feat(angular): upgrade to version 22 #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI checks to run when a PR is opened, or manually via workflow_dispatch | |
| # Test and lint are handled by their own dedicated workflows | |
| name: 🚦 CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| PYTHON_VERSION: '3.11' | |
| jobs: | |
| changes: | |
| name: 🔎 Detect Changes | |
| runs-on: ubuntu-latest | |
| outputs: | |
| lockfile: ${{ steps.filter.outputs.lockfile }} | |
| workflows: ${{ steps.filter.outputs.workflows }} | |
| src: ${{ steps.filter.outputs.src }} | |
| docker: ${{ steps.filter.outputs.docker }} | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Filter Paths | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4 | |
| id: filter | |
| with: | |
| filters: | | |
| lockfile: | |
| - 'package-lock.json' | |
| - 'scripts/requirements.txt' | |
| workflows: | |
| - '.github/workflows/**' | |
| src: | |
| - 'apps/**' | |
| - 'scripts/**' | |
| - 'package.json' | |
| - 'frameworks.json' | |
| - 'config.json' | |
| docker: | |
| - 'Dockerfile' | |
| - '.dockerignore' | |
| - 'docker-compose.yml' | |
| dependency-audit: | |
| name: 🔒 Dependency Audit | |
| runs-on: ubuntu-latest | |
| needs: changes | |
| if: needs.changes.outputs.lockfile == 'true' && github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Review Dependencies | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 | |
| with: | |
| fail-on-severity: moderate | |
| workflow-audit: | |
| name: 🛠️ Workflow Audit | |
| runs-on: ubuntu-latest | |
| needs: changes | |
| if: needs.changes.outputs.workflows == 'true' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Run Actionlint | |
| uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2 | |
| with: | |
| fail-on-error: true | |
| - name: Run Zizmor | |
| uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 | |
| with: | |
| inputs: .github/workflows/ | |
| advanced-security: false | |
| annotations: true | |
| smoke: | |
| name: 💨 Smoke Test | |
| runs-on: ubuntu-latest | |
| needs: changes | |
| if: needs.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| cache-dependency-path: scripts/requirements.txt | |
| - name: Install dependencies | |
| run: pip install -r scripts/requirements.txt | |
| - name: Validate config schemas | |
| run: python scripts/verify/validate_schemas.py | |
| config-sync: | |
| name: 🧬 Config Sync | |
| runs-on: ubuntu-latest | |
| needs: changes | |
| if: needs.changes.outputs.src == 'true' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| cache-dependency-path: scripts/requirements.txt | |
| - name: Install dependencies | |
| run: pip install -r scripts/requirements.txt | |
| - name: Regenerate config-derived files | |
| run: | | |
| python scripts/setup/generate_scripts.py | |
| python scripts/setup/generate_mocks.py | |
| - name: Check for drift | |
| run: | | |
| if ! git diff --quiet -- package.json assets/mocks/; then | |
| echo "❌ Generated files are out of sync with frameworks.json" | |
| echo " Run generate_scripts.py and generate_mocks.py, then commit" | |
| git diff -- package.json assets/mocks/ | |
| exit 1 | |
| fi | |
| echo "✅ Config-derived files in sync" | |
| docker-smoke: | |
| name: 🐳 Docker Smoke Test | |
| runs-on: ubuntu-latest | |
| needs: changes | |
| if: needs.changes.outputs.docker == 'true' || github.event_name == 'workflow_dispatch' | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4 | |
| - name: Build production image | |
| uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7 | |
| with: | |
| context: . | |
| target: production | |
| load: true | |
| tags: framework-benchmarks:ci | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: Run container & check health | |
| run: | | |
| docker run -d --rm --name fb-smoke framework-benchmarks:ci | |
| for _ in $(seq 1 30); do | |
| if docker exec fb-smoke curl -fsS http://localhost:3000/health >/dev/null 2>&1; then | |
| echo "✅ Container healthy" | |
| docker stop fb-smoke | |
| exit 0 | |
| fi | |
| sleep 2 | |
| done | |
| echo "❌ Container failed health check" | |
| docker logs fb-smoke || true | |
| docker stop fb-smoke || true | |
| exit 1 | |
| secret-scan: | |
| name: 🔑 Secret Scanning | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Scan PR Diff for Secrets | |
| uses: trufflesecurity/trufflehog@30d5bb91af1a771378349dbbb0c82129392acf70 # v3.95.6 | |
| with: | |
| base: ${{ github.event.pull_request.base.sha }} | |
| head: ${{ github.event.pull_request.head.sha }} | |
| extra_args: --only-verified | |
| # Renders markdown summary of all checks at the end | |
| summary: | |
| name: 📋 Summary | |
| runs-on: ubuntu-latest | |
| if: always() | |
| continue-on-error: true | |
| needs: | |
| - dependency-audit | |
| - workflow-audit | |
| - smoke | |
| - config-sync | |
| - docker-smoke | |
| - secret-scan | |
| steps: | |
| - name: Render Summary | |
| env: | |
| NEEDS: ${{ toJSON(needs) }} | |
| run: | | |
| label() { | |
| case "$1" in | |
| dependency-audit) echo "🔒 Dependency Audit" ;; | |
| workflow-audit) echo "🛠️ Workflow Audit" ;; | |
| smoke) echo "💨 Smoke Test" ;; | |
| config-sync) echo "🧬 Config Sync" ;; | |
| docker-smoke) echo "🐳 Docker Smoke Test" ;; | |
| secret-scan) echo "🔑 Secret Scanning" ;; | |
| *) echo "$1" ;; | |
| esac | |
| } | |
| status() { | |
| case "$1" in | |
| success) echo "✅ Passed" ;; | |
| skipped) echo "⏭️ Skipped" ;; | |
| cancelled) echo "🚫 Cancelled" ;; | |
| failure) echo "❌ Failed" ;; | |
| *) echo "❔ $1" ;; | |
| esac | |
| } | |
| { | |
| echo "## CI Summary" | |
| echo "" | |
| echo "| Check | Status |" | |
| echo "|-------|--------|" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| for job in $(echo "$NEEDS" | jq -r 'keys[]'); do | |
| result=$(echo "$NEEDS" | jq -r --arg j "$job" '.[$j].result') | |
| echo "| $(label "$job") | $(status "$result") |" >> "$GITHUB_STEP_SUMMARY" | |
| done |