Repository navigation
chore(release): bump workspace from 3.4.0 to 3.4.1 #855
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - '.beads/**' | |
| - 'LICENSE*' | |
| pull_request: | |
| paths-ignore: | |
| - '**.md' | |
| - 'docs/**' | |
| - '.beads/**' | |
| - 'LICENSE*' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| # NODE_VERSION pinned to the current LTS (22). Matches each published | |
| # package's `engines.node: ">=22.0.0"`. Node 20 reaches EOL 2026-04-30; | |
| # we're not advertising support for a runtime that loses security patches | |
| # during the lifetime of this release. | |
| env: | |
| NODE_VERSION: '22' | |
| GO_VERSION: '1.26.5' | |
| GOLANGCI_LINT_VERSION: 'v2.11.3' | |
| # ─── Pipeline ────────────────────────────────────────────────────────────── | |
| # | |
| # check-ts ─┐ | |
| # check-go ─┤── gate ── build ──┬── test-ts | |
| # ├── test-go | |
| # ├── coverage | |
| # └── verify-packages | |
| # | |
| # Gate phase: lint + typecheck + security (2 parallel jobs). | |
| # Build phase: build once, upload artifacts (ubuntu). | |
| # Test phase: test on ubuntu + windows matrix. | |
| # verify-packages: publint + attw against packed tarballs — catches | |
| # broken `exports` maps, types-resolution errors, and other package- | |
| # metadata defects before they reach main (and before a release tag). | |
| jobs: | |
| # ── Gate: TypeScript checks ────────────────────────────────────────────── | |
| check-ts: | |
| name: Check TypeScript (lint + typecheck + audit) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/setup | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - name: Build TypeScript (required for cross-package type resolution) | |
| run: pnpm build:ts | |
| - name: ESLint | |
| run: pnpm -r --filter=!hdf-cli run lint | |
| - name: tsc --noEmit | |
| run: pnpm -r --filter=!hdf-cli run type-check | |
| - name: npm audit | |
| run: pnpm audit --audit-level=high | |
| # ── Gate: Go checks ───────────────────────────────────────────────────── | |
| check-go: | |
| name: Check Go (lint + security) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/setup | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| go: 'true' | |
| - name: Build TypeScript (Go modules need hdf-schema/dist/go/) | |
| run: pnpm build:ts | |
| - name: golangci-lint (hdf-cli) | |
| run: | | |
| go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${{ env.GOLANGCI_LINT_VERSION }} | |
| cd hdf-cli && golangci-lint run | |
| - name: golangci-lint (hdf-converters) | |
| run: cd hdf-converters && golangci-lint run ./... | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 | |
| cd hdf-cli && govulncheck ./... | |
| - name: gosec | |
| run: | | |
| go install github.com/securego/gosec/v2/cmd/gosec@v2.25.0 | |
| cd hdf-cli && gosec -exclude=G304,G104,G115,G706 -exclude-generated ./... | |
| # ── Build (once, share artifacts) ──────────────────────────────────────── | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: [check-ts, check-go] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/setup | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| go: 'true' | |
| - name: Build TypeScript | |
| run: pnpm build:ts | |
| - name: Verify TS artifacts | |
| run: | | |
| for pkg in hdf-schema hdf-utilities hdf-mappings hdf-validators \ | |
| hdf-parsers hdf-converters hdf-generators hdf-diff \ | |
| hdf-extension-graph hdf-fixtures; do | |
| [ -d "$pkg/dist" ] && echo "✓ $pkg/dist" || { echo "✗ $pkg/dist missing"; exit 1; } | |
| done | |
| - name: Build Go CLI | |
| run: pnpm build:go | |
| - name: Upload build artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: build-artifacts | |
| path: | | |
| hdf-schema/dist/ | |
| hdf-utilities/dist/ | |
| hdf-mappings/dist/ | |
| hdf-validators/dist/ | |
| hdf-parsers/dist/ | |
| hdf-converters/dist/ | |
| hdf-generators/dist/ | |
| hdf-diff/dist/ | |
| hdf-extension-graph/dist/ | |
| hdf-fixtures/dist/ | |
| retention-days: 1 | |
| # ── Test TypeScript ────────────────────────────────────────────────────── | |
| test-ts: | |
| name: Test TypeScript (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 20 | |
| needs: build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/setup | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: build-artifacts | |
| - name: Test TypeScript (all packages) | |
| run: pnpm test:ts | |
| # ── Test Go ────────────────────────────────────────────────────────────── | |
| test-go: | |
| name: Test Go (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 20 | |
| needs: build | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/setup | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| go: 'true' | |
| lfs: 'true' | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: build-artifacts | |
| - name: Test Go (all packages) | |
| run: pnpm test:go | |
| - name: Test hdf-cli | |
| run: cd hdf-cli && go test ./... | |
| - name: Race detector | |
| if: matrix.os == 'ubuntu-latest' | |
| run: cd hdf-cli && go test -race ./... | |
| # ── Coverage ───────────────────────────────────────────────────────────── | |
| coverage: | |
| name: Coverage | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/setup | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| go: 'true' | |
| lfs: 'true' | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: build-artifacts | |
| - name: TypeScript coverage | |
| run: pnpm -r --filter=!hdf-cli run test:coverage | |
| - name: Go coverage (workspace packages) | |
| run: | | |
| for dir in hdf-mappings/go hdf-validators/go hdf-parsers/go; do | |
| echo "=== $dir ===" | |
| (cd $dir && go test -coverprofile=coverage.out ./... && go tool cover -func=coverage.out | tail -1) | |
| done | |
| - name: Go coverage (hdf-converters) | |
| run: | | |
| cd hdf-converters | |
| go test -coverprofile=coverage.out ./registry/... ./converters/*/go/ ./shared/go/ | |
| go tool cover -func=coverage.out | tail -1 | |
| - name: Go coverage (hdf-cli) | |
| run: | | |
| cd hdf-cli | |
| go test -coverprofile=coverage.out ./... | |
| go tool cover -func=coverage.out | tail -1 | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: always() | |
| with: | |
| name: coverage-reports | |
| path: | | |
| **/coverage | |
| **/coverage.out | |
| retention-days: 30 | |
| # ── Verify packed tarballs (publint + attw) ────────────────────────────── | |
| # Packs every publishable workspace package and runs publint + | |
| # @arethetypeswrong/cli against each tarball. Catches package-metadata | |
| # and types-export defects that the regular test suite cannot see: | |
| # missing `exports.types`, ESM-declared packages with broken dual-types, | |
| # dead `main`/`module` paths, unreachable sub-path exports, or imports | |
| # in .d.ts files that fail to resolve in a consumer install. Uses | |
| # tarballs (not source dirs) so we validate exactly what `pnpm publish` | |
| # would upload. Reuses the `build` job's artifact so we don't rebuild. | |
| verify-packages: | |
| name: Verify packed tarballs (publint + attw) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/setup | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: build-artifacts | |
| - name: Pack all publishable packages | |
| run: | | |
| mkdir -p /tmp/tarballs | |
| PACKAGES=( | |
| hdf-schema hdf-utilities hdf-mappings hdf-validators | |
| hdf-parsers hdf-converters hdf-generators hdf-diff | |
| hdf-extension-graph | |
| ) | |
| for pkg in "${PACKAGES[@]}"; do | |
| (cd "$pkg" && pnpm pack --pack-destination /tmp/tarballs) | |
| done | |
| - name: publint each tarball | |
| run: | | |
| FAIL=0 | |
| for tb in /tmp/tarballs/*.tgz; do | |
| echo "::group::publint $(basename "$tb")" | |
| pnpm dlx publint "$tb" || FAIL=1 | |
| echo "::endgroup::" | |
| done | |
| exit $FAIL | |
| - name: "@arethetypeswrong/cli each tarball" | |
| # --ignore-rules: | |
| # cjs-resolves-to-esm: we publish ESM-only intentionally | |
| # (see package.json `"type": "module"`). | |
| # no-resolution: sub-path exports (./helpers, ./hdf-results) | |
| # require the "exports" map, which node10 does not support. | |
| # We target Node 22+ (see engines field in package.json). | |
| # | |
| # `pnpm exec` (not dlx): attw is a root devDependency so we get | |
| # the lockfile-pinned version. dlx pulls each transitive dep | |
| # fresh and bypasses the fflate@0.8.3 → 0.8.2 override that | |
| # works around upstream attw bug | |
| # arethetypeswrong/arethetypeswrong.github.io#258, #262, PR #261 | |
| # (open). When that PR ships, drop the override and this comment. | |
| run: | | |
| FAIL=0 | |
| for tb in /tmp/tarballs/*.tgz; do | |
| echo "::group::attw $(basename "$tb")" | |
| pnpm exec attw --ignore-rules cjs-resolves-to-esm no-resolution -- "$tb" || FAIL=1 | |
| echo "::endgroup::" | |
| done | |
| exit $FAIL | |
| # ── Site smoke build ───────────────────────────────────────────────────── | |
| # Builds the VitePress schema reference site against the just-built | |
| # schemas. Catches generator script breakage, broken sidebar config, | |
| # missing markdown links, and other site-config defects on the PR that | |
| # introduces them — not at release-tag time when deploy-schemas.yml runs | |
| # for the first time and fails on a production deploy. | |
| # | |
| # Output not uploaded; this is a smoke test, not the deploy. | |
| site-build: | |
| name: Build schema site (smoke) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: build | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: ./.github/actions/setup | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: build-artifacts | |
| - name: Generate schema pages | |
| run: cd site && pnpm generate | |
| - name: VitePress build | |
| run: cd site && pnpm exec vitepress build |