build(deps): Bump the root-minor-patch group across 1 directory with … #102
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: ["**"] | |
| pull_request: | |
| jobs: | |
| test: | |
| name: build + test (Node 22) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: "npm" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Backend tests | |
| run: npm test --workspace backend | |
| # The deployed backend image builds STANDALONE from backend/ (npm ci against | |
| # the committed backend/package-lock.json — see backend/Dockerfile, HARDEN-1). | |
| # CI's root `npm ci` above never exercises that lock, so validate it the exact | |
| # way Cloud Build does: copy package.json + lock OUT of the workspace and run | |
| # `npm ci` there. Fails the build if the two drift (e.g. a backend dep bumped | |
| # without regenerating the lock) — caught pre-merge, not at deploy time. | |
| - name: Verify backend deploy lockfile (standalone npm ci) | |
| run: | | |
| tmp="$(mktemp -d)" | |
| cp backend/package.json backend/package-lock.json "$tmp/" | |
| cd "$tmp" | |
| npm ci --omit=dev | |
| - name: Frontend tests | |
| run: npx vitest run | |
| working-directory: frontend | |
| - name: Frontend build | |
| run: npx vite build | |
| working-directory: frontend | |
| env: | |
| # CI build-check only — this bundle is never deployed. The build-config | |
| # guard (vite-plugin-build-config.ts) requires the password hashes, the | |
| # backend API URL, AND the eval-service URL for any production build; | |
| # provide placeholders so the compile-check passes. Real deploys bake the | |
| # real values from .env.deploy.local and the guard aborts if they're | |
| # missing. | |
| ADMIN_PASSWORD: ci-build-check-placeholder | |
| INVIGILATOR_PASSWORD: ci-build-check-placeholder | |
| API_URL: https://ci-build-check.invalid | |
| # EVAL_API_URL must be https:// — the guard's evalUrlHttpsError rejects a | |
| # plaintext eval URL. Placeholder only; never reached at runtime in CI. | |
| EVAL_API_URL: https://ci-build-check.invalid |