47 lines
1.8 KiB
YAML
47 lines
1.8 KiB
YAML
name: ForgeFlow quality gate
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
secret-scan:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- name: Secret scan
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
scan_container="$(docker create ghcr.io/trufflesecurity/trufflehog:3.79.0 filesystem /scan --only-verified --fail --no-update)"
|
|
trap 'docker rm -f "${scan_container}" >/dev/null 2>&1 || true' EXIT
|
|
tar --exclude=.git --transform='s#^\.$#scan#;s#^\./#scan/#' -cf - . | docker cp - "${scan_container}:/"
|
|
docker start -a "${scan_container}"
|
|
|
|
quality:
|
|
# Browser quality runs against the dedicated bounded Windows 11 VM runner.
|
|
runs-on: windows-native
|
|
steps:
|
|
- uses: https://gitea.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- uses: https://gitea.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- run: npm ci
|
|
# The native runner deliberately skips Electron's install-time binary
|
|
# download. Prime it once before Node's parallel test workers require
|
|
# Electron, otherwise they can race while creating the same directory.
|
|
- run: npx electron --version
|
|
- run: npm run quality
|
|
- run: npx playwright install chromium
|
|
- run: npm run test:browser:ci
|
|
- name: Preserve browser failure evidence
|
|
if: failure()
|
|
uses: https://gitea.com/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: forgeflow-browser-failure-evidence
|
|
path: artifacts/
|
|
if-no-files-found: ignore
|
|
- run: npm audit --omit=dev --audit-level=high
|