This repository was archived by the owner on Jun 9, 2026. It is now read-only.
Merge pull request #56 from Steffen025/feature/wp-n7-code-review #141
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI — Lint, Typecheck, Secrets | |
| on: | |
| pull_request: | |
| branches: | |
| - dev | |
| - main | |
| push: | |
| branches: | |
| - dev | |
| - main | |
| jobs: | |
| ci: | |
| name: Lint + Typecheck + Secrets | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| # ⚠️ CRITICAL: Bun only — NEVER use npm/pnpm (per TECHSTACKPREFERENCES.md) | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install dependencies | |
| run: bun install | |
| # Typecheck nur wenn tsconfig.json existiert | |
| - name: Typecheck (if TypeScript configured) | |
| run: | | |
| if [ -f "tsconfig.json" ]; then | |
| echo "TypeScript config found — running typecheck..." | |
| bunx tsc --noEmit | |
| else | |
| echo "No tsconfig.json — skipping typecheck" | |
| fi | |
| # Biome lint/format nur wenn biome.json existiert | |
| - name: Biome Check (if configured) | |
| run: | | |
| if [ -f "biome.json" ]; then | |
| echo "Biome config found — running check..." | |
| bunx @biomejs/biome check . | |
| else | |
| echo "No biome.json — skipping Biome check" | |
| fi | |
| # Secret Scan — case-insensitive für common patterns | |
| - name: Scan for hardcoded secrets | |
| run: | | |
| # Case-insensitive check for common secret patterns with 20+ char values. | |
| # Covers: sk- prefixes (OpenAI-style keys), api_key/api-key/API_KEY/API-KEY/ | |
| # client_secret with = or : assignments, values may contain letters, digits, | |
| # hyphens, underscores, dots. | |
| # Short values (< 20 chars) are excluded to avoid false positives from | |
| # module names like 'task-manager', 'publishTask', 'publish-task-model', etc. | |
| # Search in common code directories | |
| SEARCH_DIRS="Tools .opencode skill-packs" | |
| echo "🔍 Scanning for hardcoded secrets..." | |
| FOUND=0 | |
| for dir in $SEARCH_DIRS; do | |
| if [ -d "$dir" ]; then | |
| echo " Scanning $dir..." | |
| # Find potential secrets (include YAML configs) | |
| # Filter: exclude example strings in documentation, BountyPrograms, test data | |
| RESULT=$(grep -rEin "sk-[a-zA-Z0-9._-]{20,}|(api[_-]?key|client[_-]?secret|password|token)[[:space:]]*[:=][[:space:]]*['\"]?[a-zA-Z0-9._-]{20,}['\"]?" "$dir" --include="*.ts" --include="*.js" --include="*.json" --include="*.yaml" --include="*.yml" --exclude-dir="node_modules" 2>/dev/null | grep -v "BountyPrograms.json" | grep -vi "EXAMPLES OF GOOD\|EXAMPLES OF BAD\|claimed-task-complete-when\|ignored-explicit-python\|assistant-deleted-users\|overwrote-working-code\|asked-clarifying-question" || true) | |
| if [ -n "$RESULT" ]; then | |
| # Filter out process.env references (environment variable lookups, not hardcoded secrets) | |
| FILTERED=$(echo "$RESULT" | grep -vi "process\.env" | grep -vi "\.env\.example" || true) | |
| if [ -n "$FILTERED" ]; then | |
| # Only show file:line, not the content (to avoid exposing secrets in logs) | |
| echo "❌ Potential hardcoded secret found:" | |
| echo "$FILTERED" | cut -d: -f1,2 | |
| FOUND=1 | |
| fi | |
| fi | |
| fi | |
| done | |
| if [ $FOUND -eq 1 ]; then | |
| echo "" | |
| echo "❌ Secret scan failed! Please remove hardcoded secrets or use environment variables." | |
| exit 1 | |
| fi | |
| echo "✅ No obvious hardcoded secrets found" | |
| # Test job — vorbereitet für wenn Tests existieren | |
| - name: Tests (if tests exist) | |
| run: | | |
| # Exclude node_modules to avoid finding test files in dependencies | |
| if find . -name "*.test.ts" -o -name "*.spec.ts" | grep -v node_modules | grep -q .; then | |
| echo "Test files found — running tests..." | |
| bun test | |
| else | |
| echo "No test files found — skipping (add tests to enable)" | |
| fi | |
| env: | |
| NODE_ENV: test |