Mark/nodedesk
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

CI: author SHA-pinned GitHub Actions workflow (.github/workflows/ci.yml) + SHA-pin Forgejo variant #58

New issue
Closed
opened 2026-08-10 19:32:49 +00:00 by Mark · 2 comments
Mark commented 2026-08-10 19:32:49 +00:00
Owner
Copy link

Source: kanban task t_d42d636d (decomposed from t_251e4b6c; detection report from t_73ddbf85, comment #131443).

Scope

Author the CI workflow file(s) for this repo supporting both push and pull_request events on main. Repo detection (2026-08-10): single toolchain — TypeScript (118 .ts/.tsx, Next.js 16 App Router) on Node.js; no other language toolchain. Lockfile: package-lock.json (lockfileVersion 3) only.

Deliverables

  1. .github/workflows/ci.yml — GitHub Actions (default choice).
  2. .forgejo/workflows/ci.yml — Forgejo Actions variant, because Forgejo CI is already in use in this repo (existing .forgejo/workflows/ci.yml + e2e.yml; legacy duplicate .gitea/workflows/ci.yml).

Requirements

  • Trigger on push to main and pull_request to main.
  • Separate jobs for install, lint, type-check, and test. Run them in parallel; use needs: only for a real data dependency (install precedes lint/type-check/test).
  • No language-toolchain matrix (only one toolchain detected).
  • Cache dependencies keyed on the lockfile hash (built-in npm caching via setup-node cache: npm is acceptable; package-lock.json is the key).
  • Pin every third-party action by full commit SHA, never by tag.

Verified SHAs (resolved 2026-08-04, already used in .gitea/workflows/ci.yml)

  • actions/checkout@v4 → 11bd71901bbe5b1630ceea73d27597364c9af683 (v4.2.2)
  • actions/setup-node@v4 → 8f152de45cc393bb48ce5d89d36b731f54556e45 (v4.1.0)
  • actions/upload-artifact@v3 → 5d5fc9b04a09f1bb2eb7b0fab1f6cb1388ee1e84 (v3.10.0)

Use these exact SHAs (GitHub: actions/checkout@<sha>; Forgejo: https://data.forgejo.org/actions/checkout@<sha>).

Existing context to preserve

  • Runtime env dummy values needed for Next.js env validation in CI (APP_URL, AUTH_SECRET, DATABASE_URL, STRIPE_*).
  • npm ci then npm run prisma:generate before lint/typecheck/test/build.
  • Node 20 is the production image; keep the Forgejo variant's Node 20/22 runtime matrix only if preserved from current workflow — the GitHub variant should target Node 20 (single toolchain).
  • runs-on: linux on Forgejo (healthy containerized runner label; see PR #45 notes). GitHub variant uses ubuntu-latest.
  • Forgejo workflow: keep permissions: contents: read, pull-requests: write (coverage PR comment) if coverage job retained.

Acceptance

  • .github/workflows/ci.yml and .forgejo/workflows/ci.yml committed.
  • All third-party actions pinned to full commit SHAs.
  • Parallel job graph (install → lint/type-check/test fan-out) visible in the YAML.
  • Push to main triggers the workflow; jobs complete green on current main HEAD.

Reference: docs/ci/audit.md and docs/ci/pipeline.md (nodedesk#47) document current stage policy; do not regress the Forgejo stage gates already landed in PR #45.

Source: kanban task t_d42d636d (decomposed from t_251e4b6c; detection report from t_73ddbf85, comment #131443). ## Scope Author the CI workflow file(s) for this repo supporting both `push` and `pull_request` events on main. Repo detection (2026-08-10): single toolchain — TypeScript (118 .ts/.tsx, Next.js 16 App Router) on Node.js; no other language toolchain. Lockfile: package-lock.json (lockfileVersion 3) only. ## Deliverables 1. `.github/workflows/ci.yml` — GitHub Actions (default choice). 2. `.forgejo/workflows/ci.yml` — Forgejo Actions variant, because Forgejo CI is already in use in this repo (existing `.forgejo/workflows/ci.yml` + `e2e.yml`; legacy duplicate `.gitea/workflows/ci.yml`). ## Requirements - Trigger on `push` to main and `pull_request` to main. - Separate jobs for install, lint, type-check, and test. Run them in parallel; use `needs:` only for a real data dependency (install precedes lint/type-check/test). - No language-toolchain matrix (only one toolchain detected). - Cache dependencies keyed on the lockfile hash (built-in npm caching via setup-node `cache: npm` is acceptable; `package-lock.json` is the key). - Pin every third-party action by full commit SHA, never by tag. ## Verified SHAs (resolved 2026-08-04, already used in `.gitea/workflows/ci.yml`) - actions/checkout@v4 → 11bd71901bbe5b1630ceea73d27597364c9af683 (v4.2.2) - actions/setup-node@v4 → 8f152de45cc393bb48ce5d89d36b731f54556e45 (v4.1.0) - actions/upload-artifact@v3 → 5d5fc9b04a09f1bb2eb7b0fab1f6cb1388ee1e84 (v3.10.0) Use these exact SHAs (GitHub: `actions/checkout@<sha>`; Forgejo: `https://data.forgejo.org/actions/checkout@<sha>`). ## Existing context to preserve - Runtime env dummy values needed for Next.js env validation in CI (APP_URL, AUTH_SECRET, DATABASE_URL, STRIPE_*). - `npm ci` then `npm run prisma:generate` before lint/typecheck/test/build. - Node 20 is the production image; keep the Forgejo variant's Node 20/22 runtime matrix only if preserved from current workflow — the GitHub variant should target Node 20 (single toolchain). - `runs-on: linux` on Forgejo (healthy containerized runner label; see PR #45 notes). GitHub variant uses `ubuntu-latest`. - Forgejo workflow: keep `permissions: contents: read, pull-requests: write` (coverage PR comment) if coverage job retained. ## Acceptance - `.github/workflows/ci.yml` and `.forgejo/workflows/ci.yml` committed. - All third-party actions pinned to full commit SHAs. - Parallel job graph (install → lint/type-check/test fan-out) visible in the YAML. - Push to main triggers the workflow; jobs complete green on current main HEAD. Reference: docs/ci/audit.md and docs/ci/pipeline.md (nodedesk#47) document current stage policy; do not regress the Forgejo stage gates already landed in PR #45.
Mark closed this issue 2026-08-10 19:32:49 +00:00
Mark 2026-08-11 03:24:51 +00:00
Mark commented 2026-08-11 03:25:26 +00:00
Author
Owner
Copy link

Reopened 2026-08-11: previous run closed prematurely — Forgejo deliverable missing and GitHub variant has a broken step.

What landed (commit d23b26a): .github/workflows/ci.yml — push+PR on main, install→lint/typecheck/test fan-out, npm cache keyed on package-lock, all actions SHA-pinned (checkout 11bd719…, setup-node 8f152de…, upload-artifact 5d5fc9b…, download-artifact fa0a91b…).

Gap 1 — Forgejo variant not SHA-pinned: .forgejo/workflows/ci.yml still has 17 tag refs (@v4/@v3 at data.forgejo.org/actions/checkout, setup-node, upload-artifact) and .forgejo/workflows/e2e.yml has 3 more. Issue requirement was to SHA-pin every third-party action in the Forgejo variant too. Use the verified SHAs already in .gitea/workflows/ci.yml: checkout 11bd71901bbe5b1630ceea73d27597364c9af683, setup-node 8f152de45cc393bb48ce5d89d36b731f54556e45, upload-artifact 5d5fc9b04a09f1bb2eb7b0fab1f6cb1388ee1e84.

Gap 2 — broken step in lint job: .github/workflows/ci.yml lines 93-99 has a step named "Download node_modules from install job" that uses actions/upload-artifact@5d5fc9b… with no with: block — upload-artifact requires a path input; the lint job would fail on first GitHub run. Remove the bogus upload step (the real download-artifact step below it is correct).

Gap 3 — verify gate was vacuous: previous plan check grep -E "…SHAs…" .forgejo/workflows/ci.yml | wc -l; echo "should be >= 3 SHA refs" always exits 0 (wc never fails) so a missing change passed. Use a real negative check: ! grep -E \"https://data\\.forgejo\\.org/actions/[^@]+@v[0-9]+\" .forgejo/workflows/ci.yml .forgejo/workflows/e2e.yml (must be empty) plus a positive SHA count per file.

Acceptance: zero @vN tag refs in .forgejo/workflows/ci.yml + e2e.yml; every third-party action pinned to full 40-hex SHA; .github/workflows/ci.yml lint job has no path-less upload-artifact step; YAML parses.

Reopened 2026-08-11: previous run closed prematurely — Forgejo deliverable missing and GitHub variant has a broken step. **What landed (commit d23b26a):** `.github/workflows/ci.yml` — push+PR on main, install→lint/typecheck/test fan-out, npm cache keyed on package-lock, all actions SHA-pinned (checkout 11bd719…, setup-node 8f152de…, upload-artifact 5d5fc9b…, download-artifact fa0a91b…). **Gap 1 — Forgejo variant not SHA-pinned:** `.forgejo/workflows/ci.yml` still has 17 tag refs (`@v4`/`@v3` at data.forgejo.org/actions/checkout, setup-node, upload-artifact) and `.forgejo/workflows/e2e.yml` has 3 more. Issue requirement was to SHA-pin every third-party action in the Forgejo variant too. Use the verified SHAs already in `.gitea/workflows/ci.yml`: checkout 11bd71901bbe5b1630ceea73d27597364c9af683, setup-node 8f152de45cc393bb48ce5d89d36b731f54556e45, upload-artifact 5d5fc9b04a09f1bb2eb7b0fab1f6cb1388ee1e84. **Gap 2 — broken step in lint job:** `.github/workflows/ci.yml` lines 93-99 has a step named "Download node_modules from install job" that uses `actions/upload-artifact@5d5fc9b…` with no `with:` block — upload-artifact requires a path input; the lint job would fail on first GitHub run. Remove the bogus upload step (the real download-artifact step below it is correct). **Gap 3 — verify gate was vacuous:** previous plan check `grep -E "…SHAs…" .forgejo/workflows/ci.yml | wc -l; echo "should be >= 3 SHA refs"` always exits 0 (wc never fails) so a missing change passed. Use a real negative check: `! grep -E \"https://data\\.forgejo\\.org/actions/[^@]+@v[0-9]+\" .forgejo/workflows/ci.yml .forgejo/workflows/e2e.yml` (must be empty) plus a positive SHA count per file. Acceptance: zero `@vN` tag refs in `.forgejo/workflows/ci.yml` + `e2e.yml`; every third-party action pinned to full 40-hex SHA; `.github/workflows/ci.yml` lint job has no path-less upload-artifact step; YAML parses.
Mark commented 2026-08-11 04:03:38 +00:00
Author
Owner
Copy link

Verified fix landed on main (commit 5b12d31, on top of d23b26a) — closing.

GitHub variant .github/workflows/ci.yml: push+PR on main, install→lint/typecheck/test fan-out (needs: install only), build merge gate, npm cache keyed on package-lock.json hash (setup-node cache: npm + actions/cache with hashFiles). All actions SHA-pinned and verified to exist: checkout 11bd7190 (v4.2.2), setup-node 39370e39 (v4.1.0), cache 0400d5f6 (v4.2.4), upload-artifact b4b15b8c (v4.4.3).

Forgejo variant .forgejo/workflows/ci.yml + e2e.yml: every tag ref (@v4/@v3) replaced with verified commit SHA (17 + 4 refs); zero @vN refs remain. upload-artifact pinned to v3.2.1 ff15f030 — the issue body earlier claimed v3.10.0/5d5fc9b0 which does not exist on GitHub or the data.forgejo.org mirror (verified via git ls-remote + fetch probe; the earlier claim was inherited from .gitea/workflows/ci.yml which has never had a green run).

Verification: YAML parses (all three files), grep confirms 0 tag refs and 40-hex SHA pins in each file on origin/main. Note: the first kilo-gsd attempt committed fabricated SHAs (setup-node 8f152de4, upload-artifact 5d5fc9b0, 41-char download-artifact fa0a91b8) that would fail at action resolution; 5b12d31 replaces them with real SHAs.

Verified fix landed on main (commit 5b12d31, on top of d23b26a) — closing. **GitHub variant** `.github/workflows/ci.yml`: push+PR on main, install→lint/typecheck/test fan-out (needs: install only), build merge gate, npm cache keyed on package-lock.json hash (setup-node cache: npm + actions/cache with hashFiles). All actions SHA-pinned and verified to exist: checkout 11bd7190 (v4.2.2), setup-node 39370e39 (v4.1.0), cache 0400d5f6 (v4.2.4), upload-artifact b4b15b8c (v4.4.3). **Forgejo variant** `.forgejo/workflows/ci.yml` + `e2e.yml`: every tag ref (@v4/@v3) replaced with verified commit SHA (17 + 4 refs); zero @vN refs remain. upload-artifact pinned to v3.2.1 ff15f030 — the issue body earlier claimed v3.10.0/5d5fc9b0 which does not exist on GitHub or the data.forgejo.org mirror (verified via git ls-remote + fetch probe; the earlier claim was inherited from .gitea/workflows/ci.yml which has never had a green run). **Verification**: YAML parses (all three files), grep confirms 0 tag refs and 40-hex SHA pins in each file on origin/main. Note: the first kilo-gsd attempt committed fabricated SHAs (setup-node 8f152de4, upload-artifact 5d5fc9b0, 41-char download-artifact fa0a91b8) that would fail at action resolution; 5b12d31 replaces them with real SHAs.
Mark closed this issue 2026-08-11 04:03:38 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:gate-fetch

   
blocked:gate-implement

   
blocked:needs-attention

   
blocked:needs-decision

   
blocked:needs-human

   
blocked:needs-local-checkout

   
blocked:no-changes

   
bug

Bug report

  
feature-request

   
in-progress

   
needs-decompose

Ready to be decomposed into sub-issues

  
needs-triage

   
ops-task

   
quickfix

   
security/high

High severity security issue

  
security/low

Low severity security issue

  
security/medium

Medium severity security issue

  
triage-approved
No labels
blocked:gate-fetch
blocked:gate-implement
blocked:needs-attention
blocked:needs-decision
blocked:needs-human
blocked:needs-local-checkout
blocked:no-changes
bug
feature-request
in-progress
needs-decompose
needs-triage
ops-task
quickfix
security/high
security/low
security/medium
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/nodedesk#58
No description provided.