chore(audit): execute 2026-06-10 audit — CI path-filter parity, version pins, un-skip isolation test #15
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: acl-drift | |
| # Catch apps/ui ACL type drift in the apps/api PR that introduced | |
| # it. The generated file lives in the UI app's tree; without this gate, | |
| # changes to src/lib/acl/acl.constants.ts here ship without the | |
| # corresponding apps/ui regeneration. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "apps/api/src/lib/acl/acl.constants.ts" | |
| - "apps/api/scripts/codegen/generate-acl-types.ts" | |
| - ".github/workflows/apps-api-acl-drift.yml" | |
| pull_request: | |
| paths: | |
| - "apps/api/src/lib/acl/acl.constants.ts" | |
| - "apps/api/scripts/codegen/generate-acl-types.ts" | |
| - ".github/workflows/apps-api-acl-drift.yml" | |
| concurrency: | |
| group: apps-api-acl-drift-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| drift: | |
| name: apps/ui ACL types are fresh | |
| defaults: | |
| run: | |
| working-directory: apps/api | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout monorepo | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - name: Set up Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Cache bun install | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('apps/api/bun.lock') }} | |
| restore-keys: | | |
| bun-${{ runner.os }}- | |
| - name: Install apps/api deps | |
| working-directory: apps/api | |
| run: bun install --frozen-lockfile | |
| - name: Check apps/ui ACL types are up-to-date | |
| working-directory: apps/api | |
| env: | |
| BORINGSTACK_UI_DIR: ${{ github.workspace }}/apps/ui | |
| run: | | |
| if ! bun run generate:acl-types:check; then | |
| echo "::error::apps/ui/src/lib/acl/acl.types.generated.ts is stale against this API change." | |
| echo "::error::To fix: from repo root run 'bun run regen' (or 'cd apps/api && bun run generate:acl-types') and commit apps/ui in the same PR." | |
| exit 1 | |
| fi |