Julian Tabel
22d72e8a34
All CI jobs and the deploy workflow only need to read repo contents. Adding explicit top-level permissions satisfies zizmor's excessive-permissions audit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
79 lines
2.1 KiB
YAML
79 lines
2.1 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [develop]
|
|
paths-ignore:
|
|
- ".beans/**"
|
|
- "*.md"
|
|
- "LICENSE"
|
|
- ".gitignore"
|
|
- ".github/workflows/deploy.yml"
|
|
pull_request:
|
|
branches: [develop]
|
|
paths-ignore:
|
|
- ".beans/**"
|
|
- "*.md"
|
|
- "LICENSE"
|
|
- ".gitignore"
|
|
- ".github/workflows/deploy.yml"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
backend-lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
|
|
with:
|
|
python-version: "3.14"
|
|
- run: pip install ruff ty
|
|
- name: Check linting
|
|
run: ruff check backend/
|
|
- name: Check formatting
|
|
run: ruff format --check backend/
|
|
- name: Type check
|
|
run: ty check backend/src/
|
|
continue-on-error: true
|
|
|
|
actions-lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Install actionlint
|
|
run: |
|
|
bash <(curl -sL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
|
|
sudo mv actionlint /usr/local/bin/
|
|
- name: Lint GitHub Actions
|
|
run: actionlint
|
|
- name: Audit GitHub Actions security
|
|
run: pipx run zizmor .github/workflows/
|
|
|
|
frontend-lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: "24"
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
working-directory: frontend
|
|
- name: Lint
|
|
run: npm run lint
|
|
working-directory: frontend
|
|
- name: Check formatting
|
|
run: npx oxfmt --check "src/"
|
|
working-directory: frontend
|
|
- name: Type check
|
|
run: npx tsc -b
|
|
working-directory: frontend
|