Jakob Wennberg
5369349e9e
Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override). Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly. Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure. 40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run). Full details in the PR body.
55 lines
1.8 KiB
YAML
55 lines
1.8 KiB
YAML
name: CI cache warm
|
|
|
|
# The save half of the npm cache that .github/actions/setup-core restores.
|
|
#
|
|
# It has to live in its own main-branch workflow. GitHub scopes a cache entry to
|
|
# the ref that wrote it, with one exception: entries written on the default
|
|
# branch are readable from every branch and PR. core-build.yml runs on
|
|
# pull_request only, so anything it saved would be readable by exactly one PR
|
|
# and dead the moment that PR merged. That is not hypothetical here: a naive
|
|
# `cache: npm` on the pg-real workflow once put fourteen 284 MB copies (4 GB,
|
|
# 40% of the repo quota) on disk in a day, none of them ever restorable.
|
|
#
|
|
# So: main saves, PRs restore-only. Keyed on the lockfile hash, so this runs
|
|
# only when dependencies actually move and each entry is read many times before
|
|
# it is replaced.
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- package-lock.json
|
|
- package.json
|
|
workflow_dispatch: {}
|
|
|
|
concurrency:
|
|
group: ci-cache
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
warm:
|
|
name: Warm npm cache
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
|
|
with:
|
|
node-version: 20
|
|
|
|
# Populates ~/.npm. `npm ci` deletes node_modules first, so this measures
|
|
# a cold install the same way a PR job will.
|
|
- run: npm ci
|
|
|
|
# A no-op when the key already exists, which is the intent: one entry per
|
|
# lockfile state, not one per push.
|
|
- name: Save npm cache
|
|
uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
|
|
with:
|
|
path: ~/.npm
|
|
key: npm-${{ runner.os }}-node20-${{ hashFiles('package-lock.json') }}
|