netscript/.github/workflows/code-quality.yml at main · rickylabs/netscript · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
name: Code quality

on:
  pull_request:
    paths:
      - 'packages/**'
      - 'plugins/**'
      - '.llm/tools/quality/**'
      - 'deno.json'
  push:
    branches: [main]
  schedule:
    # Weekly repo-wide drift scan (Mon 07:17 UTC) so unchanged-file drift on
    # main is surfaced even when no PR touches it.
    - cron: '17 7 * * 1'

permissions:
  contents: read

jobs:
  # PR gate — blocking. Scans only the files the PR changed.
  code-quality:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.9.0
      - name: Scan changed source files
        shell: bash
        run: |
          mapfile -t files < <(git diff --name-only --diff-filter=ACMR "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}" -- packages plugins)
          args=()
          for file in "${files[@]}"; do args+=(--changed-file "$file"); done
          if ((${#args[@]})); then deno task quality:scan --pretty "${args[@]}"; fi
      - run: deno task arch:check
      - name: Lint changed publish surfaces
        run: |
          deno task doc:lint --root packages/cli --pretty
          deno doc --lint packages/plugin/src/config/mod.ts packages/plugin/src/protocol/mod.ts

  # Blocking repo-wide drift scan on push-to-main + schedule.
  code-quality-repo:
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.9.0
      - name: Repo-wide quality scan
        run: deno task quality:scan:repo --pretty