fix: Fix Redaction Prompt Corruption (#178) #133
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # PR quality gate: build → typecheck → test → lint on every pull request | |
| # targeting main, plus push to main as a post-merge safety net. | |
| # | |
| # The test and typecheck steps are the gate — a failing test or a type error | |
| # fails the run. The lint step is non-blocking in phase 1: the code-quality | |
| # rules (max-lines-per-function, max-depth, complexity, no-unused-vars, | |
| # prefer-const) land at `warn` severity, and eslint exits 0 on warnings-only | |
| # output. Promotion to `error` is a deliberate follow-up once existing | |
| # offenders are refactored. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| # There is deliberately NO `concurrency:` block here: every push to a PR keeps | |
| # its own completed verdict. A cancelled run at a PR tip is an unverified | |
| # commit that reads as clean — "no failing checks" looks exactly like | |
| # "checks passed". Two instincts to resist: | |
| # - Do not re-add `cancel-in-progress: true` to save CI minutes. That trades | |
| # a few minutes per active PR for unverified commits. | |
| # - Do not re-add a bare `concurrency.group` either. On the default | |
| # `queue: single`, GitHub cancels an existing PENDING run whenever a newer | |
| # run queues into the same group (`cancel-in-progress` governs only the | |
| # in-progress run), so a group left on that default silently restores | |
| # cancellation under rapid pushes. `queue: max` avoids that (it keeps up | |
| # to 100 pending runs, FIFO) but serialises: per-push feedback becomes | |
| # N × ~1m30s instead of ~1m30s, and nothing here needs serialising — | |
| # `actions/setup-node`'s cache save fails soft on a concurrent write. | |
| jobs: | |
| # The job name `test` is a contract: the repo's `main` ruleset (id 14531661) | |
| # requires a status check with context `test`, pinned to the GitHub Actions | |
| # app (integration_id: 15368). Renaming this job detaches the required check. | |
| # That failure is fail-closed — PRs block on a check that never reports, | |
| # rather than merging unverified — but the symptom (a forever-"Expected" | |
| # check) does not point here. If this job must be renamed, update the | |
| # ruleset's required_status_checks context in the same breath. | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20.19' | |
| cache: 'npm' | |
| # npm ci installs the exact committed package-lock.json tree and fails | |
| # loudly if package.json and the lockfile disagree. (Mirrors release.yml.) | |
| - run: npm ci | |
| # Package test scripts run against compiled output (dist/), so the | |
| # build must happen before tests. Deliberately NOT --if-present: every | |
| # workspace declares a build script (local-runtime's is an explicit | |
| # no-op), so a workspace that loses its script fails the run loudly | |
| # instead of being skipped in silence. | |
| - name: Build all workspaces | |
| run: npm run build --workspaces | |
| # Typecheck every workspace explicitly (tsc --noEmit -p tsconfig.json | |
| # per TypeScript package, fanned out WITHOUT --if-present; | |
| # local-runtime's typecheck script is an explicit no-op — it has no | |
| # TypeScript to check). This is the one stage that typechecks | |
| # report-web at all (its tsup/vite build never runs tsc); for the five | |
| # tsc-building packages it is redundant with their build, deliberately | |
| # — so a future build-tool switch cannot silently drop the check. It | |
| # runs after build because dependent packages resolve @finalrun/* | |
| # types from built dist/ declarations. | |
| - name: Typecheck all workspaces | |
| run: npm run typecheck | |
| - name: Run tests (the PR gate) | |
| run: npm run test:workspaces | |
| - name: Lint (warnings are non-blocking in phase 1) | |
| run: npm run lint |