mirror of
https://github.com/streamyfin/streamyfin.git
synced 2026-07-05 20:12:51 +01:00
c54131307c
Biome, tsc and the i18n/lockfile scripts only read the working tree, so a shallow clone is enough. Also run checkout and Bun setup in parallel in update-issue-form for consistency.
112 lines
3.5 KiB
YAML
112 lines
3.5 KiB
YAML
name: 🚦 Security & Quality Gate
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
branches: [develop, master]
|
|
workflow_dispatch:
|
|
push:
|
|
branches: [develop]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
dependency-review:
|
|
name: 🔍 Vulnerable Dependencies
|
|
runs-on: ubuntu-26.04
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
fetch-depth: 0
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
|
|
with:
|
|
fail-on-severity: high
|
|
base-ref: ${{ github.event.pull_request.base.sha || 'develop' }}
|
|
head-ref: ${{ github.event.pull_request.head.sha || github.ref }}
|
|
|
|
expo-doctor:
|
|
name: 🚑 Expo Doctor Check
|
|
runs-on: ubuntu-26.04
|
|
steps:
|
|
- parallel:
|
|
- name: 🛒 Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
submodules: recursive
|
|
|
|
- name: 🍞 Setup Bun
|
|
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
|
with:
|
|
# renovate: datasource=npm depName=bun
|
|
bun-version: "1.3.14"
|
|
|
|
- name: 💾 Cache Bun dependencies
|
|
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: ~/.bun/install/cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-${{ runner.arch }}-bun-
|
|
|
|
- name: 📦 Install dependencies (bun)
|
|
run: bun install --frozen-lockfile
|
|
|
|
- name: 🚑 Run Expo Doctor
|
|
# Re-enabled but non-blocking: surfaces doctor warnings in the logs
|
|
# without failing the gate (some checks are known-noisy for this setup).
|
|
continue-on-error: true
|
|
run: bun expo-doctor
|
|
|
|
code_quality:
|
|
name: "🔍 Lint & Test (${{ matrix.command }})"
|
|
runs-on: ubuntu-26.04
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
command:
|
|
- "lint"
|
|
- "check"
|
|
- "format"
|
|
- "typecheck"
|
|
- "i18n:check"
|
|
|
|
steps:
|
|
- parallel:
|
|
- name: "📥 Checkout PR code"
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
submodules: recursive
|
|
|
|
- name: "🍞 Setup Bun"
|
|
uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
|
|
with:
|
|
# renovate: datasource=npm depName=bun
|
|
bun-version: "1.3.14"
|
|
|
|
- name: 💾 Cache Bun dependencies
|
|
uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
|
|
with:
|
|
path: ~/.bun/install/cache
|
|
key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ hashFiles('bun.lock') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-${{ runner.arch }}-bun-
|
|
|
|
- name: "📦 Install dependencies"
|
|
run: bun install --frozen-lockfile
|
|
|
|
- name: "🚨 Run ${{ matrix.command }}"
|
|
run: bun run ${{ matrix.command }}
|