Limit credentialed CORS to trusted frontend origins #371
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Lighthouse | |
| on: | |
| push: | |
| pull_request: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.head.sha || github.sha }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| actions: read | |
| pull-requests: read | |
| jobs: | |
| dedupe: | |
| name: Avoid Duplicate Lighthouse Runs | |
| runs-on: ubuntu-latest | |
| outputs: | |
| should_run: ${{ steps.dedupe.outputs.should_run }} | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Decide whether this run owns the Lighthouse work | |
| id: dedupe | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }} | |
| PR_ACTION: ${{ github.event.action }} | |
| PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| WORKFLOW_FILE: lighthouse.yml | |
| run: bash .github/scripts/should-run-tests-workflow.sh | |
| detect-changes: | |
| name: Detect Changes | |
| needs: dedupe | |
| if: needs.dedupe.outputs.should_run == 'true' && github.repository == 'Modtale/modtale' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'Modtale/modtale') | |
| runs-on: ubuntu-latest | |
| outputs: | |
| frontend: ${{ steps.filter.outputs.frontend }} | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect changed components | |
| id: filter | |
| env: | |
| DEFAULT_BRANCH: ${{ github.event.repository.default_branch }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| PUSH_BEFORE_SHA: ${{ github.event.before }} | |
| run: bash .github/scripts/detect-component-changes.sh | |
| audit: | |
| name: Lighthouse Audit (non-blocking) | |
| needs: detect-changes | |
| if: needs.detect-changes.outputs.frontend == 'true' && github.repository == 'Modtale/modtale' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'Modtale/modtale') | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22.12.0 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| - name: Set up Chrome for Lighthouse | |
| id: setup-chrome | |
| uses: browser-actions/setup-chrome@v2 | |
| with: | |
| install-dependencies: true | |
| - name: Build frontend for Lighthouse | |
| run: npm run build | |
| - name: Run Lighthouse audit | |
| id: lighthouse | |
| continue-on-error: true | |
| env: | |
| CHROME_PATH: ${{ steps.setup-chrome.outputs.chrome-path }} | |
| run: npm run audit:lighthouse | |
| - name: Upload Lighthouse reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: lighthouse-reports | |
| path: frontend/.lighthouseci | |
| if-no-files-found: ignore | |
| retention-days: 7 | |
| - name: Report Lighthouse audit result | |
| if: steps.lighthouse.outcome == 'failure' | |
| run: | | |
| echo "::warning::Lighthouse audit failed or thresholds were not met. This workflow is non-blocking; review the uploaded lighthouse-reports artifact for details." |