MHSanaei
9fc47b3d41
- ci.yml: only run on Go/frontend source and lockfiles. - codeql.yml: scope push/PR triggers to Go and JS/TS sources; weekly cron still does a full scan. - release.yml: add matching paths allowlist to pull_request so doc/workflow-only PRs don't kick off the multi-arch build. Skips workflow runs on changes to docs, translations, GitHub configs, and unrelated scripts.
92 lines
2.1 KiB
YAML
92 lines
2.1 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- "**.go"
|
|
- "go.mod"
|
|
- "go.sum"
|
|
- "**.js"
|
|
- "**.mjs"
|
|
- "**.cjs"
|
|
- "**.ts"
|
|
- "**.vue"
|
|
- "**.html"
|
|
- "**.css"
|
|
- "frontend/package.json"
|
|
- "frontend/package-lock.json"
|
|
- ".nvmrc"
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "**.go"
|
|
- "go.mod"
|
|
- "go.sum"
|
|
- "**.js"
|
|
- "**.mjs"
|
|
- "**.cjs"
|
|
- "**.ts"
|
|
- "**.vue"
|
|
- "**.html"
|
|
- "**.css"
|
|
- "frontend/package.json"
|
|
- "frontend/package-lock.json"
|
|
- ".nvmrc"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
go-test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
- name: Stub web/dist for go:embed
|
|
run: mkdir -p web/dist && touch web/dist/.gitkeep
|
|
- name: Test
|
|
run: |
|
|
go list ./... | grep -v '/frontend/node_modules/' > /tmp/go-packages.txt
|
|
go test $(cat /tmp/go-packages.txt)
|
|
|
|
govulncheck:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
- name: Stub web/dist for go:embed
|
|
run: mkdir -p web/dist && touch web/dist/.gitkeep
|
|
- name: Install govulncheck
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
- name: Run govulncheck
|
|
run: govulncheck ./...
|
|
|
|
frontend:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version-file: .nvmrc
|
|
cache: npm
|
|
cache-dependency-path: frontend/package-lock.json
|
|
- name: Install
|
|
run: npm ci
|
|
working-directory: frontend
|
|
- name: Lint
|
|
run: npm run lint
|
|
working-directory: frontend
|
|
- name: Build
|
|
run: npm run build
|
|
working-directory: frontend
|
|
- name: Audit
|
|
run: npm audit --audit-level=high
|
|
working-directory: frontend
|