cli/.github/workflows/github-scripts-ci.yml at develop · supabase/cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: GitHub Scripts CI

# `.github/scripts/**` ships hand-rolled TypeScript (the AI review pipeline,
# the contribution gate) with its own `bun:test` suites, but `bun test` skips
# dot-directories by default and nothing previously type-checked this code in
# CI. This is a small, non-required check dedicated to that surface — it does
# not gate branch protection and never runs in `merge_group`.
on:
  pull_request:
    paths:
      - ".github/scripts/**"
      - "apps/cli/src/shared/services/Dockerfile"
      - "apps/cli/src/shared/services/parse-dockerfile-service-images.ts"
      - "apps/cli/src/shared/services/slim-images.ts"
      - "packages/stack/src/Artifacts.ts"
      - ".github/workflows/ai-review.yml"
      - ".github/workflows/fast-forward.yml"
      - ".github/workflows/lint-pull-request.yml"
      - ".github/workflows/sync-branches.yml"
      - ".github/workflows/sync-repair.yml"
      - ".github/sync-branches/**"
      - "apps/cli/scripts/analyze-commits-title.js"
      - ".github/workflows/github-scripts-ci.yml"
      - ".github/workflows/mirror-slim-image.yml"

permissions: {}

concurrency:
  group: github-scripts-ci-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  test:
    name: Test and type-check
    runs-on: ubuntu-latest
    # The shared setup installs the full workspace + Go toolchain via mise, which
    # runs ~9-10 min; a 10-minute cap raced the install and got cancelled on a
    # cold cache. 20 gives that install headroom. (This check is heavier than it
    # needs to be for two scripts — slimming the setup is a possible follow-up.)
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # The shared setup installs the toolchain (bun/pnpm/node via mise) AND the
      # workspace dependencies, so the type-check below can resolve
      # `@tsconfig/bun` + `@types/bun` from `node_modules`. `setup-bun` alone
      # left those uninstalled, which is what failed this check originally. On
      # fork PRs the firewall token is empty and the shared setup falls back to
      # the public npm registry, so this stays fork-safe.
      - uses: ./.github/actions/setup
        with:
          dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}

      - name: Run tests
        run: |
          set -uo pipefail
          # The root `test:github-scripts` script runs `bun test ./.github/scripts`;
          # its leading "./" is load-bearing, since `bun test .github/scripts`
          # silently discovers ZERO tests and still exits 0. Capture output to a
          # file instead of piping it, so `test_exit` below is the script's own
          # exit code, not `tee`/`grep`'s.
          pnpm run test:github-scripts > /tmp/github-scripts-test-output.txt 2>&1
          test_exit=$?
          cat /tmp/github-scripts-test-output.txt
          if [ "$test_exit" -ne 0 ]; then
            echo "::error ::bun test failed (exit $test_exit)." >&2
            exit 1
          fi
          if ! grep -Eq 'Ran [1-9][0-9]* tests' /tmp/github-scripts-test-output.txt; then
            echo "::error ::bun test reported no tests ran (missing 'Ran N tests' with N>0) — the leading './' may have been dropped, or test discovery is otherwise broken." >&2
            exit 1
          fi

      - name: Type-check
        run: bun x tsc --noEmit -p .github/scripts/tsconfig.json