chore: update actions #1536
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint-typecheck: | |
| name: Lint & Typecheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Install web dependencies | |
| # web/ is a separate Bun project with its own lockfile. `tsc -b` follows | |
| # the project reference into web/tsconfig.json, so its node_modules | |
| # (e.g. @testing-library/dom) must be present for the typecheck to resolve. | |
| run: cd web && bun install --frozen-lockfile | |
| - name: Lint (oxlint) | |
| run: oxlint . | |
| - name: Typecheck | |
| run: tsc -b | |
| test-unit: | |
| name: Unit Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Run backend unit tests | |
| run: just test-backend | |
| - name: Run web unit tests | |
| run: just test-web | |
| test-build: | |
| name: Build Verification | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Build Electron app | |
| run: just build | |
| test-e2e: | |
| name: E2E Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Ensure Electron binary is installed | |
| run: | | |
| set -x | |
| # electron's install.js downloads the platform zip into @electron/get's | |
| # cache reliably, but in this CI environment its async extraction step does | |
| # not finish before the process exits — it leaves node_modules/electron/dist | |
| # half-written (only locales/), without the electron binary or chrome-sandbox. | |
| # So: run install.js to populate the download cache, then extract the cached | |
| # zip ourselves with unzip (synchronous, complete) so the dist is whole for | |
| # the chrome-sandbox chown below. | |
| rm -rf node_modules/electron/dist node_modules/electron/path.txt | |
| node node_modules/electron/install.js || true | |
| zip="$(ls -1 "$HOME"/.cache/electron/*/electron-*-linux-x64.zip | head -n1)" | |
| rm -rf node_modules/electron/dist | |
| mkdir -p node_modules/electron/dist | |
| unzip -q "$zip" -d node_modules/electron/dist | |
| printf 'electron' > node_modules/electron/path.txt | |
| ls -la node_modules/electron/dist | |
| test -f node_modules/electron/dist/chrome-sandbox | |
| - name: Fix Electron chrome-sandbox permissions | |
| run: | | |
| sudo chown root:root node_modules/electron/dist/chrome-sandbox | |
| sudo chmod 4755 node_modules/electron/dist/chrome-sandbox | |
| - name: Get Playwright version | |
| id: pw-version | |
| run: echo "version=$(bunx playwright --version | awk '{print $2}')" >> "$GITHUB_OUTPUT" | |
| - name: Cache Playwright browsers | |
| id: pw-cache | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: ${{ runner.os }}-playwright-${{ steps.pw-version.outputs.version }} | |
| - name: Install Playwright browsers | |
| if: steps.pw-cache.outputs.cache-hit != 'true' | |
| run: bunx playwright install --with-deps chromium | |
| - name: Install Playwright system deps | |
| if: steps.pw-cache.outputs.cache-hit == 'true' | |
| run: bunx playwright install-deps chromium | |
| - name: Build Electron app | |
| run: just build | |
| - name: Install Xvfb | |
| run: sudo apt-get install -y xvfb | |
| - name: Run E2E tests | |
| run: xvfb-run --auto-servernum just test-e2e-run | |
| - name: Upload Playwright report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: ${{ !cancelled() }} | |
| with: | |
| name: playwright-results | |
| path: | | |
| web/test-results/ | |
| electron/e2e/test-results/ | |
| retention-days: 30 | |
| if-no-files-found: ignore | |
| test-runbooks: | |
| name: Runbook Tests | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Compile test CLI | |
| run: just compile-test-cli | |
| - name: Configure AWS credentials via OIDC | |
| uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0 | |
| with: | |
| role-to-assume: ${{ secrets.RUNBOOKS_TEST_AWS_ROLE_ARN }} | |
| aws-region: us-west-2 | |
| - name: Export test credentials | |
| env: | |
| ORIG_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }} | |
| ORIG_SECRET: ${{ env.AWS_SECRET_ACCESS_KEY }} | |
| ORIG_TOKEN: ${{ env.AWS_SESSION_TOKEN }} | |
| ORIG_REGION: ${{ env.AWS_REGION }} | |
| run: | | |
| echo "RUNBOOKS_TEST_AWS_ACCESS_KEY_ID=${ORIG_KEY_ID}" >> "$GITHUB_ENV" | |
| echo "RUNBOOKS_TEST_AWS_SECRET_ACCESS_KEY=${ORIG_SECRET}" >> "$GITHUB_ENV" | |
| echo "RUNBOOKS_TEST_AWS_SESSION_TOKEN=${ORIG_TOKEN}" >> "$GITHUB_ENV" | |
| echo "RUNBOOKS_TEST_AWS_REGION=${ORIG_REGION}" >> "$GITHUB_ENV" | |
| - name: Run runbook tests | |
| env: | |
| RUNBOOKS_GITHUB_TOKEN: ${{ secrets.RUNBOOKS_GITHUB_TOKEN }} | |
| run: resources/bin/runbooks-test test testdata/... | |
| test-runbooks-app-token: | |
| name: Runbook Tests (GitHub App Token) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Compile test CLI | |
| run: just compile-test-cli | |
| - name: Run GitHub auth flows with installation token | |
| env: | |
| # No RUNBOOKS_GITHUB_TOKEN: force the executor's fallback chain | |
| # (RUNBOOKS_GITHUB_TOKEN -> GITHUB_TOKEN -> GH_TOKEN) to land on the | |
| # ghs_ installation token, exercising validateInstallationToken. | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: resources/bin/runbooks-test test testdata/feature-demos/github-auth/... | |
| test-docs: | |
| name: Documentation Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 | |
| - name: Run docs tests | |
| run: just test-docs | |
| ci-summary: | |
| name: CI Summary | |
| needs: | |
| [ | |
| lint-typecheck, | |
| test-unit, | |
| test-build, | |
| test-e2e, | |
| test-runbooks, | |
| test-runbooks-app-token, | |
| test-docs, | |
| ] | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Check results | |
| env: | |
| LINT_RESULT: ${{ needs.lint-typecheck.result }} | |
| UNIT_RESULT: ${{ needs.test-unit.result }} | |
| BUILD_RESULT: ${{ needs.test-build.result }} | |
| E2E_RESULT: ${{ needs.test-e2e.result }} | |
| RUNBOOKS_RESULT: ${{ needs.test-runbooks.result }} | |
| RUNBOOKS_APP_RESULT: ${{ needs.test-runbooks-app-token.result }} | |
| DOCS_RESULT: ${{ needs.test-docs.result }} | |
| run: | | |
| for result in "$LINT_RESULT" "$UNIT_RESULT" "$BUILD_RESULT" "$E2E_RESULT" "$RUNBOOKS_RESULT" "$RUNBOOKS_APP_RESULT" "$DOCS_RESULT"; do | |
| if [ "$result" != "success" ] && [ "$result" != "skipped" ]; then | |
| echo "CI failed!" | |
| exit 1 | |
| fi | |
| done | |
| echo "All checks passed!" |