Self-heal Nuxt UserProfile popup on open, fix schemas/userSchema mismatch #261
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 👷🛠️ PR Builder | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled] | |
| merge_group: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| NODE_VERSION: "lts/*" | |
| jobs: | |
| audit: | |
| name: 🔍 Security Audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: 📥 Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: ⚙️ Set up Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - name: 📦 Set up pnpm | |
| uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 | |
| with: | |
| version: latest | |
| run_install: false | |
| - name: 🔍 Run pnpm audit | |
| run: pnpm audit --audit-level=high | |
| dependency-review: | |
| name: 🔎 Dependency Review | |
| if: ${{ github.event_name == 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: 📥 Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: 🔎 Dependency Review | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4 | |
| with: | |
| fail-on-severity: high | |
| deny-licenses: GPL-3.0-only,GPL-3.0-or-later,AGPL-3.0-only,AGPL-3.0-or-later | |
| comment-summary-in-pr: always | |
| base-ref: ${{ github.event.pull_request.base.sha }} | |
| head-ref: ${{ github.event.pull_request.head.sha }} | |
| build-lint-test: | |
| name: 🔨 Build, Lint & Test SDKs | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: 📥 Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: ⚙️ Set up Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| - name: 📦 Set up pnpm | |
| uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0 | |
| with: | |
| version: latest | |
| run_install: false | |
| - name: 🗄️ Cache pnpm store | |
| uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 | |
| with: | |
| path: ~/.local/share/pnpm/store | |
| key: ${{ runner.os }}-pnpm-${{ hashFiles('pnpm-lock.yaml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pnpm- | |
| - name: 📦 Install Dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: 🔨 Build | |
| run: pnpm build | |
| - name: 🎨 Check Formatting | |
| run: pnpm format:check | |
| - name: 🧹 Lint | |
| run: pnpm --filter '!./packages/**' --filter '!./samples/**' lint | |
| - name: 🧪 Test | |
| run: pnpm --filter '!./packages/**' --filter '!./samples/**' test | |
| e2e: | |
| name: 🎭 E2E (sample apps) | |
| # Label-gated, mirroring thunderid's own pr-builder.yml `trigger-pr-builder` pattern — a real | |
| # backend + six sample apps is expensive enough that it shouldn't run on every push by | |
| # default. Always runs on merge_group/workflow_dispatch. | |
| if: >- | |
| github.event_name != 'pull_request' || | |
| contains(github.event.pull_request.labels.*.name, 'trigger-e2e') | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 40 | |
| # Least privilege: this job never pushes, comments, or writes to the repo — only the default | |
| # GITHUB_TOKEN's read access is needed for checkout. | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: 📥 Checkout Code | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| # Matches thunder-id/thunderid's own checkout steps: the checked-out repo never needs | |
| # git push/fetch credentials in this job, so don't leave the token available to be | |
| # abused by anything that runs afterward (including the third-party composite actions | |
| # invoked later in this job). | |
| persist-credentials: false | |
| - name: 🎭 Run E2E suite | |
| uses: ./.github/actions/run-e2e-suite | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| artifact-name: playwright-report |