thunderkit/.github/workflows/ci.yml at master · thunderock/thunderkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
name: ci
"on":
  push:
    branches: ["**"]
  pull_request:
permissions:
  contents: read
jobs:
  test:
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: "3.12"
      - name: Prepare private Python runtime
        run: |
          umask 077
          prefix="$(mktemp -d "$RUNNER_TEMP/python-runtime.XXXXXX")"
          python="$(python3 -c 'import pathlib, sys; print(pathlib.Path(sys.executable).resolve())')"
          "$python" -I -m venv --copies --without-pip "$prefix"
          "$prefix/bin/python3" -I -c 'import os, pathlib, stat, sys; p = pathlib.Path(sys.executable); s = p.lstat(); assert stat.S_ISREG(s.st_mode) and s.st_uid == os.geteuid() and not s.st_mode & 0o022'
          printf '%s\n' "$prefix/bin" >> "$GITHUB_PATH"
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
        with:
          node-version: "24"
          package-manager-cache: false
      - name: Prepare isolated npm CLI
        run: |
          umask 077
          prefix="$(mktemp -d "$RUNNER_TEMP/npm-cli.XXXXXX")"
          cd "$RUNNER_TEMP"
          npm install --prefix "$prefix" --ignore-scripts --no-audit --no-fund --package-lock=false npm@11.19.1
          printf '%s\n' "$prefix/node_modules/.bin" >> "$GITHUB_PATH"
      - name: Run all offline tests
        env:
          npm_config_offline: "true"
          npm_config_ignore_scripts: "true"
          npm_config_audit: "false"
          npm_config_fund: "false"
        run: make run_tests
      - name: Lint
        run: make lint
      - name: Leakage gate (no secrets / proprietary strings)
        run: |
          if grep -rniE 'adobe|astiwari|sensei-fs|AWS_BEARER|\.internal\b|\bcorp\.|firefly|\borion\b' \
             skills site bin README.md NORTH_STAR.md DEPENDENCIES.md .thunderkit; then
            echo "::error::leakage denylist hit"; exit 1
          fi
          echo "leakage gate clean"
      - name: Build site
        run: make site