build(deps-dev): bump markdownlint-cli2 from 0.23.1 to 0.23.2 in the dev-tools group #380
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - ".cursor/**" | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - ".cursor/**" | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| quality: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - run: npm ci | |
| - name: Contrôles qualité (lint, typecheck, audit) | |
| env: | |
| AUTH_SECRET: ci-test-auth-secret-32chars-minimum-ok | |
| run: npm run ci:full | |
| docker: | |
| runs-on: ubuntu-latest | |
| # Parallèle à quality : wall-clock PR ≈ max(quality, docker). | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c | |
| - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | |
| with: | |
| context: . | |
| # Validation Dockerfile uniquement : pas d'image PR sur GHCR. | |
| # Le push productif reste sur le job release. | |
| push: false | |
| cache-from: | | |
| type=registry,ref=ghcr.io/${{ github.repository }}/buildcache:latest | |
| type=gha,scope=hobbyhoops | |
| cache-to: | | |
| type=registry,ref=ghcr.io/${{ github.repository }}/buildcache:latest,mode=max | |
| type=gha,mode=max,scope=hobbyhoops | |
| release: | |
| name: semantic-release | |
| runs-on: ubuntu-latest | |
| needs: quality | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Token GitHub App (release) | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.RELEASE_APP_ID }} | |
| private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Identité Git (commits chore(release)) | |
| run: | | |
| git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]" | |
| git config user.email "${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com" | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - run: npm ci | |
| - name: semantic-release | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| # Évite pre-push → npm run ci pendant le push @semantic-release/git | |
| # (quality a déjà validé la branche ; AUTH_SECRET absent ici sinon). | |
| HUSKY: "0" | |
| run: npm run release | |
| - name: Détecter la release publiée | |
| id: release | |
| run: | | |
| tag="$(git tag --points-at HEAD | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$' | sort -V | tail -n 1 || true)" | |
| if [[ -z "$tag" ]]; then | |
| echo "published=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "published=true" >> "$GITHUB_OUTPUT" | |
| echo "tag=$tag" >> "$GITHUB_OUTPUT" | |
| if [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "latest=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "latest=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c | |
| if: steps.release.outputs.published == 'true' | |
| - uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c | |
| if: steps.release.outputs.published == 'true' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 | |
| if: steps.release.outputs.published == 'true' | |
| id: release-meta | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=raw,value=${{ steps.release.outputs.tag }} | |
| type=semver,pattern={{version}},value=${{ steps.release.outputs.tag }} | |
| type=semver,pattern={{major}}.{{minor}},value=${{ steps.release.outputs.tag }} | |
| type=raw,value=latest,enable=${{ steps.release.outputs.latest == 'true' }} | |
| - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | |
| if: steps.release.outputs.published == 'true' | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.release-meta.outputs.tags }} | |
| labels: ${{ steps.release-meta.outputs.labels }} | |
| cache-from: | | |
| type=registry,ref=ghcr.io/${{ github.repository }}/buildcache:latest | |
| type=gha,scope=hobbyhoops | |
| cache-to: | | |
| type=registry,ref=ghcr.io/${{ github.repository }}/buildcache:latest,mode=max | |
| type=gha,mode=max,scope=hobbyhoops |