43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
name: ForgeFlow quality gate
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
secret-scan:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Secret scan
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
|
|
trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
|
|
tar --exclude=.git -cf - . | docker cp - "${scan_container}:/scan"
|
|
docker start -a "${scan_container}"
|
|
|
|
quality:
|
|
# Browser quality runs against the dedicated bounded Windows 11 VM runner.
|
|
runs-on: windows-native
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm run quality
|
|
- run: npx playwright install chromium
|
|
- run: npm run test:browser:ci
|
|
- name: Preserve browser failure evidence
|
|
if: failure()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: forgeflow-browser-failure-evidence
|
|
path: artifacts/
|
|
if-no-files-found: ignore
|
|
- run: npm audit --omit=dev --audit-level=high
|