chore(deps): reconcile the lockfile after the cascade #206
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Seeded from the socket-wheelhouse CI preset, then owned by this repo: | |
| # edit it here. Fleet CI runs check + test through the LOCAL composite | |
| # actions under .github/actions/, inlined, so there is no cross-repo | |
| # reusable workflow and no first-party `uses:@sha`. | |
| name: ⚡ CI | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['*'] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| # Fleet no-phone-home posture: CI runners don't source the shell-rc that dev | |
| # machines get from setup-security-tools, so set every FLEET_ENV knob | |
| # workflow-level or the telemetry-env-is-disabled + | |
| # package-manager-auto-update-is-disabled gates (under `check --all`) fail. | |
| # Lockstep source: .claude/hooks/fleet/_shared/fleet-env.mts (FLEET_ENV) — | |
| # the telemetry-env-is-disabled check asserts each knob at CI runtime. | |
| env: | |
| CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1' | |
| COREPACK_ENABLE_PROJECT_SPEC: '0' | |
| DISABLE_TELEMETRY: '1' | |
| DO_NOT_TRACK: '1' | |
| NO_UPDATE_NOTIFIER: '1' | |
| OTEL_SDK_DISABLED: 'true' | |
| jobs: | |
| # First step of every job is the third-party actions/checkout (GitHub fetches | |
| # it independently) to populate the workspace so the LOCAL `./.github/actions/*` | |
| # composites resolve. setup-and-install then re-checks-out — full history | |
| # (fetch-depth 0) in the check job, since the commit-history checks it runs | |
| # (AI-attribution, release-boundary) read the default branch's history and | |
| # refuse a shallow clone rather than false-green; the test matrix stays at | |
| # the default depth (25 — covers CI's other git operations) and runs the | |
| # zizmor Actions audit (its own `strategy.job-total < 2` skip runs it in the | |
| # non-matrix check job, skips it in the test matrix). | |
| check: | |
| name: 🔎 Check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15) | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| # Full history: the commit-history checks (AI-attribution, | |
| # release-boundary) read the default branch's history and refuse a | |
| # shallow clone rather than false-green. | |
| checkout-fetch-depth: '0' | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| # Thin-distribution CI auth: mint a contents:read-only token so the | |
| # bootstrap fetch (fired by `prepare` during install) can download the | |
| # fleet release bundle from the private wheelhouse. Both refs are | |
| # empty on a non-thin member (var/secret unset) - the mint is skipped | |
| # and the fetch no-ops. A thin member sets a dedicated read-only App's | |
| # client-id var + private-key secret. | |
| payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }} | |
| - uses: ./.github/actions/fleet/run-script | |
| with: | |
| main-script: pnpm run check --all | |
| test: | |
| name: 🧪 Test | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 4 | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15) | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - uses: ./.github/actions/fleet/setup-and-install | |
| with: | |
| socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }} | |
| # Thin-distribution CI auth: mint a contents:read-only token so the | |
| # bootstrap fetch (fired by `prepare` during install) can download the | |
| # fleet release bundle from the private wheelhouse. Both refs are | |
| # empty on a non-thin member (var/secret unset) - the mint is skipped | |
| # and the fetch no-ops. A thin member sets a dedicated read-only App's | |
| # client-id var + private-key secret. | |
| payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }} | |
| payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }} | |
| - uses: ./.github/actions/fleet/run-script | |
| with: | |
| setup-script: pnpm run build | |
| main-script: pnpm test --all |