Launch OpenControl #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| verify: | |
| name: Host / ${{ matrix.os }} / Node ${{ matrix.node }} | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| node: [22.23.1, 24.18.0] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| cache: npm | |
| - name: Bootstrap reviewed npm | |
| run: node scripts/bootstrap-reviewed-npm.mjs | |
| - name: Install locked dependencies without lifecycle scripts | |
| run: npm ci --ignore-scripts | |
| - name: Verify registry signatures and attestations | |
| run: npm audit signatures | |
| - name: Run only reviewed dependency lifecycle scripts | |
| run: npm run security:rebuild | |
| - name: Verify host | |
| run: npm run verify | |
| supply-chain: | |
| name: Supply-chain and package gates | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 24.18.0 | |
| cache: npm | |
| - name: Bootstrap reviewed npm | |
| run: node scripts/bootstrap-reviewed-npm.mjs | |
| - name: Install locked dependencies without lifecycle scripts | |
| run: npm ci --ignore-scripts | |
| - name: Verify registry signatures and attestations | |
| run: npm audit signatures | |
| - name: Reject moderate or higher advisories | |
| run: npm audit --audit-level=moderate | |
| - name: Run only reviewed dependency lifecycle scripts | |
| run: npm run security:rebuild | |
| - name: Verify private exact-pinned manifest | |
| run: npm run security:manifest | |
| - name: Verify dependency licenses | |
| run: npm run security:licenses | |
| - name: Run portable firmware tests | |
| run: npm run test:firmware | |
| - name: Build package | |
| run: npm run build | |
| - name: Inspect package contents | |
| run: npm run security:package | |
| - name: Generate CycloneDX SBOM | |
| run: npm sbom --omit=dev --sbom-format=cyclonedx > opencontrol.cdx.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 | |
| with: | |
| name: opencontrol-sbom | |
| path: opencontrol.cdx.json | |
| if-no-files-found: error | |
| retention-days: 30 |