fs-packages/.github/workflows/ci.yml at main · script-development/fs-packages · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: CI

on:
    push:
        branches: [main]
    pull_request:
        branches: [main]

jobs:
    check:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
              with:
                  node-version: 24
            - run: npm ci --ignore-scripts
            # Scoped to HIGH+ per Commander disposition 2026-06-19: the unscoped
            # gate fails RED on 13 residual MODERATE @changesets/* → js-yaml
            # dev-chain advisories with no non-major fix (@changesets/cli v3 is a
            # rejected breaking bump). --audit-level=high clears that unfixable
            # moderate noise while preserving HIGH+ detection across prod + dev
            # trees (a future form-data/vite-class HIGH still trips the gate).
            - run: npm audit --audit-level=high
            - run: npm run format:check
            - run: npm run lint
            - run: npm run build
            # PR-time dist validation (queue #107 class — validate at PR time, not
            # only at release). Asserts each package's published tarball carries the
            # four REQUIRED dual-format dist artifacts, present and non-empty, so an
            # empty/missing-dist regression (the fs-http 0.1.1/0.1.2 empty-tarball
            # incident) fails the PR check rather than surfacing only at publish.
            # Shares scripts/validate-dist.mjs with publish.yml — the two gates
            # cannot drift.
            - run: npm run validate:dist
            # Release-pipeline invariant gate (WR-0615). validate:dist asserts the
            # publish job's OUTPUT is sound; this asserts its INPUT can always be
            # obtained — that the build artifact's expiry clock can never be
            # outrun by the unbounded 'npm-publish' approval clock. Cheap, zero-dep,
            # and placed here so re-coupling the two clocks fails the PR rather than
            # a release three days later. See scripts/validate-workflows.mjs.
            - run: npm run validate:workflows
            - run: npm run typecheck
            - run: npm run lint:pkg
            - run: npm run test:coverage
            - run: npm run test:mutation
            # Durable mutation-score artifact: each package's Stryker run writes
            # JSON + HTML to packages/<pkg>/reports/mutation/. Retain them as a
            # downloadable run artifact so the per-package score is retrievable
            # after the run, not just ephemeral stdout. if: always() captures the
            # report even when the break:90 gate fails (the score is the evidence).
            - name: Upload mutation reports
              if: always()
              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
              with:
                  name: mutation-reports
                  path: packages/*/reports/mutation/
                  retention-days: 30
                  if-no-files-found: warn

    # Browser-mode test lane (real Chromium via the Playwright provider): the
    # ui-inputs contract + interaction layer the happy-dom suite is structurally
    # blind to — computed --ui-* styles, real CDP events on disabled controls,
    # floating-ui positioning, axe-core audits. Config lives OUTSIDE the workspace
    # glob (packages/ui-inputs/vitest.browser.config.ts), so the `check` lane's
    # coverage/mutation gates are untouched. Browser binaries are cached keyed on
    # the locked playwright version; system deps must install on every run (the
    # cache only holds ~/.cache/ms-playwright).
    browser-tests:
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
              with:
                  node-version: 24
            - run: npm ci --ignore-scripts
            - name: Resolve Playwright version (browser cache key)
              id: playwright-version
              run: echo "version=$(node -p "require('playwright/package.json').version")" >> "$GITHUB_OUTPUT"
            - name: Cache Playwright chromium
              id: playwright-cache
              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
              with:
                  path: ~/.cache/ms-playwright
                  key: playwright-chromium-${{ steps.playwright-version.outputs.version }}
            - name: Install chromium (browser + system deps)
              if: steps.playwright-cache.outputs.cache-hit != 'true'
              run: npx playwright install chromium --with-deps
            - name: Install chromium system deps only (browser cache hit)
              if: steps.playwright-cache.outputs.cache-hit == 'true'
              run: npx playwright install-deps chromium
            - run: npm run test:browser

    # Aggregate check the town-crier trial tracks (TC-0069): the bus mirrors each
    # PR's CI verdict by matching exactly one check-run name, case-sensitively,
    # `ci-passed`. This job fans in every CI lane and is intended to become the
    # single required status check on `main` — branch protection swaps from
    # `check` to `ci-passed` after this merges.
    ci-passed:
        name: ci-passed
        runs-on: ubuntu-latest
        needs: [check, browser-tests]
        if: always()
        steps:
            - name: Verify all lanes passed
              if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
              run: |
                  echo "One or more CI lanes did not pass."
                  exit 1