feat: deliver AutoBlog 2.0 editorial CMS #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Quality gates | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| env: | |
| BUN_VERSION: 1.3.12 | |
| DATABASE_URL: file:./data/ci.db | |
| BETTER_AUTH_SECRET: ci-only-secret-with-at-least-thirty-two-characters | |
| NEXT_PUBLIC_APP_URL: http://127.0.0.1:3000 | |
| DEMO_ENABLED: "true" | |
| AI_MODE: mock | |
| CRON_SECRET: ci-only-distinct-cron-secret-000000000000 | |
| jobs: | |
| dependency-integrity: | |
| name: Frozen install | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| typecheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bun run typecheck | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bun run lint | |
| unit-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bun run test | |
| integration-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bun run test:integration | |
| e2e: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bunx playwright install --with-deps chromium | |
| - run: bun run test:e2e | |
| accessibility: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bunx playwright install --with-deps chromium | |
| - run: bun run test:a11y | |
| visual-regression: | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bunx playwright install chromium | |
| - run: bun run test:visual | |
| performance-budgets: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: { node-version: "22.19.0" } | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bunx playwright install --with-deps chromium | |
| - run: bun run build | |
| - run: bun run test:performance | |
| - run: bun run test:lighthouse | |
| - name: Preserve Lighthouse and bundle reports | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: performance-reports | |
| path: | | |
| .lighthouse/ | |
| .performance/ | |
| include-hidden-files: true | |
| if-no-files-found: error | |
| retention-days: 7 | |
| production-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bun run build | |
| security-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: { fetch-depth: 0 } | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 | |
| with: { bun-version: "1.3.12" } | |
| - run: bun install --frozen-lockfile | |
| - run: bun run audit | |
| - run: bun run security:secrets | |
| - name: Scan Git history without exposing values | |
| uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9 | |
| with: | |
| extra_args: --results=verified,unknown --fail --no-update |