chore(ci): tighten test workflow and harden supply chain#94
Merged
Conversation
- Split lint + unit (biome + vitest) into a dedicated `lint-and-unit` job on ubuntu-latest. The build matrix now `needs: lint-and-unit` and no longer redundantly runs `npm ci && npm run test` across all 9 OS × Haxe cells. - Drop `setup-node` from the build job; the local action (`uses: ./`) ships with `using: node20`, so the runner provides the Node runtime. - Add `permissions: contents: read` to scope down `GITHUB_TOKEN`. - Add `concurrency` keyed on workflow + ref with `cancel-in-progress: true` to drop superseded push/PR runs. - Set `timeout-minutes` (lint-and-unit: 10, build: 20) to bound flaky download/install stages. - Pass `cache: npm` to `actions/setup-node` to speed up `npm ci`. - Rename the second `Install Haxe` step to make the re-installation idempotency check explicit in logs. - Document that `paths-ignore: '.github/*.yml'` only matches files directly under `.github/`, so workflow edits still trigger CI.
Pin every third-party action in test.yml and codeql-analysis.yml
to a specific commit SHA (with the matching release tag in a
trailing comment) to harden against tag-mutation. Local actions
(`uses: ./`) are unaffected.
- actions/checkout: v6 → v6.0.2 (de0fac2e)
- actions/setup-node: v4 → v4.4.0 (49933ea5)
- github/codeql-action/{init,autobuild,analyze}: v4 → v4.35.4 (68bde559)
The existing .github/dependabot.yml already runs github-actions
weekly, so dependabot will keep both the SHA and the version
comment moving forward.
Append `npm run dist` (= `npm run build && npm run pack`) and `git diff --exit-code -- dist` to the lint-and-unit job. CI now fails if a src/ change has not been accompanied by a regenerated dist/, which previously could slip in unnoticed because the runtime loads dist/ directly per action.yml (`using: node20`, `main: dist/index.js`). Local workflow on src/ change: `npm run dist`, then commit the updated dist/ alongside the source change.
Stop running CI on every feature-branch push and only run on: - direct push to master - PR open / synchronize / reopen against master - manual workflow_dispatch Drop `tags-ignore` since `branches: [master]` already excludes tag refs. Apply the existing `paths-ignore` (**/*.md, .github/*.yml) to the pull_request trigger as well, so a docs-only PR no longer runs the workflow asymmetrically with push. Workflow files under .github/workflows/ still trigger CI as before. This also eliminates the push + pull_request double-fire on PR sync (push to a feature branch with an open PR), since push is now scoped to master alone. Note for fork contributors: a feature-branch push on a fork no longer triggers CI on its own. Open a draft PR (which fires `pull_request.opened` against this repo) or run `workflow_dispatch` from the fork's Actions tab to validate changes before opening a non-draft PR.
Both pointed to external pages (workflow syntax reference and the 2020 workflow_dispatch changelog) without explaining anything about this workflow itself. The remaining `paths-ignore` NOTE that documents the `.github/*.yml` glob behaviour is kept since that one captures intent that is easy to misread.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tighten
.github/workflows/test.ymlagainst best practices. No runtime behavior change for the action itself.lint-and-unitjob; the build matrixneeds:it, eliminating 9× redundantnpm ci && npm run test.permissions: contents: read,concurrency,timeout-minutes, andcache: npm..github/dependabot.ymlkeeps them current.dist/sync check so a missednpm run distfails CI.paths-ignoreonpull_request. Removes the push + pull_request double-fire on PR sync. Fork contributors can use draft PRs orworkflow_dispatch.Test plan
dist/sync check passes against the currently committeddist/.