124 lines
3.6 KiB
Markdown
124 lines
3.6 KiB
Markdown
# CI-WORKFLOW — snapshot de .gitea/workflows/ci.yml
|
|
|
|
name: CI
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
branches: ["master"]
|
|
|
|
env:
|
|
NODE_OPTIONS: --dns-result-order=ipv4first
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
|
|
jobs:
|
|
build-and-anchors:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
|
|
|
|
steps:
|
|
- name: Tools sanity
|
|
run: |
|
|
set -euo pipefail
|
|
git --version
|
|
node --version
|
|
npm --version
|
|
npm ping --registry=https://registry.npmjs.org
|
|
|
|
# Checkout SANS action externe (pas de github.com)
|
|
- name: Checkout (from event.json, no external actions)
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
EVENT_JSON="/var/run/act/workflow/event.json"
|
|
if [ ! -f "$EVENT_JSON" ]; then
|
|
echo "ERROR: missing $EVENT_JSON"
|
|
ls -la /var/run/act/workflow || true
|
|
exit 1
|
|
fi
|
|
|
|
# 1) Récupère l'URL du repo depuis event.json
|
|
REPO_URL="$(node -e '
|
|
const fs=require("fs");
|
|
const ev=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
|
|
let url = ev.repository?.clone_url || ev.repository?.html_url || "";
|
|
if (!url) process.exit(2);
|
|
if (!url.endsWith(".git")) url += ".git";
|
|
process.stdout.write(url);
|
|
' "$EVENT_JSON")"
|
|
|
|
# 2) Récupère le SHA (push -> after, PR -> pull_request.head.sha)
|
|
SHA="$(node -e '
|
|
const fs=require("fs");
|
|
const ev=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));
|
|
const sha =
|
|
ev.after ||
|
|
ev.pull_request?.head?.sha ||
|
|
ev.head_commit?.id ||
|
|
"";
|
|
process.stdout.write(sha);
|
|
' "$EVENT_JSON")"
|
|
|
|
if [ -z "$SHA" ]; then
|
|
echo "ERROR: cannot find SHA in event.json"
|
|
node -e 'const ev=require(process.argv[1]); console.log(Object.keys(ev));' "$EVENT_JSON" || true
|
|
exit 1
|
|
fi
|
|
|
|
echo "Repo URL: $REPO_URL"
|
|
echo "SHA: $SHA"
|
|
|
|
# 3) Ajoute token si disponible (NE PAS afficher le token)
|
|
AUTH_URL="$REPO_URL"
|
|
if [ -n "${GITHUB_TOKEN:-}" ] && [[ "$REPO_URL" == https://* ]]; then
|
|
AUTH_URL="${REPO_URL/https:\/\//https:\/\/oauth2:${GITHUB_TOKEN}@}"
|
|
elif [ -n "${GITEA_TOKEN:-}" ] && [[ "$REPO_URL" == https://* ]]; then
|
|
AUTH_URL="${REPO_URL/https:\/\//https:\/\/oauth2:${GITEA_TOKEN}@}"
|
|
fi
|
|
|
|
# 4) Clone minimal + checkout exact du SHA
|
|
rm -rf .git || true
|
|
git init .
|
|
|
|
# Optionnel si ton Gitea a un TLS “non standard” (certificat) :
|
|
# git config --global http.sslVerify false
|
|
|
|
git remote add origin "$AUTH_URL"
|
|
git fetch --depth=1 origin "$SHA"
|
|
git checkout -q FETCH_HEAD
|
|
|
|
git log -1 --oneline
|
|
|
|
- name: Anchor aliases schema
|
|
run: node scripts/check-anchor-aliases.mjs
|
|
|
|
- name: NPM harden
|
|
run: |
|
|
set -euo pipefail
|
|
npm config set fetch-retries 5
|
|
npm config set fetch-retry-mintimeout 20000
|
|
npm config set fetch-retry-maxtimeout 120000
|
|
npm config set registry https://registry.npmjs.org
|
|
npm config get registry
|
|
|
|
- name: Install deps
|
|
run: npm ci
|
|
|
|
- name: Inline scripts syntax check
|
|
run: node scripts/check-inline-js.mjs
|
|
|
|
- name: Build
|
|
run: npm run build
|
|
|
|
- name: Verify anchor aliases injected
|
|
run: node scripts/verify-anchor-aliases-in-dist.mjs
|
|
|
|
- name: Anchors contract
|
|
run: npm run test:anchors
|
|
|
|
|