Repository navigation
docs: document the pull request lifecycle once and remove passages against it #2236
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| # Builds both images without pushing them. | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - uses: ./.github/actions/setup | |
| - run: bun run lint | |
| typecheck: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - uses: ./.github/actions/setup | |
| - run: bun run check | |
| test: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| suite: [unit, postgres] | |
| shard: [1/3, 2/3, 3/3] | |
| include: | |
| - suite: dom | |
| shard: 1/1 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - if: matrix.suite == 'postgres' | |
| uses: ./.github/actions/postgres | |
| - uses: ./.github/actions/setup | |
| # Not --parallel: run side by side on the runner's four cores, tests that time a subprocess or a parse fail. | |
| - run: bun run test:${{ matrix.suite }} --shard=${{ matrix.shard }} | |
| changes: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| pull-requests: read | |
| outputs: | |
| platform: ${{ steps.filter.outputs.platform }} | |
| steps: | |
| - id: filter | |
| if: github.event_name == 'pull_request' | |
| uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 | |
| with: | |
| filters: | | |
| platform: | |
| - 'apps/hub/**' | |
| - 'apps/sidecar/**' | |
| - 'apps/web/scripts/**' | |
| - 'apps/web/src/lib/**' | |
| - 'tooling/**' | |
| - 'packages/**' | |
| - 'tests/chain/**' | |
| - 'vendor/**' | |
| - 'bun.lock' | |
| - 'package.json' | |
| - '.github/workflows/ci.yml' | |
| - '.github/actions/**' | |
| # Every shard job reports so its required check is satisfied; the steps run only when platform code changed. | |
| # Each shard lists its files: the slow scenarios are spread by measured time, which --shard cannot do. | |
| chain: | |
| name: chain (${{ matrix.shard }}) | |
| needs: changes | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| env: | |
| RUN: ${{ github.event_name != 'pull_request' || needs.changes.outputs.platform == 'true' }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - shard: 1/5 | |
| files: tests/chain/unwoken.test.ts | |
| - shard: 2/5 | |
| files: tests/chain/woken.test.ts tests/chain/local-sidecars.test.ts tests/chain/deterministic.test.ts tests/chain/unset.test.ts | |
| - shard: 3/5 | |
| files: tests/chain/disconnected.test.ts tests/chain/reread.test.ts tests/chain/judged.test.ts | |
| - shard: 4/5 | |
| files: tests/chain/unrouted.test.ts tests/chain/held.test.ts tests/chain/waiting.test.ts | |
| - shard: 5/5 | |
| files: tests/chain/pushed.test.ts tests/chain/sidecar-cap.test.ts tests/chain/always.test.ts | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| - if: env.RUN == 'true' | |
| uses: ./.github/actions/postgres | |
| - if: env.RUN == 'true' | |
| uses: ./.github/actions/setup | |
| - if: env.RUN == 'true' | |
| run: bun --conditions=intx-src test --parallel=2 ${{ matrix.files }} | |
| policy: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| checks: read | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - uses: corbitsdev/corbits-triage/packages/policy-check-action@28a902e9a6e2f7ec53c581425b72d97c6800fc89 | |
| publish: | |
| needs: [lint, typecheck, test, chain] | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| PUSH: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }} | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 | |
| - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 | |
| - if: env.PUSH == 'true' | |
| uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Scan what is about to publish, built for the runner's arch only; the multi-arch builds below reuse its cache. | |
| - name: Sidecar image to scan | |
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | |
| with: | |
| context: . | |
| target: sidecar | |
| load: true | |
| tags: corbits-triage-sidecar:scan | |
| cache-from: type=gha,scope=sidecar | |
| no-cache-filters: app | |
| - name: Hub image to scan | |
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | |
| with: | |
| context: . | |
| load: true | |
| tags: corbits-triage-hub:scan | |
| cache-from: type=gha,scope=hub | |
| no-cache-filters: app | |
| - name: Scan sidecar image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: corbits-triage-sidecar:scan | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: 1 | |
| - name: Scan hub image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: corbits-triage-hub:scan | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: 1 | |
| - name: Sidecar image | |
| id: sidecar | |
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | |
| with: | |
| context: . | |
| target: sidecar | |
| platforms: linux/amd64,linux/arm64 | |
| push: ${{ env.PUSH }} | |
| tags: | | |
| ghcr.io/corbitsdev/corbits-triage-sidecar:main | |
| ghcr.io/corbitsdev/corbits-triage-sidecar:${{ github.sha }} | |
| cache-from: type=gha,scope=sidecar | |
| cache-to: type=gha,scope=sidecar,mode=max | |
| no-cache-filters: app | |
| - name: Hub image | |
| uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: ${{ env.PUSH }} | |
| build-args: SIDECAR_IMAGE=ghcr.io/corbitsdev/corbits-triage-sidecar@${{ steps.sidecar.outputs.digest }} | |
| tags: | | |
| ghcr.io/corbitsdev/corbits-triage-hub:main | |
| ghcr.io/corbitsdev/corbits-triage-hub:${{ github.sha }} | |
| cache-from: type=gha,scope=hub | |
| cache-to: type=gha,scope=hub,mode=max | |
| no-cache-filters: app |