fix(court-docket): read pushed docket results instead of dead live-scrape POST #305
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [ main ] | |
| jobs: | |
| workflow-secret-policy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Enforce Workflow Secret Allowlist | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| secrets_in_use="$(grep -RhoE '\$\{\{\s*secrets(\.[A-Za-z_][A-Za-z0-9_]*|\['"'"'\"[A-Za-z_][A-Za-z0-9_]*'"'"'\"\])\s*\}\}' .github/workflows \ | |
| | sed -E "s/.*secrets[.\['\"]([A-Za-z_][A-Za-z0-9_]*).*/\1/" \ | |
| | sort -u || true)" | |
| if [[ -z "${secrets_in_use}" ]]; then | |
| echo "No workflow secrets in use." | |
| exit 0 | |
| fi | |
| if [[ ! -f .github/allowed-workflow-secrets.txt ]]; then | |
| echo "Missing .github/allowed-workflow-secrets.txt" | |
| exit 1 | |
| fi | |
| disallowed=0 | |
| while IFS= read -r secret_name; do | |
| [[ -z "${secret_name}" ]] && continue | |
| if ! grep -qx "${secret_name}" .github/allowed-workflow-secrets.txt; then | |
| echo "Disallowed workflow secret reference: ${secret_name}" | |
| disallowed=1 | |
| fi | |
| done <<< "${secrets_in_use}" | |
| if [[ "${disallowed}" -ne 0 ]]; then | |
| echo "Workflow secret policy check failed." | |
| exit 1 | |
| fi | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Gitleaks | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| GL_VERSION="8.30.0" | |
| curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GL_VERSION}/gitleaks_${GL_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tgz | |
| tar -xzf /tmp/gitleaks.tgz -C /tmp gitleaks | |
| /tmp/gitleaks version | |
| - name: Scan Git History | |
| run: /tmp/gitleaks git --config .gitleaks.toml --redact --log-opts="--all" --exit-code 1 | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - workflow-secret-policy | |
| - secret-scan | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| - name: Install | |
| run: npm ci | |
| - name: Dependency Audit | |
| # Scope the High+ gate to production dependencies shipped to the Worker | |
| # runtime. All current High/Moderate advisories are in dev-only tooling | |
| # (esbuild, vite, ws via wrangler / drizzle-kit / vitest) with no | |
| # non-breaking fix; the runtime dependency tree is clean. Mirrors the | |
| # audit_omit_dev option already exposed by reusable-governance-gates.yml. | |
| run: npm audit --audit-level=high --omit=dev | |
| - name: Typecheck | |
| run: npx tsc -p tsconfig.json --noEmit | |
| - name: Test | |
| run: npm test | |
| - name: Governance Pressure Tests | |
| run: bash scripts/pressure-test-governance.sh | |
| - name: Lint (skipped) | |
| run: echo "no linter configured" | |
| build-ui: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| needs: | |
| - workflow-secret-policy | |
| - secret-scan | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: 'npm' | |
| cache-dependency-path: ui/package-lock.json | |
| - name: Install | |
| run: npm ci | |
| working-directory: ui | |
| - name: Build (includes typecheck) | |
| run: npm run build | |
| working-directory: ui |