socket-btm/.github/workflows/ci.yml at main · SocketDev/socket-btm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
# Baseline CI — seeded once by socket-wheelhouse (template/presets/), then
# repo-owned: edit freely. Runs check + test via the LOCAL composite actions
# under .github/actions/fleet/ (cascade-updated), referenced by ./ path — no
# cross-repo reusable workflow, no first-party `uses:@sha`. Add repo-specific
# jobs anywhere under `jobs:`.
name: ⚡ CI

on:
  push:
    branches: [main]
    tags: ['*']
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Fleet no-phone-home posture: CI runners don't source the shell-rc that dev
# machines get from setup-security-tools, so set every FLEET_ENV knob
# workflow-level or the telemetry-env-is-disabled +
# package-manager-auto-update-is-disabled gates (under `check --all`) fail.
# Lockstep source: .claude/hooks/fleet/_shared/fleet-env.mts (FLEET_ENV) —
# the telemetry-env-is-disabled check asserts each knob at CI runtime.
env:
  CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1'
  COREPACK_ENABLE_PROJECT_SPEC: '0'
  DISABLE_TELEMETRY: '1'
  DO_NOT_TRACK: '1'
  NO_UPDATE_NOTIFIER: '1'

jobs:
  # First step of every job is the third-party actions/checkout (GitHub fetches
  # it independently) to populate the workspace so the LOCAL `./.github/actions/*`
  # composites resolve. setup-and-install then re-checks-out at its deeper
  # default (fetch-depth 25 — covers CI's git operations) and
  # runs the zizmor Actions audit (its own `strategy.job-total < 2` skip runs it
  # in the non-matrix check job, skips it in the test matrix).
  check:
    name: 🔎 Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15)
        with:
          fetch-depth: 1
          persist-credentials: false
      - uses: ./.github/actions/fleet/setup-and-install
        with:
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
      - uses: ./.github/actions/fleet/run-script
        with:
          main-script: pnpm run check --all

  test:
    name: 🧪 Test
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15)
        with:
          fetch-depth: 1
          persist-credentials: false
      - uses: ./.github/actions/fleet/setup-and-install
        with:
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
      - uses: ./.github/actions/fleet/run-script
        env:
          # Authenticate build-time GitHub API reads (release listings,
          # prebuilt-artifact downloads). Unauthenticated calls share the
          # hosted runner's IP-scoped rate limit and 403 under load.
          GH_TOKEN: ${{ github.token }}
        with:
          setup-script: pnpm run build
          main-script: pnpm test --all