Repository navigation
chore(deps-dev): Bump the dev-dependencies group across 1 directory with 3 updates #79
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| jobs: | |
| test: | |
| name: Typecheck and test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| # worker-configuration.d.ts is generated; fail if the committed file | |
| # drifts from wrangler.jsonc, .dev.vars.example, or the locked wrangler | |
| # version. Regenerate with: npx wrangler types --strict-vars=false | |
| - name: Generated types freshness | |
| run: | | |
| cp .dev.vars.example .dev.vars | |
| npx wrangler types --strict-vars=false --check | |
| - run: npm run typecheck | |
| - run: npm test | |
| hygiene: | |
| name: Repository hygiene | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| # CONTRIBUTING rule 3: no em dashes anywhere. The character is built | |
| # from bytes so this workflow file stays clean itself. | |
| # Generated files that carry upstream prose are exempt: the wrangler | |
| # types output and the GitNexus agent docs and skills. | |
| - name: No em dashes | |
| run: | | |
| EMDASH="$(printf '\xe2\x80\x94')" | |
| if git ls-files -z -- . \ | |
| ':(exclude)worker-configuration.d.ts' \ | |
| ':(exclude)CLAUDE.md' \ | |
| ':(exclude)AGENTS.md' \ | |
| ':(exclude).claude/skills/gitnexus/**' \ | |
| | xargs -0 grep -rlI "$EMDASH" 2>/dev/null; then | |
| echo "::error::Em dash found in the files above. CONTRIBUTING rule 3: use hyphens, commas, or colons." | |
| exit 1 | |
| fi | |
| # CONTRIBUTING rule 2: no real tenant GUIDs. Only the fictional | |
| # Harborview GUID and the all-zeros test UUID are allowed. | |
| # wrangler.jsonc is exempt: deploy-button copies legitimately carry | |
| # their provisioned D1 database_id there. | |
| - name: No unexpected UUIDs | |
| run: | | |
| FOUND="$(git ls-files -z -- . ':(exclude)worker-configuration.d.ts' ':(exclude)wrangler.jsonc' | xargs -0 grep -rhoIiE '[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}' 2>/dev/null | sort -u \ | |
| | grep -viE '^(f4a7c1d2-9b3e-4c8a-a1d6-2e5b7c9f0a34|00000000-0000-4000-8000-000000000000)$' || true)" | |
| if [ -n "$FOUND" ]; then | |
| echo "$FOUND" | |
| echo "::error::Unexpected UUID literals found. CONTRIBUTING rule 2: samples use only the fictional Harborview GUID." | |
| exit 1 | |
| fi | |
| # CONTRIBUTING rule 1: no secrets. .dev.vars must never be tracked and | |
| # nothing may reference a Cloudflare API token shape. | |
| - name: No committed secrets | |
| run: | | |
| if git ls-files | grep -x '.dev.vars'; then | |
| echo "::error::.dev.vars is tracked. It must stay local-only." | |
| exit 1 | |
| fi | |
| # CONTRIBUTING rule 4: PowerShell emitted as text never uses && or ||. | |
| - name: PowerShell text rules | |
| run: | | |
| if grep -nE '&&|\|\|' test/golden/intune-variables.ps1 test/golden/gpo-script.ps1; then | |
| echo "::error::Generated PowerShell must not use && or ||." | |
| exit 1 | |
| fi | |
| # Soft nudge only: docs/wiki is generated from the local GitNexus index | |
| # and cannot be rebuilt in CI, so warn when src changes without it. | |
| - name: Wiki freshness (warning only) | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| CHANGED="$(git diff --name-only "origin/${{ github.base_ref }}"...HEAD)" | |
| if echo "$CHANGED" | grep -q '^src/' && ! echo "$CHANGED" | grep -q '^docs/wiki/'; then | |
| echo "::warning::src/ changed but docs/wiki/ did not. If module structure or flows changed, regenerate the wiki (see CONTRIBUTING, Documentation)." | |
| fi |