Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
214 changes: 214 additions & 0 deletions .github/workflows/quality-gates.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,214 @@
name: Quality Gates

on:
pull_request:
types: [opened, synchronize, reopened]
push:
branches: [main]

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

permissions:
contents: read

jobs:
osv-scan:
name: OSV Scan
runs-on: ubuntu-24.04-arm
timeout-minutes: 2

steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: OSV Scan
env:
OSV_VERSION: 2.4.0
OSV_SHA256: 44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9
run: |
set -euo pipefail
curl -sSLo osv-scanner "https://github.com/google/osv-scanner/releases/download/v${OSV_VERSION}/osv-scanner_linux_arm64"
echo "${OSV_SHA256} osv-scanner" | sha256sum -c -
chmod +x osv-scanner
./osv-scanner --lockfile=package-lock.json

audit:
name: Audit
runs-on: ubuntu-24.04-arm
timeout-minutes: 2

steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
cache: npm

- name: Install Dependencies
run: npm ci --no-fund --no-audit

- name: Audit
run: npm audit --audit-level=low

lint:
name: Lint
runs-on: ubuntu-24.04-arm
timeout-minutes: 2

steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
cache: npm

- name: Install Dependencies
run: npm ci --no-fund --no-audit

- name: Lint
run: node --run lint

typecheck:
name: Typecheck
runs-on: ubuntu-24.04-arm
timeout-minutes: 2

steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
cache: npm

- name: Install Dependencies
run: npm ci --no-fund --no-audit

- name: Typecheck
run: node --run typecheck

build:
name: Build
runs-on: ubuntu-24.04-arm
timeout-minutes: 2

steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
cache: npm

- name: Install Dependencies
run: npm ci --no-fund --no-audit

- name: Build
run: node --run build

- name: Upload build artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: dist
path: dist
retention-days: 1

e2e:
name: E2E
runs-on: ubuntu-24.04-arm
timeout-minutes: 2
needs: build

steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
cache: npm

- name: Install Dependencies
run: npm ci --no-fund --no-audit

- name: Download build artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: dist
path: dist

- name: E2E
run: node --run test:e2e:run

manifest:
name: Manifest
runs-on: ubuntu-24.04-arm
timeout-minutes: 2
needs: build

steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: 24
registry-url: "https://registry.npmjs.org"
cache: npm

- name: Install Dependencies
run: npm ci --no-fund --no-audit

- name: Download build artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: dist
path: dist

- name: Manifest
run: node --run test:manifest

test:
name: Test
runs-on: ubuntu-24.04-arm
timeout-minutes: 2
strategy:
fail-fast: false
matrix:
node-version: [24, 26]

steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Setup Node
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
with:
node-version: ${{ matrix.node-version }}
registry-url: "https://registry.npmjs.org"
cache: npm

- name: Install Dependencies
run: npm ci --no-fund --no-audit

- name: Test
run: node --run test:coverage
4 changes: 4 additions & 0 deletions .npmrc
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
package-lock=true
min-release-age=7
ignore-scripts=true
allow-git=none
15 changes: 15 additions & 0 deletions .oxlintrc.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
{
"$schema": "./node_modules/oxlint/configuration_schema.json",
"plugins": [
"typescript",
"unicorn",
"oxc"
],
"categories": {
"correctness": "error"
},
"rules": {},
"env": {
"builtin": true
}
}
Loading