react-sample/.github/workflows/ci.yml at main · ydj515/react-sample · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: CI

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: Validate (typecheck, lint, format, test, build)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm validate

  storybook:
    name: Build Storybook
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm build-storybook

  e2e:
    name: E2E (Playwright)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Resolve Playwright version
        id: playwright
        run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
      - name: Cache Playwright browsers
        id: playwright-cache
        uses: actions/cache@v6
        with:
          path: ~/.cache/ms-playwright
          key: playwright-${{ runner.os }}-${{ steps.playwright.outputs.version }}
      # 캐시 미스: 브라우저 + 시스템 의존성 모두 설치
      - name: Install Playwright browsers and system deps
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm exec playwright install --with-deps chromium
      # 캐시 히트: 브라우저는 복원됐으므로 시스템 의존성만 설치(빠름)
      - name: Install Playwright system deps
        if: steps.playwright-cache.outputs.cache-hit == 'true'
        run: pnpm exec playwright install-deps chromium
      - run: pnpm test:e2e
      - uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          name: playwright-report
          path: playwright-report/
          retention-days: 7

  audit:
    name: Security audit (pnpm)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: pnpm/action-setup@v6
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      # 전체 취약점을 Actions 실행 요약(Summary)에 표로 남긴다.
      - name: Audit report to job summary
        if: always()
        run: |
          {
            echo "## pnpm audit report"
            echo ""
            echo '```'
            pnpm audit || true
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"
      # JSON 리포트를 아티팩트로 보관한다.
      - name: Save audit JSON report
        if: always()
        run: pnpm audit --json > pnpm-audit.json || true
      - uses: actions/upload-artifact@v7
        if: always()
        with:
          name: pnpm-audit-report
          path: pnpm-audit.json
          retention-days: 7
      # high/critical 취약점이 있을 때만 실패시킨다(moderate/low는 리포트만).
      - name: Fail on high or critical vulnerabilities
        run: pnpm audit --audit-level high