fix(ci): use one required pull-request gate

2026-08-29 03:35:32 +02:00
parent 408dea0c2d
commit 0b8deed1e3
1 changed files with 43 additions and 43 deletions
@@ -1,46 +1,46 @@
-name: ForgeFlow quality gate
+name: ForgeFlow quality gate
-
+
 on:
  push:
    branches: [main]
-  pull_request:
+  workflow_dispatch:
-
+
-jobs:
+jobs:
-  secret-scan:
+  secret-scan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
-    steps:
+    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
-      - name: Secret scan
+      - name: Secret scan
-        shell: bash
+        shell: bash
-        run: |
+        run: |
-          set -euo pipefail
+          set -euo pipefail
-          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
+          scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
-          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
+          trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
-          tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
+          tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
-          docker start -a "${scan_container}"
+          docker start -a "${scan_container}"
-
+
-  quality:
+  quality:
-    # Browser quality runs against the dedicated bounded Windows 11 VM runner.
+    # Browser quality runs against the dedicated bounded Windows 11 VM runner.
-    runs-on: windows-native
+    runs-on: windows-native
-    steps:
+    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4
-        with:
+        with:
-          node-version: 22
+          node-version: 22
-          cache: npm
+          cache: npm
-      - run: npm ci
+      - run: npm ci
-      # The native runner deliberately skips Electron's install-time binary
+      # The native runner deliberately skips Electron's install-time binary
-      # download. Prime it once before Node's parallel test workers require
+      # download. Prime it once before Node's parallel test workers require
-      # Electron, otherwise they can race while creating the same directory.
+      # Electron, otherwise they can race while creating the same directory.
-      - run: npx electron --version
+      - run: npx electron --version
-      - run: npm run quality
+      - run: npm run quality
-      - run: npx playwright install chromium
+      - run: npx playwright install chromium
-      - run: npm run test:browser:ci
+      - run: npm run test:browser:ci
-      - name: Preserve browser failure evidence
+      - name: Preserve browser failure evidence
-        if: failure()
+        if: failure()
-        uses: actions/upload-artifact@v3.2.2-node20
+        uses: actions/upload-artifact@v3.2.2-node20
-        with:
+        with:
-          name: forgeflow-browser-failure-evidence
+          name: forgeflow-browser-failure-evidence
-          path: artifacts/
+          path: artifacts/
-          if-no-files-found: ignore
+          if-no-files-found: ignore
-      - run: npm audit --omit=dev --audit-level=high
+      - run: npm audit --omit=dev --audit-level=high