feat(plugin-email): SmtpTransport —— 真实 SMTP 投递、设置热替换、不再说谎的 mail/test (#5087) #2890
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate Dependencies | |
| on: | |
| pull_request: | |
| paths: | |
| - '**/package.json' | |
| - 'pnpm-lock.yaml' | |
| - '.changeset/config.json' | |
| - 'pnpm-workspace.yaml' | |
| - 'scripts/check-changeset-fixed.mjs' | |
| - 'scripts/check-override-consistency.mjs' | |
| # The OSV exemption ledger and its check: a PR that touches either must | |
| # run this workflow, or an exemption could be added without the gate | |
| # that governs it ever running on the PR that adds it. | |
| - 'osv-scanner.toml' | |
| - 'scripts/check-osv-exemptions.mjs' | |
| # Re-run when the workflow itself changes, so edits to these gates are | |
| # exercised on the PR that introduces them. | |
| - '.github/workflows/validate-deps.yml' | |
| schedule: | |
| # Run weekly on Monday at 03:00 UTC | |
| - cron: '0 3 * * 1' | |
| workflow_dispatch: | |
| jobs: | |
| validate: | |
| name: Validate Package Dependencies | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| - name: Enable Corepack | |
| run: corepack enable | |
| - name: Verify pnpm version | |
| run: pnpm --version | |
| - name: Get pnpm store directory | |
| shell: bash | |
| run: | | |
| echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV | |
| - name: Setup pnpm cache | |
| uses: actions/cache@v6 | |
| with: | |
| path: ${{ env.STORE_PATH }} | |
| key: ${{ runner.os }}-pnpm-store-v3-${{ hashFiles('**/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm-store-v3- | |
| - name: Verify lockfile is up to date | |
| run: | | |
| pnpm install --frozen-lockfile --prefer-offline | |
| - name: Verify Changesets "fixed" group covers every public package | |
| run: node scripts/check-changeset-fixed.mjs | |
| # pnpm overrides pin what THIS workspace resolves, but they do not ship | |
| # with published packages — downstream installs see only the declared | |
| # ranges. If an override target isn't reachable from a publishable | |
| # package's declared range, we test one dependency graph and publish | |
| # another (the 15.1.0 quickstart shipped exactly that: plugin-auth | |
| # declared better-auth ^1.6.23 while CI ran the 1.7.0-rc.1 override, | |
| # and every fresh project 500'd on auth). | |
| - name: Verify overrides are reflected in published manifests | |
| run: node scripts/check-override-consistency.mjs | |
| # Fail the workflow if known vulnerabilities are found — enforces | |
| # security compliance before merging. | |
| # | |
| # Previously this ran `pnpm audit --audit-level=high`, but npm retired the | |
| # audit endpoint (HTTP 410, "This endpoint is being retired. Use the bulk | |
| # advisory endpoint instead.") and pnpm has not migrated, so `pnpm audit` | |
| # now fails unconditionally on every branch (see issue #2974). OSV-Scanner | |
| # reads pnpm-lock.yaml directly against the OSV database and exits non-zero | |
| # when any advisory matches, restoring a working blocking gate. | |
| # | |
| # Note: OSV-Scanner blocks on any severity, not just high/critical. When | |
| # the advisory has a fixed version you take the fix. The ONLY escape | |
| # hatch, for an advisory with no fix available, is an `[[IgnoredVulns]]` | |
| # entry in `osv-scanner.toml` at the repo root — never lowering the gate. | |
| # | |
| # That escape hatch is governed by three conventions (#4965), stated in | |
| # full in the header of osv-scanner.toml: `ignoreUntil` mandatory | |
| # (default 30 days, ceiling 90), `reason` mandatory with an advisory link | |
| # plus a sentence on why it cannot be fixed, and exemptions land in their | |
| # own `osv-exemption`-labelled PR. The scanner enforces none of that — it | |
| # reads a missing `ignoreUntil` as "ignore forever", silently — so the | |
| # step below runs first and fails on any exemption that is missing, | |
| # quoted, expired, over the ceiling, or unexplained. `--self-test` proves | |
| # the check in both directions. | |
| - name: Verify OSV exemptions carry an expiry and a reason | |
| run: | | |
| node scripts/check-osv-exemptions.mjs --self-test | |
| node scripts/check-osv-exemptions.mjs | |
| - name: Audit dependencies for known vulnerabilities (OSV-Scanner) | |
| uses: google/osv-scanner-action/osv-scanner-action@9fd1bcce27f67e3bd819a0a7620e332803dc43bc # v2.3.8 | |
| with: | |
| scan-args: |- | |
| --lockfile=pnpm-lock.yaml | |
| - name: List outdated packages | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| run: | | |
| pnpm outdated --recursive || true |