ci: harden releases and lockfiles #520
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check: | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| persist-credentials: false | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.11 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Typecheck | |
| run: bun run typecheck | |
| - name: Lint | |
| run: bun run lint | |
| - name: Test | |
| run: bun test | |
| - name: Build release artifacts | |
| run: bun run build | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: '18' | |
| - name: Verify npm package contents | |
| run: | | |
| npm pack --dry-run --json > npm-pack.json | |
| node --input-type=module <<'NODE' | |
| import { readFileSync } from 'node:fs'; | |
| const [{ files }] = JSON.parse(readFileSync('npm-pack.json', 'utf8')); | |
| const packagedFiles = new Set(files.map(({ path }) => path)); | |
| const requiredFiles = [ | |
| 'dist/index.d.ts', | |
| 'dist/mmx.mjs', | |
| 'dist/sdk.mjs', | |
| 'package.json', | |
| ]; | |
| const missingFiles = requiredFiles.filter((path) => !packagedFiles.has(path)); | |
| if (missingFiles.length > 0) { | |
| throw new Error(`npm package is missing: ${missingFiles.join(', ')}`); | |
| } | |
| NODE | |
| - name: Smoke test with Node 18 | |
| run: | | |
| node dist/mmx.mjs --version | |
| node --input-type=module -e "await import('./dist/sdk.mjs')" | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 'lts/*' | |
| - name: Smoke test with current Node LTS | |
| run: | | |
| node dist/mmx.mjs --version | |
| node --input-type=module -e "await import('./dist/sdk.mjs')" | |
| - name: Verify npm lockfile | |
| run: npm ci --ignore-scripts |