chore(deps)(deps): bump the production-dependencies group in /apps/api with 3 updates #591
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "apps/api/**" | |
| - ".github/workflows/apps-api-ci.yml" | |
| pull_request: | |
| branches: [main] | |
| # Cancel in-flight runs of the same ref on a new push. | |
| concurrency: | |
| group: apps-api-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| name: typecheck + lint + test | |
| defaults: | |
| run: | |
| working-directory: apps/api | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| services: | |
| # Mirrors `docker-compose.yml` so the integration tests under | |
| # tests/api/** can hit a real Postgres rather than skipping. The | |
| # password matches `.env.example` for parity with local dev. | |
| postgres: | |
| image: postgres:17-alpine@sha256:979c4379dd698aba0b890599a6104e082035f98ef31d9b9291ec22f2b13059ca | |
| env: | |
| POSTGRES_DB: app | |
| POSTGRES_USER: app | |
| POSTGRES_PASSWORD: app_dev_password | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U app -d app" | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| valkey: | |
| image: valkey/valkey:8-alpine@sha256:77643d152547b446fc15cbafaff22004545663fcd40c6b28038ad283837baa75 | |
| ports: | |
| - 6379:6379 | |
| options: >- | |
| --health-cmd "valkey-cli ping" | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| env: | |
| # Same values used by the test runtime locally. JWT_SECRET is the | |
| # 32+ char placeholder env.ts already accepts in test mode; never | |
| # commit a real secret here. | |
| NODE_ENV: test | |
| DATABASE_URL: postgresql://app:app_dev_password@localhost:5432/app | |
| JWT_SECRET: ci-only-jwt-secret-padded-to-thirty-two-chars | |
| FRONTEND_URL: http://localhost:7331 | |
| ALLOWED_ORIGINS: http://localhost:7331 | |
| APP_NAME: API Template | |
| LOG_LEVEL: error | |
| # Use `resend` without a key so `buildEmailService()` picks | |
| # `NoopEmailService` (see email.service.utils). A non-empty fake key | |
| # would construct `ResendEmailService` and call the real API, which | |
| # fails and breaks notification email-channel tests that expect `sent`. | |
| EMAIL_PROVIDER: resend | |
| RESEND_API_KEY: "" | |
| EMAIL_FROM: noreply@example.com | |
| VALKEY_HOST: localhost | |
| VALKEY_PORT: "6379" | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Detect relevant changes | |
| uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 | |
| id: filter | |
| with: | |
| filters: | | |
| code: | |
| - 'apps/api/**' | |
| - '.github/workflows/apps-api-ci.yml' | |
| - name: Set up Bun | |
| if: steps.filter.outputs.code == 'true' | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.14 | |
| - name: Cache bun install | |
| if: steps.filter.outputs.code == 'true' | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('apps/api/bun.lock') }} | |
| restore-keys: | | |
| bun-${{ runner.os }}- | |
| - name: Install dependencies | |
| if: steps.filter.outputs.code == 'true' | |
| run: bun install --frozen-lockfile | |
| - name: Apply DB migrations | |
| if: steps.filter.outputs.code == 'true' | |
| # `db:migrate` applies the committed migrations in drizzle/ — | |
| # non-interactive, deterministic, and creates every schema | |
| # (auth / billing / app / audit) the test suite expects. | |
| # `db:push` is dev-only and prompts on a TTY, which CI doesn't have. | |
| run: bun run db:migrate | |
| - name: Build email templates | |
| if: steps.filter.outputs.code == 'true' | |
| run: bun run build:templates | |
| - name: Typecheck + lint | |
| if: steps.filter.outputs.code == 'true' | |
| run: bun run check | |
| - name: Tests | |
| if: steps.filter.outputs.code == 'true' | |
| env: | |
| REQUIRE_INTEGRATION_DB: "true" | |
| run: bun run test | |
| - name: Test coverage report | |
| if: steps.filter.outputs.code == 'true' | |
| env: | |
| REQUIRE_INTEGRATION_DB: "true" | |
| run: bun run test:coverage | |
| - name: Upload coverage to Codecov | |
| if: steps.filter.outputs.code == 'true' | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| files: apps/api/coverage/lcov.info | |
| flags: api | |
| name: api-coverage | |
| fail_ci_if_error: false | |
| # CODECOV_TOKEN is required for private repos; for public repos | |
| # uploads work tokenless. | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| - name: Production bundle | |
| if: steps.filter.outputs.code == 'true' | |
| run: bun build src/index.ts --outdir dist --target bun |