chore: update verified programs list #1683
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master, development, 'development-*'] | |
| pull_request: | |
| env: | |
| PLAYWRIGHT_BROWSERS_PATH: ~/.cache/ms-playwright | |
| SENTRY_TELEMETRY_DISABLE: true | |
| STORYBOOK_DISABLE_TELEMETRY: 1 | |
| OPENSPEC_TELEMETRY: 0 | |
| jobs: | |
| # Job to read Node version from .nvmrc | |
| read-nvmrc: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| node-version: ${{ steps.nvmrc.outputs.NODE_VERSION }} | |
| shard-list: ${{ steps.shards.outputs.list }} | |
| shard-total: ${{ steps.shards.outputs.total }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| sparse-checkout: | | |
| .nvmrc | |
| sparse-checkout-cone-mode: false | |
| - name: Read .nvmrc | |
| id: nvmrc | |
| run: echo "NODE_VERSION=$(cat .nvmrc)" >> $GITHUB_OUTPUT | |
| # One source for the shard count: `strategy.matrix` cannot read `env`, and a matrix that | |
| # disagrees with the `--shard` divisor passes green while silently skipping the missing slices. | |
| - name: Plan specs shards | |
| id: shards | |
| run: | | |
| total=2 | |
| echo "total=$total" >> $GITHUB_OUTPUT | |
| echo "list=[$(seq -s, 1 $total)]" >> $GITHUB_OUTPUT | |
| Build-And-Test: | |
| needs: read-nvmrc | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| matrix: | |
| node-version: ['${{ needs.read-nvmrc.outputs.node-version }}', '24.x'] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # The pnpm store is not here: setup-node caches it, and holding both stored the same tree twice. | |
| # A source hash suits an incremental build cache, where a near miss still helps. | |
| - name: Setup Additional Cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| id: additional_cache | |
| with: | |
| path: | | |
| ${{ env.PLAYWRIGHT_BROWSERS_PATH }} | |
| ${{ github.workspace }}/.next/cache | |
| key: build-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ hashFiles('**/.browserslistrc') }}-${{ hashFiles('**/*.ts', '**/*.tsx') }} | |
| restore-keys: | | |
| build-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/pnpm-lock.yaml') }}- | |
| build-cache-${{ runner.os }}-${{ runner.arch }}- | |
| - name: Setup pnpm and Node.js | |
| uses: ./.github/actions/pnpm-setup | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| - name: Format | |
| run: pnpm format:ci | |
| - name: Lint | |
| run: pnpm lint | |
| - name: OpenSpec | |
| run: pnpm openspec:validate | |
| # Mandatory, and the only `next build` in CI — Specs-Shards only generates types. A production | |
| # build that breaks fails here or nowhere, so this step must not be weakened to typegen. | |
| - name: Build | |
| run: pnpm build | |
| # The app specs run in Specs-Shards; keeping them here would serialise ~4.5 min behind this job. | |
| - name: Test packages | |
| run: pnpm test:packages | |
| # Split off Build-And-Test so the specs sweep fans out without re-running format/lint/build per shard. | |
| # Sharded on both node versions: leaving 24.x whole would keep it the ~8 min critical path. | |
| Specs-Shards: | |
| needs: read-nvmrc | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: ['${{ needs.read-nvmrc.outputs.node-version }}', '24.x'] | |
| shard: ${{ fromJSON(needs.read-nvmrc.outputs.shard-list) }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup pnpm and Node.js | |
| uses: ./.github/actions/pnpm-setup | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| # Specs resolve sibling packages through dist. No `next build`: nothing here reads the generated | |
| # route types now that the specs project no longer typechecks. | |
| - name: Build packages | |
| run: pnpm build:packages | |
| - name: Test specs (shard ${{ matrix.shard }}/${{ needs.read-nvmrc.outputs.shard-total }}) | |
| run: pnpm test:ci:specs --shard=${{ matrix.shard }}/${{ needs.read-nvmrc.outputs.shard-total }} | |
| Security-Audit: | |
| # Independent of the build: the audit resolves the tree from pnpm-lock.yaml and queries | |
| # the registry, so it runs in parallel for faster, self-contained feedback. | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install package manager | |
| uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 | |
| # `pnpm audit` resolves the tree from pnpm-lock.yaml and queries the registry — no | |
| # `pnpm install`/node_modules needed, so this job skips install and caching entirely. | |
| # Fails on any critical advisory; lower severities are reported but do not block. | |
| # Baseline unfixable dev-only advisories via `auditConfig.ignoreGhsas` in | |
| # pnpm-workspace.yaml rather than lowering this gate. | |
| - name: Audit dependencies | |
| run: pnpm audit:ci | |
| Sitemap-Check: | |
| needs: read-nvmrc | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup pnpm and Node.js | |
| uses: ./.github/actions/pnpm-setup | |
| with: | |
| node-version: ${{ needs.read-nvmrc.outputs.node-version }} | |
| # scripts/update-sitemap.ts imports app/utils/programs.ts, which imports the built @explorer/decoder-mango. | |
| - name: Build workspace packages | |
| run: pnpm build:packages | |
| - name: Generate sitemap | |
| run: pnpm exec tsx scripts/update-sitemap.ts | |
| - name: Check for sitemap drift | |
| run: git diff --exit-code public/sitemap.xml public/default-sitemap.xml public/accounts-sitemap.xml | |
| Storybook-Smoke-Tests: | |
| needs: read-nvmrc | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| continue-on-error: true | |
| strategy: | |
| matrix: | |
| node-version: ['${{ needs.read-nvmrc.outputs.node-version }}', '24.x'] | |
| # The browser-mode sweep has repeatedly died on a full root partition ("No space left on device"). | |
| # Browsers and the Vite dep-optimize cache live on the runner's ~65 GB /mnt scratch disk | |
| # (PLAYWRIGHT_BROWSERS_PATH / VITE_CACHE_PATH); the pnpm store stays on / so node_modules keeps hardlinking. | |
| env: | |
| PLAYWRIGHT_CACHE_AFFIX: pw-mnt | |
| PLAYWRIGHT_BROWSERS_PATH: /mnt/cache/ms-playwright | |
| VITE_CACHE_PATH: /mnt/cache/vite | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Prepare cache dirs on the scratch disk | |
| run: | | |
| sudo mkdir -p "$PLAYWRIGHT_BROWSERS_PATH" "$VITE_CACHE_PATH" | |
| sudo chown -R "$(id -u):$(id -g)" "$PLAYWRIGHT_BROWSERS_PATH" "$VITE_CACHE_PATH" | |
| - name: Cache Playwright browsers | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| id: playwright_cache | |
| with: | |
| path: ${{ env.PLAYWRIGHT_BROWSERS_PATH }} | |
| key: ${{ runner.os }}-${{ env.PLAYWRIGHT_CACHE_AFFIX }}-${{ hashFiles('**/pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ env.PLAYWRIGHT_CACHE_AFFIX }}- | |
| - name: Setup pnpm and Node.js | |
| uses: ./.github/actions/pnpm-setup | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| # No-op while setup-node restores by exact key only; kept in case the store ever regains restore-keys. | |
| - name: Prune pnpm store | |
| run: pnpm store prune | |
| - name: Install Playwright browsers | |
| if: steps.playwright_cache.outputs.cache-hit != 'true' | |
| run: pnpm exec playwright install --with-deps chromium | |
| - name: Install Playwright system deps only | |
| if: steps.playwright_cache.outputs.cache-hit == 'true' | |
| run: pnpm exec playwright install-deps chromium | |
| - name: Run Storybook smoke tests | |
| env: | |
| STORYBOOK_DISABLE_TELEMETRY: ${{ env.STORYBOOK_DISABLE_TELEMETRY }} | |
| run: pnpm test:sb |