[ENG-3582] map: record which dependency APIs the app calls, separatel… #357
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| capability-contract: | |
| name: Capability contract | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| # The version check compares the manifest against the base branch, so it needs history. | |
| fetch-depth: 0 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22.x | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Manifest is up to date with its source | |
| run: node scripts/emit-capabilities.mjs --check | |
| - name: Vocabulary changes carry a version bump | |
| # A member added or removed without moving CAPABILITY_VERSION leaves every vendoring consumer | |
| # unable to tell it is behind — the same silent drift the manifest exists to remove. | |
| run: node scripts/check-capability-version.mjs --base "origin/${{ github.base_ref || github.event.repository.default_branch }}" | |
| validate: | |
| name: Validate on Node ${{ matrix.node-version }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node-version: | |
| - 18.x | |
| - 20.x | |
| - 22.x | |
| - 24.x | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Test | |
| run: npm test | |
| - name: Build | |
| run: npm run build | |
| - name: Verify package contents | |
| run: npm pack --dry-run | |
| production-audit: | |
| name: Production dependency audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20.x | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Audit published dependency tree | |
| run: npm audit --omit=dev --audit-level=moderate |