Repository navigation
CI: key concurrency on the source repo; fix MD022 in MEMORY.md #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["**"] | |
| pull_request: | |
| # Nothing here touches the GitHub API beyond checkout, so the token needs no | |
| # write scope; an explicit block also stops it inheriting wider repo defaults. | |
| permissions: | |
| contents: read | |
| # A branch push and its pull_request event overlap constantly. Superseded runs | |
| # only tie up runners and delay the checks that matter. | |
| # | |
| # github.ref alone does NOT dedupe them: a push is refs/heads/<branch> while the | |
| # pull_request event is refs/pull/<n>/merge, so both ran on every push to a PR | |
| # branch. The pair only collapses if both sides render the same bare branch | |
| # name: head_ref is the source branch on a pull_request and empty on a push, | |
| # and ref_name is the branch name without the refs/heads/ prefix (github.ref | |
| # would keep it and miss the match). | |
| # | |
| # The branch name alone is not unique across repositories, though: two pull | |
| # requests opened from different forks on a branch both named `feature` would | |
| # share a group, and cancel-in-progress would have them kill each other's | |
| # checks. Keying on the source repo as well keeps forks apart, and still | |
| # collapses the push/pull_request pair for a same-repo branch, where | |
| # head.repo.full_name and github.repository are the same string. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Nothing after this step talks to GitHub, so leaving the token in | |
| # .git/config only widens what a compromised dependency can reach. | |
| persist-credentials: false | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements-dev.txt | |
| - name: Lint | |
| run: ruff check . | |
| - name: Format check | |
| run: ruff format --check . | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| - name: Tests | |
| run: python -m pytest tests/ -v | |
| - name: Client-side export assertions (F1) | |
| run: node tests/js/test_export_sanitize.mjs | |
| - name: Client-side render/cap assertions (P4/P5/P13) | |
| run: node tests/js/test_render_caps.mjs | |
| - name: Client-side feature assertions (Phase 4) | |
| run: node tests/js/test_features.mjs | |
| - name: Audit runtime dependencies | |
| run: pip-audit -r requirements.txt |