neon-testing/.github/workflows/check.yml at main · starmode-base/neon-testing · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: Check

on:
  push:
    branches: [main]
  # pull_request_target enables secrets for fork PRs (required for Neon API)
  # SECURITY: Requires manual approval before running - configure at:
  # https://github.com/starmode-base/neon-testing/settings/actions
  # → "Require approval for all external contributors"
  pull_request_target:
    branches: [main]

# Cancel superseded runs of the same PR to avoid piling up Neon branches; main
# pushes queue instead so every main commit keeps a completed run
concurrency:
  group: check-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request_target' }}

jobs:
  # Keep in sync with the check job in release.yml. Differs only in the job
  # guard (the fork guard here, the gate dependency there) and the PR-head
  # checkout ref
  check:
    # Skip in forks - the checks need this repo's Neon secrets, so fork runs
    # would only fail red and waste their minutes
    if: github.repository == 'starmode-base/neon-testing'
    runs-on: ubuntu-latest
    timeout-minutes: 20

    # SECURITY: this job runs repo code (tests, dev dependencies) - including
    # fork code after approval - never give it a write-capable GITHUB_TOKEN
    permissions:
      contents: read

    steps:
      - name: Checkout
        # https://github.com/actions/checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # For pull_request_target, check out the PR head to test the
          # contributor's code; for push events this equals the event commit
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          # Nothing after clone needs git auth - don't leave a token in
          # .git/config for repo code to read
          persist-credentials: false

      - name: Setup Node.js
        # https://github.com/actions/setup-node
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: "24.x"

      - name: Setup Bun
        # https://github.com/oven-sh/setup-bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: latest

      - name: Log versions
        run: |
          echo "Node: $(node -v)"
          echo "npm: $(npm -v)"
          echo "Bun: $(bun -v)"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Run checks
        env:
          # https://github.com/starmode-base/neon-testing/settings/variables/actions
          # https://github.com/starmode-base/neon-testing/settings/secrets/actions
          NEON_API_KEY: ${{ secrets.NEON_API_KEY }}
          NEON_PROJECT_ID: ${{ vars.NEON_PROJECT_ID }}
        run: bun run check