Repository navigation
chore(deps): update dependency chrome-for-testing to v157 (#1799) #6248
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lint | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Defaults (opened, synchronize, reopened) PLUS `ready_for_review`: this job is | |
| # the required `lint` check, and flipping a PR draft → ready is the issue #509 | |
| # recovery path that re-dispatches it on the current head SHA without a push. | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: lint-${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| # This job name is a REQUIRED status check — it must match the context list | |
| # in the `main` ruleset (.github/rulesets/main.json) exactly (renaming means | |
| # updating that ruleset too). | |
| # Runs ruff (check + format), pyright, and the Markdown + YAML doc-lint | |
| # (scripts/lint-docs.sh). | |
| name: lint | |
| # Runs on drafts too: ruff/pyright/doc-lint are cheap and upload no SARIF, so | |
| # keeping this required check live on drafts keeps the `lint` context TRULY | |
| # covered rather than vacuously green — only the heavy / SARIF jobs skip drafts | |
| # (see tests/test_workflow_draft_guard.py). `ready_for_review` stays in the | |
| # trigger types so a draft → ready flip with no push still re-confirms. | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up uv + Python | |
| uses: $/.github/actions/setup | |
| with: | |
| python-version: "3.13" | |
| # `--no-sync`: the setup action above already `uv sync --extra dev`'d the | |
| # environment for the pinned interpreter. A bare `uv run` re-resolves against | |
| # `.python-version`, and if that ever disagrees with the pinned version it | |
| # rebuilds the venv WITHOUT the dev extra (dropping ruff/pyright) → a spurious | |
| # "Failed to spawn: ruff". `--no-sync` runs the prepared venv verbatim. | |
| - name: ruff check | |
| run: uv run --no-sync ruff check . | |
| - name: ruff format --check | |
| run: uv run --no-sync ruff format --check . | |
| - name: pyright | |
| run: uv run --no-sync pyright src/clauster | |
| # Repo-meta guards (`@pytest.mark.repo_meta`): static assertions over .github/**, | |
| # the rulesets, and the repo-config baselines. They live in tests/ but must ALSO run | |
| # here, because the `tests` matrix in ci.yml is skipped on a `.github/**`-only PR | |
| # (.github/actions/changed-code) — precisely the PR these guards police, which would | |
| # otherwise let a change to the CI filters merge with its own guard skipped. `lint` is | |
| # a required check with no paths filter, so it runs on every PR unconditionally. | |
| # `-o addopts=""` drops the repo-wide `--cov-fail-under=96` (a subset run can't meet it) | |
| # and `-n auto` (worker startup dwarfs a handful of file reads). Clearing addopts also | |
| # drops its `--ignore=tests/e2e`, so that has to be restored by hand — otherwise | |
| # collection imports `tests/e2e/conftest.py`, which shadows `tests/conftest.py` on | |
| # sys.path and every module importing a shared helper fails with an ImportError. | |
| - name: repo-meta guards | |
| run: >- | |
| uv run --no-sync pytest -m repo_meta -o addopts="" --ignore=tests/e2e | |
| -q -p no:cacheprovider | |
| # Blocking: a malformed changeset (a summary that wraps mid-sentence) renders a | |
| # truncated `###` heading in the GitHub release notes (v0.12.3 #560/#561), and one | |
| # keyed to a package/bump knope doesn't know is skipped SILENTLY, losing its | |
| # changelog entry and version bump (#1320). The local pre-commit hook catches both | |
| # pre-push; this enforces them on every PR. | |
| - name: changeset lint | |
| run: uv run --no-sync python scripts/lint_changesets.py | |
| # Node for markdownlint-cli2: pin the runtime (ubuntu-latest's bundled Node | |
| # drifts across image refreshes) and install the version-pinned, integrity- | |
| # checked package from the lockfile via `npm ci`. yamllint comes from | |
| # `uv sync --extra dev` above. | |
| - name: Set up Node 24 | |
| uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | |
| with: | |
| node-version: "26" | |
| cache: npm | |
| - name: Install Node deps | |
| # `npm ci` has stalled for minutes on a slow registry fetch and starved the | |
| # 5-minute job budget, which cancels the required `lint` check. Prefer the | |
| # setup-node cache, skip the audit network call with `--no-audit`, and drop the | |
| # funding message with `--no-fund`. Cap the step so a stalled fetch fails fast | |
| # instead of the whole job timing out. 3 minutes leaves headroom for a cold-cache | |
| # install while still failing well before the 5-minute job cap. | |
| timeout-minutes: 3 | |
| run: npm ci --prefer-offline --no-audit --no-fund | |
| # Markdown + YAML lint — the same script developers run locally. | |
| - name: markdown + yaml lint | |
| run: bash scripts/lint-docs.sh | |
| # CSP directive-expression guard (#533): the dashboard ships the @alpinejs/csp | |
| # build (script-src has no 'unsafe-eval'), whose evaluator rejects arrow fns, | |
| # template literals, ?./??, spread/new, if-statements, and multi-statement `;` | |
| # sequences, and resolves bare identifiers only against registered components. | |
| # A template edit that reintroduces any of those silently breaks the dashboard at | |
| # runtime — unit tests only grep source, they never execute Alpine — so this fails | |
| # the build on any violation. Node 24 is already set up above (markdownlint). | |
| - name: CSP expression guard | |
| run: node scripts/check_csp_expressions.mjs |