This repository was archived by the owner on Aug 20, 2026. It is now read-only.
build(deps): bump documents.js to 4.0.11 #482
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Public repository -> GitHub-hosted ubuntu-latest runners (free, unlimited Actions minutes) deploying to GitHub Pages. No self-hosted fleet needed. | |
| jobs: | |
| commitlint: | |
| name: Commitlint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - name: Validate the last commit with commitlint | |
| if: github.event_name == 'push' | |
| run: pnpm exec commitlint --last --verbose | |
| - name: Validate every PR commit with commitlint | |
| if: github.event_name == 'pull_request' | |
| run: pnpm exec commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: ./.github/actions/setup-and-run | |
| with: | |
| task: lint | |
| command: pnpm lint | |
| typecheck: | |
| name: Typecheck | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: ./.github/actions/setup-and-run | |
| with: | |
| task: typecheck | |
| command: pnpm typecheck | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: ./.github/actions/setup-and-run | |
| with: | |
| task: test | |
| command: pnpm test:coverage | |
| - uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: coverage-report | |
| path: coverage/ | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: ./.github/actions/setup-and-run | |
| with: | |
| task: build | |
| command: pnpm build | |
| release: | |
| name: Release | |
| needs: [commitlint, lint, typecheck, test, build] | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write | |
| issues: write | |
| steps: | |
| # main requires status checks to merge, and the default GITHUB_TOKEN has no bypass for that -- @semantic-release/git's own push of the release commit is a direct push to main, so it needs a token from an actor the branch ruleset explicitly allows to bypass (see ExaDev/.github and each repo's own ruleset). Everything else in this job (release notes, GitHub Release creation) keeps using secrets.GITHUB_TOKEN below, unaffected -- only checkout's own git credentials need the elevated token, since that's what the later `git push` inherits. | |
| - name: Generate a token for the release push | |
| id: app-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: "4473709" | |
| private-key: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }} | |
| - uses: actions/checkout@v7 | |
| with: | |
| # semantic-release analyses the full commit history since the last release. | |
| fetch-depth: 0 | |
| token: ${{ steps.app-token.outputs.token }} | |
| - uses: ./.github/actions/setup-and-run | |
| with: | |
| task: release | |
| # HUSKY=0 so local git hooks never fire during the CI release commit. | |
| command: HUSKY=0 pnpm release | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| build-and-deploy: | |
| name: Build and deploy to Pages | |
| # Build AFTER release so the deploy is built from the tagged release commit (semantic-release bumps package.json + tags on the chore(release) commit). For non-releasing commits release creates no new tag and the build just uses the latest commit on main. | |
| needs: [commitlint, lint, typecheck, test, build, release] | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| concurrency: | |
| group: deploy-pages | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| actions: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: main | |
| fetch-depth: 0 | |
| - uses: ./.github/actions/setup-and-run | |
| with: | |
| task: build | |
| command: pnpm build | |
| - uses: actions/configure-pages@v6 | |
| with: | |
| enablement: true | |
| # A failed deploy-pages step leaves this run's uploaded github-pages artifact behind; re-running would then try to upload a second one and fail ("Multiple artifacts named github-pages"). Clean up first. | |
| - name: Remove prior github-pages artifacts from this run | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts" \ | |
| --jq '.artifacts[] | select(.name=="github-pages") | .id' | | |
| while read -r id; do | |
| [ -z "$id" ] && continue | |
| gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/$id" | |
| done | |
| - uses: actions/upload-pages-artifact@v5 | |
| with: | |
| path: dist | |
| - id: deployment | |
| uses: actions/deploy-pages@v5 |