chore(deps): bump the cloudflare group across 1 directory with 4 updates #83
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run check | |
| env: | |
| ABLE_PRIVATE_DENYLIST: ${{ secrets.ABLE_PRIVATE_DENYLIST }} | |
| - name: Build deploy artifact without publishing | |
| run: npx wrangler deploy --dry-run --config apps/desk/wrangler.jsonc --outdir apps/desk/dist/worker | |
| secret-history: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| - name: Scan private identifiers across complete main history | |
| if: github.event_name == 'push' | |
| env: | |
| PUBLIC_HISTORY_DENYLIST: ${{ secrets.ABLE_PRIVATE_DENYLIST }} | |
| run: npm run scan:history | |
| - name: Install pinned Gitleaks | |
| env: | |
| GITLEAKS_URL: https://github.com/gitleaks/gitleaks/releases/download/v8.24.3/gitleaks_8.24.3_linux_x64.tar.gz | |
| GITLEAKS_SHA256: 9991e0b2903da4c8f6122b5c3186448b927a5da4deef1fe45271c3793f4ee29c | |
| run: | | |
| curl --fail --location --silent --show-error "$GITLEAKS_URL" --output /tmp/gitleaks.tar.gz | |
| echo "$GITLEAKS_SHA256 /tmp/gitleaks.tar.gz" | sha256sum --check --strict - | |
| mkdir -p /tmp/gitleaks-bin | |
| tar -xzf /tmp/gitleaks.tar.gz -C /tmp/gitleaks-bin gitleaks | |
| - name: Scan complete main history | |
| run: /tmp/gitleaks-bin/gitleaks git --redact --verbose --exit-code=2 . | |
| visual: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: mcr.microsoft.com/playwright:v1.62.0-noble@sha256:baed2032d533817f3dbe6425de795788430ba345e819a1201337009ba17c9d07 | |
| options: --ipc=host | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run test:visual | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: failure() | |
| with: | |
| name: visual-regression-report | |
| path: apps/desk/test-results/ |