struxadotcloud/struxa

public

fix(security): resolve code-scanning alertsb3b8ad34 months ago184 lines · 5.3 KB

1	name: Build Check
2
3	on:
4	pull_request:
5	branches:
6	- "**"
7
8	concurrency:
9	group: build-${{ github.ref }}
10	cancel-in-progress: true
11
12	jobs:
13	changes:
14	name: Detect Changes
15	runs-on: blacksmith-2vcpu-ubuntu-2404
16	permissions:
17	contents: read
18	outputs:
19	web: ${{ steps.filter.outputs.web }}
20	go: ${{ steps.filter.outputs.go }}
21	steps:
22	- uses: actions/checkout@v4
23	- uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 #
24	id: filter
25	with:
26	filters: \|
27	web:
28	- 'apps/web/**'
29	- 'packages/**'
30	- 'package.json'
31	- 'bun.lock'
32	- 'turbo.json'
33	- 'tsconfig.json'
34	go:
35	- 'apps/watchkeeper/**'
36
37	typecheck:
38	name: Type Check
39	needs: changes
40	if: needs.changes.outputs.web == 'true'
41	runs-on: blacksmith-2vcpu-ubuntu-2404
42	permissions:
43	contents: read
44	outputs:
45	result: ${{ job.status }}
46
47	steps:
48	- name: Checkout
49	uses: actions/checkout@v4
50
51	- name: Setup Bun
52	uses: useblacksmith/setup-bun@d9a9b6b2b9986450eb588fc55d3961ecd4c81c57 # v1
53	with:
54	bun-version: "1.3.5"
55
56	- name: Install dependencies
57	run: bun install --frozen-lockfile
58
59	- name: Type check
60	run: bun run check-types
61
62	build-web:
63	name: Build (Web)
64	needs: changes
65	if: needs.changes.outputs.web == 'true'
66	runs-on: blacksmith-2vcpu-ubuntu-2404
67	permissions:
68	contents: read
69	outputs:
70	result: ${{ job.status }}
71
72	steps:
73	- name: Checkout
74	uses: actions/checkout@v4
75
76	- name: Setup Bun
77	uses: useblacksmith/setup-bun@d9a9b6b2b9986450eb588fc55d3961ecd4c81c57 # v1
78	with:
79	bun-version: "1.3.5"
80
81	- name: Install dependencies
82	run: bun install --frozen-lockfile
83
84	- name: Build
85	run: bun run build
86	env:
87	SKIP_ENV_VALIDATION: "1"
88	NEXT_TELEMETRY_DISABLED: "1"
89
90	build-go:
91	name: Build (Go)
92	needs: changes
93	if: needs.changes.outputs.go == 'true'
94	runs-on: blacksmith-2vcpu-ubuntu-2404
95	permissions:
96	contents: read
97	outputs:
98	result: ${{ job.status }}
99
100	steps:
101	- name: Checkout
102	uses: actions/checkout@v4
103
104	- name: Setup Go
105	uses: actions/setup-go@v5
106	with:
107	go-version-file: apps/watchkeeper/go.mod
108
109	- name: Build
110	run: go build ./...
111	working-directory: apps/watchkeeper
112
113	comment:
114	name: PR Comment
115	runs-on: blacksmith-2vcpu-ubuntu-2404
116	needs: [typecheck, build-web,
117	if: always() && github.event_name == 'pull_request'
118	permissions:
119	pull-requests: write
120
121	steps:
122	- name: Post result comment
123	uses: actions/github-script@v7
124	with:
125	script: \|
126	const typecheck = '${{ needs.typecheck.outputs.result }}' \|\| 'skipped';
127	const buildWeb = '${{ needs.build-web.outputs.result }}' \|\| 'skipped';
128	const buildGo = '${{ needs.build-go.outputs.result }}' \|\| 'skipped';
129
130	const icon = (s) => s === 'success' ? '✅' : s === 'skipped' ? '⏭️' : '❌';
131	const label = (s) => s === 'success' ? 'passed' : s === 'skipped' ? 'skipped' : 'failed';
132
133	const relevant = [typecheck, buildWeb, buildGo].filter(s => s !== 'skipped');
134	const allGood = relevant.length === 0 \|\| relevant.every(s => s === 'success');
135	const header = allGood
136	? '## ✅ Build checks passed'
137	: '## ❌ Build checks failed';
138
139	const run_url = `https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}`;
140
141	const rows = [];
142	if (typecheck !== 'skipped' \|\| buildWeb !== 'skipped') {
143	rows.push(`\| Type Check \| ${icon(typecheck)} ${label(typecheck)} \|`);
144	rows.push(`\| Build (Web) \| ${icon(buildWeb)} ${label(buildWeb)} \|`);
145	}
146	if (buildGo !== 'skipped') {
147	rows.push(`\| Build (Go) \| ${icon(buildGo)} ${label(buildGo)} \|`);
148	}
149
150	const body = [
151	header,
152	'',
153	'\| Check \| Status \|',
154	'\|-------\|--------\|',
155	...rows,
156	'',
157	`[View run](${run_url}) · commit ${{ github.sha }}`.slice(0, 120),
158	].join('\n');
159
160	const marker = '<!-- struxa-build-check -->';
161
162	const { data: comments } = await github.rest.issues.listComments({
163	owner: context.repo.owner,
164	repo: context.repo.repo,
165	issue_number: context.issue.number,
166	});
167
168	const existing = comments.find(c => c.body.includes(marker));
169
170	if (existing) {
171	await github.rest.issues.updateComment({
172	owner: context.repo.owner,
173	repo: context.repo.repo,
174	comment_id: existing.id,
175	body: marker + '\n' + body,
176	});
177	} else {
178	await github.rest.issues.createComment({
179	owner: context.repo.owner,
180	repo: context.repo.repo,
181	issue_number: context.issue.number,
182	body: marker + '\n' + body,
183	});
184	}