chore(deps): bump @aastar/sdk 0.39.4 → 0.43.0 (CC-40/CC-41, unblock CC-33) #1261
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [master] | |
| pull_request: | |
| branches: [master] | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| jobs: | |
| # Job 1: Security audit | |
| security: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Use Node.js 20 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| - name: Install root dependencies with force | |
| run: npm ci | |
| - name: Run npm audit (All workspaces) | |
| # Using critical level: remaining high-severity issues (multer, serialize-javascript, ajv) | |
| # are upstream NestJS/webpack dependencies with no non-breaking fix available yet. | |
| # See: https://github.com/expressjs/multer/issues (pinned at 2.0.2 by @nestjs/platform-express) | |
| run: npm audit --audit-level=critical --workspaces --if-present | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: "fs" | |
| scan-ref: "." | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| trivyignores: .trivyignore | |
| - name: Upload Trivy results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| - name: Dependency Review | |
| if: github.event_name == 'pull_request' | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: high | |
| # Temporary: axios high vuln in @ledgerhq optional deps (via @aastar/airaccount). | |
| # No non-breaking fix available until ledgerhq updates their axios dependency. | |
| allow-ghsas: GHSA-43fc-jf86-j433 | |
| # Job 2: Code quality checks | |
| quality: | |
| name: Code Quality | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| project: [aastar, aastar-frontend] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Use Node.js 20 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Check formatting | |
| run: | | |
| if [ -f ${{ matrix.project }}/package.json ] && jq -e '.scripts["format:check"]' ${{ matrix.project }}/package.json > /dev/null; then | |
| npm run format:check --workspace=${{ matrix.project }} | |
| else | |
| cd ${{ matrix.project }} && npx prettier --check "**/*.{js,jsx,ts,tsx,json,css,md}" | |
| fi | |
| - name: Run linter | |
| run: | | |
| if [ -f ${{ matrix.project }}/package.json ] && jq -e '.scripts["lint:check"]' ${{ matrix.project }}/package.json > /dev/null; then | |
| npm run lint:check --workspace=${{ matrix.project }} | |
| elif [ -f ${{ matrix.project }}/package.json ] && jq -e '.scripts.lint' ${{ matrix.project }}/package.json > /dev/null; then | |
| npm run lint --workspace=${{ matrix.project }} | |
| else | |
| cd ${{ matrix.project }} && npx eslint . --ext .js,.jsx,.ts,.tsx | |
| fi | |
| - name: Check i18n locale parity | |
| run: | | |
| if [ -f ${{ matrix.project }}/package.json ] && jq -e '.scripts["i18n:check"]' ${{ matrix.project }}/package.json > /dev/null; then | |
| npm run i18n:check --workspace=${{ matrix.project }} | |
| fi | |
| # Job 3: Build all projects | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| include: | |
| - project: aastar | |
| build-command: npm run build | |
| - project: aastar-frontend | |
| build-command: npm run build | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Use Node.js 20 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build project | |
| run: npm run build --workspace=${{ matrix.project }} | |
| env: | |
| CI: true | |
| # Job 4: Run tests | |
| test: | |
| name: Tests | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| project: [aastar] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Use Node.js 20 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run tests | |
| working-directory: ./${{ matrix.project }} | |
| run: npm test || npm run test:ci || echo "No tests configured" | |
| env: | |
| CI: true | |
| NODE_ENV: test | |
| # Job 5: Type checking | |
| typecheck: | |
| name: Type Check | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| project: [aastar, aastar-frontend] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Use Node.js 20 | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run TypeScript compiler | |
| run: | | |
| if [ -f ${{ matrix.project }}/package.json ] && jq -e '.scripts["type-check"]' ${{ matrix.project }}/package.json > /dev/null; then | |
| npm run type-check --workspace=${{ matrix.project }} | |
| else | |
| cd ${{ matrix.project }} && npx tsc --noEmit | |
| fi | |
| # Job 6: CodeQL Analysis | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ["javascript", "typescript"] | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v4 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| # Job 7: Summary job for branch protection | |
| ci-success: | |
| name: CI Success | |
| runs-on: ubuntu-latest | |
| needs: [security, quality, build, test, typecheck, codeql] | |
| if: always() | |
| steps: | |
| - name: Check all jobs status | |
| run: | | |
| if [[ "${{ needs.security.result }}" == "success" && | |
| "${{ needs.quality.result }}" == "success" && | |
| "${{ needs.build.result }}" == "success" && | |
| "${{ needs.test.result }}" == "success" && | |
| "${{ needs.typecheck.result }}" == "success" && | |
| "${{ needs.codeql.result }}" == "success" ]]; then | |
| echo "All CI checks passed!" | |
| else | |
| echo "Some CI checks failed" | |
| exit 1 | |
| fi |