-
-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CI improvements #288
CI improvements #288
Changes from all commits
3cbeb3d
4d90fd8
154aa81
996df75
e07cf10
a83c739
93d45c7
e37ffa6
b52cd29
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2,7 +2,24 @@ | |
|
||
name: CI | ||
|
||
on: [push, pull_request] | ||
on: | ||
# Run on pushes to the default branch. | ||
push: | ||
branches: | ||
- main | ||
|
||
# Run on all PRs. | ||
pull_request: | ||
types: | ||
- opened | ||
- synchronize | ||
- reopened | ||
|
||
# Support merge queues. | ||
merge_group: | ||
|
||
# Allow running this workflow manually from the Actions tab. | ||
workflow_dispatch: | ||
|
||
defaults: | ||
run: | ||
|
@@ -20,29 +37,39 @@ jobs: | |
# Steps represent a sequence of tasks that will be executed as part of the job | ||
steps: | ||
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it | ||
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
- name: Git checkout | ||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
with: | ||
submodules: recursive | ||
clean: true | ||
persist-credentials: false | ||
set-safe-directory: true | ||
|
||
- name: Setup Node.js environment | ||
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2 | ||
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 | ||
with: | ||
node-version: 16.x | ||
cache: 'npm' | ||
|
||
- name: Cache ~/.elm | ||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 | ||
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2 | ||
with: | ||
path: ~/.elm | ||
key: elm-${{ runner.os }}-${{ hashFiles('**/elm.json', 'elm-tooling.json') }} | ||
restore-keys: | | ||
elm-${{ runner.os }}- | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I've read https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/caching-dependencies-to-speed-up-workflows but I still don't get how this is not dangerous. If There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Say I've got an |
||
|
||
- name: Cache node_modules | ||
id: cache-node_modules | ||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 | ||
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2 | ||
with: | ||
path: node_modules | ||
key: node_modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }} | ||
restore-keys: | | ||
node_modules-${{ runner.os }}- | ||
|
||
- name: Cache turbo build setup | ||
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 | ||
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2 | ||
with: | ||
path: .turbo | ||
key: ${{ runner.os }}-turbo-${{ github.sha }} | ||
|
@@ -53,15 +80,15 @@ jobs: | |
if: steps.cache-node_modules.outputs.cache-hit != 'true' | ||
env: | ||
NO_ELM_TOOLING_INSTALL: 1 | ||
run: npm ci | ||
run: npm ci --engine-strict | ||
|
||
- name: elm-tooling install | ||
run: npx --no-install elm-tooling install | ||
|
||
- name: Install turbo | ||
run: npm install -g turbo | ||
|
||
- name: Test nodejs version requirements | ||
- name: Test Node.js version requirements | ||
run: turbo run check-engines | ||
|
||
- name: Run tests | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -113,7 +113,7 @@ | |
"turbo": "^2.1.2", | ||
"typescript": "~5.6.2" | ||
}, | ||
"packageManager": "npm@8.19.4", | ||
"packageManager": "npm@8.19.4+sha512.dc700d97c8bd0ca9d403cf4fe0a12054d376f048d27830a6bc4a9bcce02ec42143cdd059ce3525f7dce09c6a4e52e9af5b996f268d8729c8ebb1cfad7f2bf51f", | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Can you explain how to find the hash for this? Do you also have more information/resources on why this is a good idea? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I wrote it manually originally, but remembered a few days ago (in a personal project) that there's a cli, so getting the hash is as simple as |
||
"engines": { | ||
"node": "14 >=14.21 || 16 >=16.20 || 18 || 20 || >=22" | ||
} | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe dependabot is not updating them because of the hash? Or because of the comment. Not sure either 🤷♂️
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Dependabot is smart enough for it to work on my other projects. If the comment is wrong, it'll also override it (rather than ignoring it or not updating), which is nice.
(Otherwise, I wouldn't use this. I prefer security updates+possible supply chain attack over old versions)