458 lines
21 KiB
YAML
458 lines
21 KiB
YAML
# GENERATED FILE — edit config/ci/gates.json and run `corepack pnpm generate:ci-workflow`.
|
|
name: frontend-quality-gates
|
|
|
|
on:
|
|
push:
|
|
branches: [develop]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
stage:
|
|
description: Highest promotion tier to evaluate
|
|
required: true
|
|
default: merge
|
|
type: choice
|
|
options:
|
|
- merge
|
|
- release
|
|
- production
|
|
- field
|
|
- documentation
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CI: "true"
|
|
VITE_BUILD_ID: "gitea-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
VITE_COMMIT_SHA: "${{ gitea.sha }}"
|
|
RELEASE_ID: "${{ gitea.ref }}-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
CI_RUNNER_IMAGE: "${{ vars.RUNNER_IMAGE_DIGEST }}"
|
|
|
|
jobs:
|
|
merge_gate:
|
|
name: "${{ matrix.gate }} / ${{ matrix.name }}"
|
|
if: ${{ gitea.event_name != 'workflow_dispatch' || inputs.stage != 'documentation' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-001, name: manifest-lockfile, browser: false }
|
|
- { gate: FE-GATE-002, name: lint, browser: false }
|
|
- { gate: FE-GATE-003, name: typecheck, browser: false }
|
|
- { gate: FE-GATE-004, name: runtime-schema, browser: false }
|
|
- { gate: FE-GATE-005, name: unit, browser: false }
|
|
- { gate: FE-GATE-006, name: component, browser: false }
|
|
- { gate: FE-GATE-007, name: integration, browser: false }
|
|
- { gate: FE-GATE-008, name: e2e, browser: true }
|
|
- { gate: FE-GATE-009, name: accessibility, browser: true }
|
|
- { gate: FE-GATE-010, name: architecture, browser: false }
|
|
- { gate: FE-GATE-011, name: build, browser: false }
|
|
- { gate: FE-GATE-013, name: security, browser: false }
|
|
- { gate: FE-GATE-020, name: removability, browser: false }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Install Playwright browsers
|
|
if: ${{ matrix.browser }}
|
|
run: corepack pnpm exec playwright install --with-deps chromium firefox webkit
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- ${{ matrix.gate }}
|
|
- name: Upload merge gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "${{ matrix.gate }}-${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
release_gate:
|
|
name: "${{ matrix.gate }} / ${{ matrix.name }}"
|
|
needs: merge_gate
|
|
if: ${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
HOSTING_BASE_URL: "${{ vars.HOSTING_BASE_URL }}"
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-012, name: bundle, browser: false }
|
|
- { gate: FE-GATE-014, name: config-compatibility, browser: false }
|
|
- { gate: FE-GATE-019, name: hosting-header, browser: false }
|
|
- { gate: FE-GATE-026, name: lab-performance, browser: true }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Install Playwright browsers
|
|
if: ${{ matrix.browser }}
|
|
run: corepack pnpm exec playwright install --with-deps chromium firefox webkit
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- ${{ matrix.gate }}
|
|
- name: Upload release gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "${{ matrix.gate }}-${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
immutable_build:
|
|
name: "FE-GATE-015 / immutable-release-candidate"
|
|
needs: release_gate
|
|
if: ${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
dist_sha256: ${{ steps.candidate.outputs.dist_sha256 }}
|
|
archive_sha256: ${{ steps.candidate.outputs.archive_sha256 }}
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Build candidate once and verify local evidence
|
|
run: corepack pnpm ci:gate -- FE-GATE-015
|
|
- name: Archive and validate the exact candidate file set
|
|
id: candidate
|
|
run: |
|
|
mkdir -p .release
|
|
tar --sort=name --mtime="@0" --owner=0 --group=0 --numeric-owner -czf ".release/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz" \
|
|
dist \
|
|
pnpm-lock.yaml \
|
|
artifacts/performance/bundle.json \
|
|
artifacts/quality/vite-module-inventory.json \
|
|
artifacts/release/build-manifest.json \
|
|
artifacts/release/checksums.txt \
|
|
artifacts/release/dependency-inventory.json \
|
|
artifacts/release/provenance.json \
|
|
artifacts/release/verification.json \
|
|
artifacts/release/sbom.cdx.json \
|
|
artifacts/security/dependency-diff.json \
|
|
artifacts/security/license-report.json \
|
|
artifacts/security/local-evidence-assessment.json \
|
|
artifacts/security/scan.sarif \
|
|
artifacts/security/supply-chain-coherence.json \
|
|
artifacts/security/supply-chain-verification.json \
|
|
artifacts/security/vulnerability-report.json \
|
|
config/security/dependency-baseline.approval.json \
|
|
config/security/dependency-baseline.json \
|
|
config/security/dependency-change-evidence.json \
|
|
config/security/dependency-policy.json \
|
|
config/security/secret-scan-policy.json \
|
|
config/security/vulnerability-exceptions.json \
|
|
config/security/vulnerability-policy.json \
|
|
schemas/artifacts/build-manifest.schema.json \
|
|
schemas/artifacts/dependency-inventory.schema.json \
|
|
schemas/artifacts/supply-chain-verification.schema.json \
|
|
scripts/contracts/release-artifacts.ts \
|
|
scripts/create-release-candidate.ts \
|
|
scripts/generate-supply-chain.ts \
|
|
scripts/lib/build-manifest-outputs.ts \
|
|
scripts/lib/json-schema.ts \
|
|
scripts/lib/local-policy-evidence.ts \
|
|
scripts/lib/local-release-evidence.ts \
|
|
scripts/lib/release-candidate.ts \
|
|
scripts/lib/release-input-evidence.ts \
|
|
scripts/lib/release-runtime-coherence.ts \
|
|
scripts/lib/repository-file-inventory.ts \
|
|
scripts/lib/secret-scan-evaluator.ts \
|
|
scripts/lib/secret-scan-policy.ts \
|
|
scripts/lib/secret-scan.ts \
|
|
scripts/lib/supply-chain.ts \
|
|
scripts/lib/validated-json-artifact.ts \
|
|
src/contracts/release-artifacts.ts \
|
|
src/features/installed-contract-contributions.ts \
|
|
src/features/installed-feature-contracts.ts \
|
|
artifacts/release/release-candidate.json
|
|
node scripts/verify-ci-candidate-archive.ts --archive ".release/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz" --github-output "$GITHUB_OUTPUT"
|
|
- name: Upload release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: ".release/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
|
|
if-no-files-found: error
|
|
|
|
vulnerability_provider:
|
|
name: external-vulnerability-provider
|
|
needs: immutable_build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
invocation_nonce: ${{ steps.supervise_vulnerability.outputs.invocation_nonce }}
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/vulnerability-candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "${{ gitea.run_attempt }}"
|
|
EXPECTED_SOURCE_REVISION: "${{ gitea.sha }}"
|
|
VULNERABILITY_PUBLIC_KEY_PATH: "${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
|
|
VULNERABILITY_KEY_ID: "${{ vars.VULNERABILITY_KEY_ID }}"
|
|
VULNERABILITY_PROVIDER_COMMAND: "${{ vars.VULNERABILITY_PROVIDER_COMMAND }}"
|
|
VULNERABILITY_REPORT_PATH: provider-evidence/untrusted/vulnerability-report.json
|
|
VALIDATED_PROVIDER_REPORT_PATH: provider-evidence/vulnerability-report.json
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: .release/vulnerability-candidate
|
|
- name: Run and validate external vulnerability provider in one trusted supervisor
|
|
id: supervise_vulnerability
|
|
run: node scripts/run-and-validate-provider.ts --kind vulnerability
|
|
- name: Confirm sealed vulnerability provider evidence
|
|
run: test -s "$VALIDATED_PROVIDER_REPORT_PATH"
|
|
- name: Upload vulnerability provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "vulnerability-provider-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: provider-evidence/vulnerability-report.json
|
|
if-no-files-found: error
|
|
|
|
provenance_provider:
|
|
name: external-provenance-provider
|
|
needs: immutable_build
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
outputs:
|
|
invocation_nonce: ${{ steps.supervise_provenance.outputs.invocation_nonce }}
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/provenance-candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "${{ gitea.run_attempt }}"
|
|
EXPECTED_SOURCE_REVISION: "${{ gitea.sha }}"
|
|
PROVENANCE_PUBLIC_KEY_PATH: "${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
|
|
PROVENANCE_KEY_ID: "${{ vars.PROVENANCE_KEY_ID }}"
|
|
PROVENANCE_PROVIDER_COMMAND: "${{ vars.PROVENANCE_PROVIDER_COMMAND }}"
|
|
PROVENANCE_ATTESTATION_PATH: provider-evidence/untrusted/provenance-attestation.json
|
|
VALIDATED_PROVIDER_REPORT_PATH: provider-evidence/provenance-attestation.json
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: .release/provenance-candidate
|
|
- name: Run and validate external provenance provider in one trusted supervisor
|
|
id: supervise_provenance
|
|
run: node scripts/run-and-validate-provider.ts --kind provenance
|
|
- name: Confirm sealed provenance provider evidence
|
|
run: test -s "$VALIDATED_PROVIDER_REPORT_PATH"
|
|
- name: Upload provenance provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "provenance-provider-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: provider-evidence/provenance-attestation.json
|
|
if-no-files-found: error
|
|
|
|
promotion:
|
|
name: promote-verified-immutable-candidate
|
|
needs: [immutable_build, vulnerability_provider, provenance_provider]
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
CANDIDATE_ARCHIVE_SHA256: "${{ needs.immutable_build.outputs.archive_sha256 }}"
|
|
CANDIDATE_ARCHIVE_PATH: ".release/candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
|
|
CI_RUN_ID: "${{ gitea.run_id }}"
|
|
CI_RUN_ATTEMPT: "${{ gitea.run_attempt }}"
|
|
VULNERABILITY_REPORT_PATH: "${{ gitea.workspace }}/.release/vulnerability/vulnerability-report.json"
|
|
PROVENANCE_ATTESTATION_PATH: "${{ gitea.workspace }}/.release/provenance/provenance-attestation.json"
|
|
VULNERABILITY_PUBLIC_KEY_PATH: "${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
|
|
VULNERABILITY_KEY_ID: "${{ vars.VULNERABILITY_KEY_ID }}"
|
|
PROVENANCE_PUBLIC_KEY_PATH: "${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
|
|
PROVENANCE_KEY_ID: "${{ vars.PROVENANCE_KEY_ID }}"
|
|
VULNERABILITY_INVOCATION_NONCE: "${{ needs.vulnerability_provider.outputs.invocation_nonce }}"
|
|
PROVENANCE_INVOCATION_NONCE: "${{ needs.provenance_provider.outputs.invocation_nonce }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Download release candidate
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: .release/candidate
|
|
- name: Download vulnerability provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "vulnerability-provider-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: .release/vulnerability
|
|
- name: Download provenance provider evidence
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@75635f32b4c1c41c4b3d64e8f85210112ed4c9c7
|
|
with:
|
|
name: "provenance-provider-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: .release/provenance
|
|
- name: Finalize verified promotion from inode-bound captured inputs
|
|
id: finalize
|
|
run: node scripts/stage-verified-promotion.ts
|
|
- name: Upload promoted release
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "promoted-release-${{ gitea.run_id }}-${{ gitea.run_attempt }}"
|
|
path: |
|
|
${{ steps.finalize.outputs.staging_root }}/release-candidate.tar.gz
|
|
${{ steps.finalize.outputs.staging_root }}/vulnerability-report.json
|
|
${{ steps.finalize.outputs.staging_root }}/provenance-attestation.json
|
|
${{ steps.finalize.outputs.staging_root }}/provider-verification.json
|
|
${{ steps.finalize.outputs.staging_root }}/promotion-verification.json
|
|
if-no-files-found: error
|
|
- name: Always remove private promotion staging
|
|
if: always()
|
|
env:
|
|
PROMOTION_STAGING_ROOT: ${{ steps.finalize.outputs.staging_root }}
|
|
PROMOTION_CLEANUP_TOKEN: ${{ steps.finalize.outputs.cleanup_token }}
|
|
PROMOTION_RUNNER_TEMP_DEV: ${{ steps.finalize.outputs.runner_temp_dev }}
|
|
PROMOTION_RUNNER_TEMP_INO: ${{ steps.finalize.outputs.runner_temp_ino }}
|
|
PROMOTION_STAGING_DEV: ${{ steps.finalize.outputs.staging_dev }}
|
|
PROMOTION_STAGING_INO: ${{ steps.finalize.outputs.staging_ino }}
|
|
run: |
|
|
if [ -n "$PROMOTION_STAGING_ROOT" ] && [ -n "$PROMOTION_CLEANUP_TOKEN" ] && [ -n "$PROMOTION_RUNNER_TEMP_DEV" ] && [ -n "$PROMOTION_RUNNER_TEMP_INO" ] && [ -n "$PROMOTION_STAGING_DEV" ] && [ -n "$PROMOTION_STAGING_INO" ]; then
|
|
node scripts/cleanup-verified-promotion.ts
|
|
fi
|
|
|
|
production_gate:
|
|
name: "${{ matrix.gate }} / ${{ matrix.name }}"
|
|
needs: promotion
|
|
if: ${{ gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'production' || inputs.stage == 'field') }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- { gate: FE-GATE-016, name: rollback-drill }
|
|
- { gate: FE-GATE-021, name: runbook-boot-config }
|
|
- { gate: FE-GATE-022, name: runbook-chunk-mismatch }
|
|
- { gate: FE-GATE-023, name: runbook-api-degradation }
|
|
- { gate: FE-GATE-024, name: runbook-telemetry }
|
|
- { gate: FE-GATE-025, name: runbook-release-rollback }
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- ${{ matrix.gate }}
|
|
- name: Upload production gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "${{ matrix.gate }}-${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
field_gate:
|
|
name: "FE-GATE-018 / field-web-vitals"
|
|
needs: production_gate
|
|
if: ${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'field' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
env:
|
|
FIELD_WEB_VITALS_INPUT: "${{ vars.FIELD_WEB_VITALS_INPUT }}"
|
|
MIN_ELIGIBLE_SAMPLES: "${{ vars.MIN_ELIGIBLE_SAMPLES }}"
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run blocking gate
|
|
run: corepack pnpm ci:gate -- FE-GATE-018
|
|
- name: Upload field gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "FE-GATE-018-${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|
|
|
|
documentation_gate:
|
|
name: "FE-GATE-017 / diagram-review"
|
|
if: ${{ gitea.event_name == 'workflow_dispatch' && inputs.stage == 'documentation' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 45
|
|
steps:
|
|
- uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
persist-credentials: false
|
|
- uses: https://github.com/actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version-file: .nvmrc
|
|
- name: Frozen install
|
|
run: |
|
|
corepack enable
|
|
corepack pnpm install --frozen-lockfile --ignore-scripts
|
|
- name: Run documentation gate
|
|
run: corepack pnpm ci:gate -- FE-GATE-017
|
|
- name: Upload documentation gate evidence
|
|
if: always()
|
|
uses: https://github.com/ChristopherHX/gitea-upload-artifact@81f940d004763f986ba3582c007fd842dd5cb0d7
|
|
with:
|
|
name: "FE-GATE-017-${{ gitea.run_id }}"
|
|
path: artifacts/
|
|
if-no-files-found: error
|