Skip to content

feat: deliver AutoBlog 2.0 editorial CMS #5

feat: deliver AutoBlog 2.0 editorial CMS

feat: deliver AutoBlog 2.0 editorial CMS #5

Workflow file for this run

name: Quality gates
on:
pull_request:
push:
branches: [main]
permissions:
contents: read
env:
BUN_VERSION: 1.3.12
DATABASE_URL: file:./data/ci.db
BETTER_AUTH_SECRET: ci-only-secret-with-at-least-thirty-two-characters
NEXT_PUBLIC_APP_URL: http://127.0.0.1:3000
DEMO_ENABLED: "true"
AI_MODE: mock
CRON_SECRET: ci-only-distinct-cron-secret-000000000000
jobs:
dependency-integrity:
name: Frozen install
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
typecheck:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bun run typecheck
lint:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bun run lint
unit-tests:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bun run test
integration-tests:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bun run test:integration
e2e:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bunx playwright install --with-deps chromium
- run: bun run test:e2e
accessibility:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bunx playwright install --with-deps chromium
- run: bun run test:a11y
visual-regression:
runs-on: windows-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bunx playwright install chromium
- run: bun run test:visual
performance-budgets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with: { node-version: "22.19.0" }
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bunx playwright install --with-deps chromium
- run: bun run build
- run: bun run test:performance
- run: bun run test:lighthouse
- name: Preserve Lighthouse and bundle reports
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: performance-reports
path: |
.lighthouse/
.performance/
include-hidden-files: true
if-no-files-found: error
retention-days: 7
production-build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bun run build
security-audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with: { fetch-depth: 0 }
- uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with: { bun-version: "1.3.12" }
- run: bun install --frozen-lockfile
- run: bun run audit
- run: bun run security:secrets
- name: Scan Git history without exposing values
uses: trufflesecurity/trufflehog@27b0417c16317ca9a472a9a8092acce143b49c55 # v3.95.9
with:
extra_args: --results=verified,unknown --fail --no-update