9dd5c6e5f3
* Patch production dependency advisories
* ci: harden dependency installs with npm ci --ignore-scripts
- Replace npm install with npm ci --ignore-scripts across all workflows
to enforce lockfile parity and block dependency postinstall scripts.
- Run npm run postinstall explicitly after install so our root patch
script still applies (the only legitimate postinstall use in this
repo); dep lifecycle scripts stay blocked.
- Add lockfile-lint and npm audit signatures to the lint job to catch
registry-host tampering and verify cryptographic signatures.
- Regenerate package-lock.json to match bumped package.json versions.
* ci: drop --ignore-scripts; rely on npm ci + lockfile-lint + audit signatures
Lavamoat allow-scripts only traverses root deps; it can't see workspace
deps like electron, esbuild, sharp. Without proper monorepo support, an
allowlist would be incomplete and electron's binary download breaks.
Keep the rest of the security stack:
- npm ci (strict lockfile parity)
- lockfile-lint (resolved-host check)
- npm audit signatures (cryptographic verification)
Real script-blocking would need pnpm 10+ migration. Tracking separately.
* ci(nix-build): use PR head SHA so fork checkouts work
The previous `ref: ${{ github.head_ref || github.ref }}` made
actions/checkout fetch a branch name that only exists on the fork,
not origin. Use the PR head SHA instead — origin mirrors PR commits
via refs/pull/N/head, so this works for fork PRs without changing
the push-to-main auto-commit behavior.
---------
Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
56 lines
1.4 KiB
YAML
56 lines
1.4 KiB
YAML
name: Server CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "packages/server/**"
|
|
- "package.json"
|
|
- "package-lock.json"
|
|
- ".github/workflows/server-ci.yml"
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- "packages/server/**"
|
|
- "package.json"
|
|
- "package-lock.json"
|
|
- ".github/workflows/server-ci.yml"
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "22"
|
|
cache: "npm"
|
|
|
|
- name: Fetch origin/main (worktree tests)
|
|
run: git fetch --no-tags origin main:refs/remotes/origin/main
|
|
|
|
- name: Install server dependencies
|
|
run: npm ci --workspace=@getpaseo/server --include-workspace-root
|
|
|
|
- name: Install Claude Code CLI for provider tests
|
|
run: npm install -g @anthropic-ai/claude-code
|
|
|
|
- name: Build highlight dependency
|
|
run: npm run build --workspace=@getpaseo/highlight
|
|
|
|
- name: Build relay dependency
|
|
run: npm run build --workspace=@getpaseo/relay
|
|
|
|
- name: Typecheck
|
|
run: npm run typecheck --workspace=@getpaseo/server
|
|
|
|
- name: Test
|
|
run: npm run test --workspace=@getpaseo/server
|
|
env:
|
|
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
|
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|