StudyBuddy/.github/workflows/ci.yml at master · HabsaTheDog/StudyBuddy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
name: CI

on:
  pull_request:
  push:
    branches: [master]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  verify:
    name: Verify (${{ matrix.os }})
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.16
          cache: npm
      - uses: typst-community/setup-typst@40d32bb6ccb235bd7f5164cb47cfd40a5ea3a314 # v5
        with:
          typst-version: 0.15.0
      - run: npm ci
      - name: Install Linux document and browser tooling
        if: runner.os == 'Linux'
        run: |
          sudo apt-get update
          sudo apt-get install -y poppler-utils
          npx playwright install --with-deps chromium
      - name: Install Windows document and browser tooling
        if: runner.os == 'Windows'
        run: |
          $popplerVersion = "26.02.0-0"
          $popplerArchive = Join-Path $env:RUNNER_TEMP "poppler-$popplerVersion.zip"
          $popplerRoot = Join-Path $env:RUNNER_TEMP "poppler-$popplerVersion"
          Invoke-WebRequest -Uri "https://github.com/oschwartz10612/poppler-windows/releases/download/v$popplerVersion/Release-$popplerVersion.zip" -OutFile $popplerArchive
          $expectedSha256 = "993e4a94376ed712fafc7058d724ea0b943d118bbd2305cd9ed55174eb85cda5"
          $actualSha256 = (Get-FileHash $popplerArchive -Algorithm SHA256).Hash.ToLowerInvariant()
          if ($actualSha256 -ne $expectedSha256) { throw "Downloaded Poppler archive checksum mismatch." }
          Expand-Archive -Path $popplerArchive -DestinationPath $popplerRoot
          $popplerBin = Get-ChildItem $popplerRoot -Recurse -Filter pdfinfo.exe |
            Select-Object -First 1 -ExpandProperty DirectoryName
          if (-not $popplerBin) { throw "The verified Poppler archive did not contain pdfinfo.exe." }
          $popplerBin | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
          $env:PATH = "$popplerBin;$env:PATH"
          pdfinfo -v
          npx playwright install chromium
      - run: npm run typecheck
      - run: npm test
      - name: Verify SDK and bundled CLI pairing
        run: npm run moodle:doctor:version

  repository-policy:
    name: Repository policy
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22.16
          cache: npm
      - run: npm ci
      - run: npm run check:links
      - run: npm run check:public-tree
      - run: npm run check:licenses
      - run: npm run check:sbom
      - run: npm run audit:all
      - name: Verify pinned submodule commit is public
        run: |
          commit="$(git ls-tree HEAD t3code-fork | awk '{print $3}')"
          test -n "$commit"
          git ls-remote https://github.com/HabsaTheDog/t3code.git | grep -F "$commit"

  ui-submodule:
    name: Pinned UI submodule
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          submodules: true
      - uses: voidzero-dev/setup-vp@313600b80b104eadebb9111787d37a2e83e014ca # v1.17.0
        with:
          working-directory: t3code-fork
          node-version-file: package.json
          cache: true
          run-install: true
      - name: Check UI formatting and lint
        working-directory: t3code-fork
        run: vp check
      - name: Typecheck UI workspace
        working-directory: t3code-fork
        run: vp run -r --concurrency-limit 2 typecheck
      - name: Test UI workspace
        working-directory: t3code-fork
        run: vp run -r --concurrency-limit 2 test
      - name: Audit Study Buddy release dependencies
        working-directory: t3code-fork
        run: node scripts/study-buddy-audit.ts