dcd-cli/.github/workflows/cli-ci.yml at dev · devicecloud-dev/dcd-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
name: CLI CI

on:
  push:
    branches: [ dev, production ]
  pull_request:
    # `production` is included so the dev→production promotion PR is also gated
    # by lint/typecheck/build (and is required by the production ruleset).
    branches: [ dev, production ]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  secret-scan:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout (full history)
      uses: actions/checkout@v7
      with:
        # Full history so gitleaks scans every commit, not just the tip.
        fetch-depth: 0

    - name: Run gitleaks
      env:
        # Pinned release; bump deliberately. Run the binary directly rather than
        # gitleaks/gitleaks-action@v2, which requires a paid GITLEAKS_LICENSE for
        # organization-owned repos.
        GITLEAKS_VERSION: 8.30.1
      run: |
        curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
          | tar -xz gitleaks
        # --log-opts=HEAD scopes the scan to commits reachable from what's
        # checked out: the whole history of this branch (or of the PR merge
        # commit, i.e. base + PR commits), but NOT unrelated branches.
        # `fetch-depth: 0` fetches refs/heads/* — every branch — and gitleaks
        # otherwise scans all of them, so an open branch that legitimately
        # commits a high-entropy value plus its own .gitleaks.toml allowlist
        # would fail every OTHER branch's scan, which is judged against the
        # allowlist at its own tip. Each branch is still fully scanned by its
        # own PR, and pushes to dev/production scan their full history.
        ./gitleaks git . --redact --verbose --no-banner --log-opts=HEAD

  lint-and-test:
    runs-on: ubuntu-latest

    # This repo is PUBLIC and runs no step that reaches into the private
    # devicecloud-dev/dcd repo. It used to check out that repo's mock-api over an
    # SSH deploy key to run test/integration/*, which meant a private-repo
    # credential lived in a public repo's secrets and the API's OpenAPI spec was
    # pulled onto the runner on every same-repo PR. dcd#1036 deleted that mock-api;
    # rather than re-point at it, the linkage is gone.
    #
    # The consequence is deliberate: test/integration/* does NOT run here, and
    # neither does the swagger contract-drift check it provided (spec drift used to
    # surface as a Prism 422). Only test/unit/* runs — pure, no backend. To run the
    # integration suite locally, point MOCK_API_DIR at a mock; see CLAUDE.md.
    steps:
    - name: Checkout CLI
      uses: actions/checkout@v7
      with:
        path: cli

    - name: Setup pnpm
      uses: pnpm/action-setup@v6.0.10
      with:
        version: 10
        run_install: false

    - name: Setup Node.js
      uses: actions/setup-node@v7
      with:
        node-version: '22'
        cache: 'pnpm'
        cache-dependency-path: './cli/pnpm-lock.yaml'

    - name: Install CLI dependencies
      working-directory: ./cli
      run: pnpm install --frozen-lockfile

    - name: Run CLI linter
      working-directory: ./cli
      run: pnpm lint

    - name: Type check (strict, src + tests)
      working-directory: ./cli
      run: pnpm typecheck

    - name: Run CLI unit tests
      working-directory: ./cli
      run: pnpm test:unit

    - name: Note skipped integration tests
      run: echo "::notice::Integration tests are not run in CI — they need a mock of the dcd API, and this public repo does not reach into the private one. Lint, typecheck, unit tests, build and audit all ran."

    - name: Build CLI
      working-directory: ./cli
      run: pnpm build

    - name: Security audit
      working-directory: ./cli
      run: pnpm audit --audit-level moderate