chore(deps): bump lightningcss from 1.32.0 to 1.33.0 #1590
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Least-privilege default for every job; widen per-job only when needed. | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs on the same ref (e.g. rapid pushes to a PR) so CI | |
| # only spends minutes on the newest commit. Pushes to main run to completion. | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| lint: | |
| name: Lint CSS | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run lint:css | |
| commitlint: | |
| name: Lint commit messages | |
| runs-on: ubuntu-latest | |
| # Commit-message linting only makes sense against a PR's commit range. | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| # Full history so commitlint can walk base..head. | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Validate PR commits against Conventional Commits | |
| run: >- | |
| npx --no -- commitlint | |
| --from ${{ github.event.pull_request.base.sha }} | |
| --to ${{ github.event.pull_request.head.sha }} | |
| --verbose | |
| build: | |
| name: Build bundle | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run build | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: dist | |
| path: dist/ | |
| artifacts-freshness: | |
| name: Verify all generated artifacts | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| # Full history so check-token-registry.js can diff the registry | |
| # against the base branch (id-permanence gate) rather than HEAD. | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - run: npm run audit:check | |
| - run: node scripts/check-artifacts.js --check | |
| - run: node scripts/check-version-sync.js | |
| - run: node scripts/check-token-registry.js | |
| - run: node scripts/check-llm-guide.js | |
| # Every hand-written doc must reference only live token/class names (or | |
| # names explicitly allowlisted in docs/ref-allowlist.json). | |
| - run: node scripts/check-doc-refs.js | |
| # The release workflow's git-add must stage every file version-sync writes. | |
| - run: node scripts/check-release-add-list.js | |
| # architecture.md's layer order must match core/layers.css (the cascade contract). | |
| - run: node scripts/check-layer-order.js | |
| - run: node scripts/check-macro-catalog.js | |
| # #582 source-CSS audit gates: false wiring claims, annotation/value | |
| # drift, fallback-only hook tokens, hand-maintained mirrors, and | |
| # per-bundle token definitions. | |
| - run: node scripts/check-dead-knobs.js | |
| - run: node scripts/check-annotations.js | |
| - run: node scripts/check-hook-tokens.js | |
| - run: node scripts/check-mirrors.js | |
| - run: node scripts/check-bundle-defs.js | |
| dependency-audit: | |
| name: Dependency vulnerability audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| # Fail only on high/critical advisories so routine low-severity noise | |
| # doesn't block merges. Tune the threshold as the project matures. | |
| - run: npm audit --audit-level=high | |
| breaking-change-docs: | |
| name: Check migration docs for breaking changes | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Fail if breaking change is missing migration docs | |
| env: | |
| BASE: ${{ github.event.pull_request.base.sha }} | |
| HEAD: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| if git log "$BASE..$HEAD" --no-merges --pretty=format:"%s" \ | |
| | grep -qE '^[[:alnum:]_-]+(\([^)]+\))?!:'; then | |
| if ! git diff --name-only "$BASE" "$HEAD" | grep -q '^docs/migration\.md$'; then | |
| echo "::error::Breaking change detected but docs/migration.md was not updated." \ | |
| "Add a migration section or use a non-breaking commit type." | |
| exit 1 | |
| fi | |
| echo "Breaking changes found — docs/migration.md was updated." | |
| else | |
| echo "No breaking changes detected." | |
| fi | |
| test: | |
| name: Regression tests | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| # Reuse the dist/ artifact from the build job — no need to rebuild. | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: dist | |
| path: dist/ | |
| # Run unit tests directly (skipping the pretest build hook). | |
| - run: npm run test:unit | |
| - run: npx playwright install --with-deps chromium firefox webkit | |
| - run: npx playwright test | |
| configurator: | |
| name: Configurator tests | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| # Root deps first: the configurator's sync script reads docs/api-index.json | |
| # via tooling generated at the repo root. | |
| - run: npm ci | |
| - run: npm ci | |
| working-directory: configurator | |
| # Reuse the dist/ artifact from the build job so the configurator Vite | |
| # build can resolve PreviewPanel.svelte's ?raw CSS import without a | |
| # redundant root rebuild. | |
| - uses: actions/download-artifact@v8 | |
| with: | |
| name: dist | |
| path: dist/ | |
| # Unit suite — the sync tripwire: curated Basic controls, presets, fluid | |
| # engine scalars and knob defaults all pinned to the live catalogue — | |
| # plus the Vitest component suite (test runs both via test:unit/components). | |
| - run: npm test | |
| working-directory: configurator | |
| # Future-proofing tripwire: every public knob must map to a real domain. | |
| - run: npm run check:curation | |
| working-directory: configurator | |
| # Type/diagnostics gate (kept at 0 errors / 0 warnings). | |
| - run: npm run check | |
| working-directory: configurator | |
| # Browser regression suite (test:e2e prebuilds the configurator via Vite; | |
| # Playwright manages the preview server via its webServer option). | |
| # Cross-engine: the full suite runs on Chromium; core behaviour + the | |
| # dogfood/isolation contract also run on Firefox and WebKit. | |
| - run: npx playwright install --with-deps chromium firefox webkit | |
| working-directory: configurator | |
| - run: npm run test:e2e | |
| working-directory: configurator |