codegraph-brain/.github/workflows/ui.yml at main · zaebee/codegraph-brain · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
name: UI

# The graph debugger in ui/ had no CI at all (#452): ci.yml runs only the Python
# toolchain, so a change there could break the build and still merge green. It
# had already happened — when this job was added, main carried six eslint errors
# and two TypeScript errors that nothing had reported.
#
# Path-filtered so Python-only changes do not pay for a bun install, and the
# workflow file itself is in the filter so an edit to it runs it.
on:
  push:
    branches: [ main, dev, "feat/**", "fix/**", "docs/**" ]
    paths: [ "ui/**", ".github/workflows/ui.yml" ]
  pull_request:
    branches: [ main ]
    paths: [ "ui/**", ".github/workflows/ui.yml" ]

permissions:
  contents: read

jobs:
  ui-ci:
    name: UI Verification
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ui
    steps:
      - name: Checkout Code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2.2.0
        with:
          # Pinned rather than "latest": the lockfile format moves with bun, and
          # a runner picking up a new release must not be what turns this red.
          bun-version: 1.3.14

      - name: Install Dependencies
        # --frozen-lockfile fails when bun.lock is out of step with package.json,
        # the job's equivalent of `uv lock --check` in ci.yml. --ignore-scripts
        # because no dependency here needs an install hook — verified by running
        # every step below from a clean install with it — so none gets to run
        # code on the runner (Sonar githubactions:S6505).
        run: bun install --frozen-lockfile --ignore-scripts

      - name: ESLint
        run: bun run lint

      - name: Prettier
        # eslint-config-prettier turns ESLint's style rules off, so formatting is
        # checked here or nowhere; 31 files had drifted before this step existed.
        run: bun run format:check

      - name: TypeScript
        # Vite transpiles TypeScript without type-checking it, so `build` below
        # passes a type error. This is the only step that reads the types.
        # Through a package script, so it runs the `typescript` pinned in
        # bun.lock; `bunx tsc` could fetch an unpinned one (Sonar S8543).
        run: bun run typecheck

      - name: Tests
        # vitest, not `bun test`: the native runner has no `vi.mock` hoisting, and
        # component tests that use it fail under it (ui/AGENTS.md).
        run: bun run test:run

      - name: Build
        run: bun run build