mirror of
https://github.com/AgentSeal/codeburn.git
synced 2026-08-11 01:25:03 +00:00
0ec9ea93cb
The build is `tsup && tsc`. tsup runs with clean:true, so it wipes dist and writes JavaScript; if tsc then fails, dist holds .js with no declarations. The build exits non-zero, but packages/core declared no prepublishOnly, so nothing rebuilt at publish time and a later npm publish would ship it. Reproduced: remove the declarations from a copy of dist and npm pack --dry-run still succeeds, with all 41 exports subpaths pointing at files absent from the tarball. npm pack was never the guard. Adds prepublishOnly (build then verify) and scripts/verify-dist.mjs, which asserts every exports target exists. CI runs verify-dist as well, so the guard is exercised on every push rather than only on the rare publish.
62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
core:
|
|
name: core (node ${{ matrix.node }})
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
node: ['22.13.x', '24.x', '26.x']
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ matrix.node }}
|
|
|
|
- name: Install from lockfile
|
|
run: npm ci
|
|
|
|
- name: Check workspace versions
|
|
run: npm run check:workspace-versions
|
|
|
|
- name: Typecheck core
|
|
run: npm run typecheck --workspace=@codeburn/core
|
|
|
|
- name: Test core
|
|
run: npm test --workspace=@codeburn/core
|
|
|
|
- name: Build core
|
|
run: npm run build --workspace=@codeburn/core
|
|
|
|
- name: Verify every export target exists
|
|
run: npm run verify-dist --workspace=@codeburn/core
|
|
|
|
- name: Verify package contents
|
|
run: npm pack --workspace=@codeburn/core --dry-run
|
|
|
|
semgrep:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Install Semgrep
|
|
run: pip install semgrep
|
|
|
|
- name: Run Semgrep bracket-assign guard
|
|
run: |
|
|
set -e
|
|
semgrep --config .semgrep/rules/no-bracket-assign-hot-paths.yml \
|
|
--strict --json \
|
|
packages/cli/src/providers/ packages/cli/src/parser.ts > semgrep-out.json
|
|
FINDINGS=$(jq '.results | length' semgrep-out.json)
|
|
if [ "$FINDINGS" -gt 0 ]; then
|
|
jq -r '.results[] | "::error file=\(.path),line=\(.start.line)::\(.extra.message)"' semgrep-out.json
|
|
exit 1
|
|
fi
|