patchpanel/.github/workflows/ci.yml at main · STARTcloud/patchpanel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
name: CI

on:
  workflow_call:
  pull_request:
    branches: ['main']

permissions:
  contents: read
  pull-requests: write
  security-events: write
  packages: read
  actions: read

jobs:
  lint-root:
    name: Lint (root + shell + yaml + md)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: Install shellcheck
        run: sudo apt-get update && sudo apt-get install -y shellcheck
      - name: ESLint (root + packaging/scripts)
        run: npm run lint:root
      - name: shellcheck (Debian maintainer scripts)
        run: npm run lint:sh
      - name: yaml-lint
        run: npm run lint:yaml
      - name: markdownlint
        run: npm run lint:md
      - name: Prettier
        run: npm run format:check

  lint-backend:
    name: Lint (server workspace)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: Lint server
        run: npm run lint:backend

  lint-frontend:
    name: Lint (web workspace)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: Lint web
        run: npm run lint:frontend

  build-frontend:
    name: Build frontend
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: Build (Vite)
        run: npm run build

  security:
    name: Security (audit + licenses + supply-chain)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: Vulnerability scan (better-npm-audit)
        run: npm run security:vulnerabilities
      - name: License compliance (whitelist)
        run: npm run security:licenses
      - name: Supply chain (audit-ci)
        run: npm run security:supply-chain
      - name: Provenance signatures
        run: npm run security:signatures || true

  verify-scripts:
    name: Verify packaging scripts
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '22'
          cache: 'npm'
      - name: Install dependencies
        run: npm ci
      - name: sync-versions dry-run
        run: |
          # Verify sync-versions.js is syntactically valid and runnable
          node --check packaging/scripts/sync-versions.js
          echo "sync-versions.js OK"
      - name: generate-docs dry-run
        run: |
          node --check packaging/scripts/generate-docs.js
          echo "generate-docs.js OK"

  dependabot-updates:
    name: Dependabot Updates
    uses: ./.github/workflows/dependabot-trigger.yml

  codeql-analysis:
    name: CodeQL
    needs:
      [
        lint-root,
        lint-backend,
        lint-frontend,
        build-frontend,
        security,
        verify-scripts,
        dependabot-updates,
      ]
    uses: ./.github/workflows/codeql.yml