devcodex/.github/workflows/ci.yml at main · devcodex-labs/devcodex · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  supported-control-plane:
    name: Control plane (${{ matrix.os }}, Node ${{ matrix.node }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        include:
          - os: ubuntu-latest
            node: 18.17.0
            route: test:supported-runtime-control-plane
          - os: ubuntu-latest
            node: 22.x
            route: test:supported-runtime-control-plane
          - os: ubuntu-latest
            node: 26.x
            route: test:supported-runtime-control-plane
          - os: windows-latest
            node: 18.17.0
            route: test:windows-control-plane
          - os: windows-latest
            node: 24.17.0
            route: test:windows-control-plane
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      - run: npm ci
      - run: npm run ${{ matrix.route }}

  full-quality:
    name: Full quality (Node 24.17)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24.17.0
          cache: npm
      - run: npm ci
      - if: ${{ hashFiles('website/package-lock.json') != '' }}
        run: npm ci --prefix website
      - name: Run exact-policy full validation
        shell: bash
        run: |
          set -euo pipefail
          AUTHORITY_SOURCE="github-actions:${GITHUB_WORKFLOW}:${GITHUB_EVENT_NAME}:${GITHUB_REPOSITORY}:${GITHUB_REF}:${GITHUB_SHA}"
          POLICY_DIGEST="$(node -e 'const {sha256}=require("./hooks/_runtime/content-identity.cjs"); process.stdout.write(sha256(JSON.stringify({workflow:process.env.GITHUB_WORKFLOW,event:process.env.GITHUB_EVENT_NAME,repository:process.env.GITHUB_REPOSITORY,ref:process.env.GITHUB_REF,commit:process.env.GITHUB_SHA,level:"V3"})))')"
          BUDGET_DIGEST="$(
            node scripts/run-validation.js --route full --actor trusted-ci --authority-source "${AUTHORITY_SOURCE}" --policy-digest "${POLICY_DIGEST}" --plan --json |
              node -e 'const fs=require("fs"); const value=JSON.parse(fs.readFileSync(0,"utf8")); const digest=value?.data?.plan?.budgetCard?.digest; if(value?.ok!==true || !/^[a-f0-9]{64}$/.test(String(digest||""))) process.exit(1); process.stdout.write(digest)'
          )"
          node scripts/run-validation.js --route full --actor trusted-ci --authority-source "${AUTHORITY_SOURCE}" --policy-digest "${POLICY_DIGEST}" --approve-plan "${BUDGET_DIGEST}"
      - run: npm run test:coverage
      - run: npm run test:audit

  website-package:
    name: Package boundary (Node 24.17)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24.17.0
          cache: npm
      - run: npm ci
      - run: npm run release:dry-run:all
      - run: npm run test:pack-clean