ci: adopt org-wide reusable library pipeline - #10
Merged
Conversation
Replace the monolithic build job with a thin caller of the shared bymaxone/.github reusables: - ci → node-lib-ci.yml@v1 (lint, typecheck, unit+coverage, gated mutation) - keep build+size, Testcontainers Redis e2e, example build, and the verified-secret scan as repo-specific local jobs - add visibility-gated dependency review (security.yml@v1) - add weekly Dependabot for npm + github-actions Mutation now runs post-merge on main via the shared reusable instead of only as a pre-release manual step.
There was a problem hiding this comment.
Pull request overview
This PR switches the repository CI to a thin “caller” workflow that delegates standard Node library checks (lint, typecheck, unit+coverage, mutation-on-main) to the org-wide reusable pipeline in bymaxone/.github, while keeping repo-specific build/size verification, Redis Testcontainers E2E, example app checks, and a verified-only secret scan locally.
Changes:
- Replace the monolithic CI job with
bymaxone/.github/.github/workflows/node-lib-ci.yml@v1plus localverify,e2e,example, andsecret-scanjobs. - Add a gated dependency-review job via
bymaxone/.github/.github/workflows/security.yml@v1(public-repo only). - Add weekly Dependabot updates for npm and GitHub Actions.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
CLAUDE.md |
Updates contributor guidance to reflect mutation testing running post-merge on main via the shared reusable workflow. |
.github/workflows/ci.yml |
Refactors CI into a reusable-workflow caller plus repo-specific verification/E2E/example/secret-scan/security jobs. |
.github/dependabot.yml |
Adds weekly Dependabot config for npm and GitHub Actions updates. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adopt the org-wide reusable CI (
bymaxone/.github) for this library, replacing the single monolithicbuildjob.Changes
ci→node-lib-ci.yml@v1— shared lint, type-check, unit+coverage, and gated mutation.verify(build + bundle-size budget),e2e(Testcontainers Redis, image pre-pulled),example(build + lintnest-queue-example), andsecret-scan(trufflehog verified-only).security→security.yml@v1— dependency review, gated ongithub.event.repository.visibility == 'public'so it activates automatically and never fails while private.main(source-gated, incremental) via the shared reusable — never on PRs, never on a schedule.Notes
codeql.ymlremains the single source of truth (both cannot coexist).