Skip to content
CI

docs(changelog): note v0.1.2 — purge endpoint, curl, bench, secret-scan #33

Sign in to view logs

docs(changelog): note v0.1.2 — purge endpoint, curl, bench, secret-scan

docs(changelog): note v0.1.2 — purge endpoint, curl, bench, secret-scan #33

Workflow file for this run

.github/workflows/ci.yml at bb481a1
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
jobs:
web:
name: Web (Next.js)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 20
cache: npm
- name: Install dependencies
run: npm ci
- name: Generate Prisma client
run: npm run db:generate -w apps/runloop
- name: Lint
run: npm run lint
- name: Typecheck
run: npm run typecheck
- name: Test
env:
SECRET_ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000001
run: npm test --workspaces --if-present
- name: Build
env:
# Build needs SOME value to succeed; the runtime guards refuse
# weak defaults at boot, not at compile time.
JWT_SECRET: ci-build-only-not-used-at-runtime-1234567890
SECRET_ENCRYPTION_KEY: 0000000000000000000000000000000000000000000000000000000000000001
DATABASE_URL: postgres://ci:ci@localhost:5432/ci?sslmode=disable
run: npm run build
engine:
name: Engine (Go)
runs-on: ubuntu-latest
defaults:
run:
working-directory: apps/runloop-engine
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version: "1.25"
cache-dependency-path: apps/runloop-engine/go.sum
- name: go vet
run: go vet ./...
- name: go build
run: go build ./...
- name: go test
run: go test ./... -count=1 -race -timeout=2m
cli:
name: CLI
runs-on: ubuntu-latest
defaults:
run:
working-directory: apps/runloop-cli
steps:
- uses: actions/checkout@v4
- uses: actions/setup-go@v5
with:
go-version: "1.25"
cache-dependency-path: apps/runloop-cli/go.sum
- name: build
run: go build ./...
secrets-scan:
name: Secret scan
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
# trufflehog is free for org repos; gitleaks-action requires a paid
# license for orgs since v2 (https://github.com/gitleaks/gitleaks-action#-announcement).
#
# --results=verified — fail only on credentials TruffleHog could verify
# against the live provider (a real leak). The previous "verified,unknown"
# setting flagged any literal `postgres://user:${VAR}@...` template, which
# gives false positives for shell scripts that build connection strings
# at runtime (see scripts/bench.sh) without ever committing real secrets.
- uses: trufflesecurity/trufflehog@main
with:
extra_args: --results=verified