ref — which
|
|
# makes `base...HEAD` collapse to a two-dot diff and list everything
|
|
# main landed since the PR opened. Over-broad is harmless here (the
|
|
# extra files are already formatted), but it is the same trap the i18n
|
|
# ratchet below hit for real, so do not copy the old idiom. The fork
|
|
# point is what "changed in this PR" actually means.
|
|
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
|
|
BASE_SHA="$(git merge-base HEAD "origin/${{ github.base_ref }}")"
|
|
else
|
|
BASE_SHA="${{ github.event.before }}"
|
|
fi
|
|
|
|
if [[ -z "${BASE_SHA}" || "${BASE_SHA}" == "0000000000000000000000000000000000000000" ]]; then
|
|
BASE_SHA="$(git rev-list --max-parents=0 HEAD)"
|
|
fi
|
|
|
|
CHANGED_FILES="$(
|
|
git diff --name-only --diff-filter=ACMRT "${BASE_SHA}" HEAD \
|
|
| grep -E '^apps/(web|cli|packages)/.*\.(ts|tsx|js|jsx|mjs|cjs|json|md|mdx|yml|yaml|css|scss)$' \
|
|
|| true
|
|
)"
|
|
|
|
if [[ -z "${CHANGED_FILES}" ]]; then
|
|
echo "No Prettier-scoped files changed."
|
|
exit 0
|
|
fi
|
|
|
|
# Skip symlinks — prettier errors with exit 123 when an explicit
|
|
# pattern is a symbolic link. CLAUDE.md files in the tree are symlinks
|
|
# to sibling AGENTS.md files (Codex / Claude Code convention).
|
|
FILES_TO_CHECK="$(
|
|
echo "${CHANGED_FILES}" \
|
|
| sed 's#^apps/##' \
|
|
| while IFS= read -r f; do [ -L "$f" ] || echo "$f"; done
|
|
)"
|
|
|
|
if [[ -z "${FILES_TO_CHECK}" ]]; then
|
|
echo "No non-symlink Prettier-scoped files changed."
|
|
exit 0
|
|
fi
|
|
|
|
echo "Checking Prettier on changed files:"
|
|
echo "${FILES_TO_CHECK}"
|
|
echo "${FILES_TO_CHECK}" | xargs pnpm exec prettier --check --ignore-unknown
|
|
|
|
- name: Run lint
|
|
run: pnpm --filter @kandev/web lint
|
|
|
|
# Unlike the eslint literal-string guard (scoped to already-migrated paths
|
|
# via i18nGuardFiles), these four checks scan components/app/hooks/lib
|
|
# repo-wide. Each one pins a class of i18n bug that fails silently at
|
|
# runtime: a key with no catalog entry, <Trans> tag markup rendered
|
|
# verbatim, an English plural ending passed as a value, and t() at module
|
|
# scope frozen at the boot locale. See docs/i18n.md.
|
|
- name: Run i18n checks
|
|
run: pnpm --filter @kandev/web i18n:check
|
|
|
|
# New-code ratchet. The eslint literal guard is an error only on migrated
|
|
# paths, which leaves new files under un-migrated directories unguarded.
|
|
# These two judge the CHANGE instead of the FILE: an added file must be
|
|
# clean outright, a modified file only on the lines it touched, and the
|
|
# guard allowlist may not shrink. Same model as
|
|
# `golangci-lint --new-from-rev` for Go.
|
|
- name: Run i18n new-code ratchet
|
|
shell: bash
|
|
# The job defaults to `apps`; these scripts live one level deeper.
|
|
working-directory: apps/web
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# DO NOT pass --base on pull_request. The checkout is the merge ref
|
|
# `refs/pull/N/merge`, and `pull_request.base.sha` is the base branch tip
|
|
# from when the PR event fired — an ancestor of that merge ref. Handing
|
|
# it in made the ratchet judge every commit main landed since the PR
|
|
# opened as this PR's new code, failing PRs on files they never touched
|
|
# (#2160). The scripts' own default, `merge-base HEAD origin/main`,
|
|
# resolves to the merge ref's base-side parent and is correct here;
|
|
# origin/main is present because the checkout is fetch-depth: 0.
|
|
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
|
|
node scripts/run-i18n-ratchet.mjs
|
|
exit 0
|
|
fi
|
|
|
|
# push: HEAD *is* the new base branch tip, so there is no fork point to
|
|
# find and the previous tip is the only meaningful base.
|
|
BASE_SHA="${{ github.event.before }}"
|
|
if [[ -z "${BASE_SHA}" || "${BASE_SHA}" == "0000000000000000000000000000000000000000" ]]; then
|
|
echo "No usable base SHA; skipping the new-code ratchet."
|
|
exit 0
|
|
fi
|
|
|
|
node scripts/run-i18n-ratchet.mjs --base "${BASE_SHA}"
|
|
|
|
- name: Run tests
|
|
run: pnpm --filter @kandev/web test
|
|
|
|
- name: Build
|
|
run: pnpm --filter @kandev/web build
|