Jakob Wennberg
5369349e9e
Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override). Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly. Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure. 40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run). Full details in the PR body.
44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
name: Set up core toolchain
|
|
description: >-
|
|
Node, dependencies, and a zero-extension registry: the prologue every
|
|
core-build job needs before it can lint, build, or test. The caller must check
|
|
the repository out first, because a local composite action cannot be resolved
|
|
until the workspace containing it exists.
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
|
|
with:
|
|
node-version: 20
|
|
|
|
# Restore-only, deliberately never `save`. A cache written from a
|
|
# pull_request run is scoped to that PR's ref, so no other run can ever read
|
|
# it: PR-side saves are pure quota burn. Fourteen dead 284 MB copies (4 GB,
|
|
# 40% of the repo quota) accumulated in a single day the last time a naive
|
|
# `cache: npm` was left on, which is why test-pg-real.yml still runs
|
|
# uncached. The entries read here are written on main by ci-cache.yml, and
|
|
# default-branch entries are restorable from every PR.
|
|
- name: Restore npm cache
|
|
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
|
|
with:
|
|
path: ~/.npm
|
|
key: npm-${{ runner.os }}-node20-${{ hashFiles('package-lock.json') }}
|
|
restore-keys: |
|
|
npm-${{ runner.os }}-node20-
|
|
|
|
- name: Install dependencies
|
|
shell: bash
|
|
run: npm ci
|
|
|
|
# CI builds core with zero extensions enabled: that property is the entire
|
|
# reason this workflow exists, so every job that compiles or runs code needs
|
|
# the registry regenerated from an empty config first.
|
|
- name: Reset extensions config
|
|
shell: bash
|
|
run: echo '{"extensions":[]}' > extensions.config.json
|
|
|
|
- name: Generate extension registry
|
|
shell: bash
|
|
run: npm run setup:extensions
|