fix(editor): dedupe the CodeMirror family in the production bundle #214
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| jobs: | |
| check: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| platform: [windows-latest, windows-11-arm, ubuntu-24.04, macos-latest] | |
| runs-on: ${{ matrix.platform }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| # The stable toolchain installs with the minimal profile, which omits | |
| # clippy — request it explicitly so the lint step below has it. | |
| with: | |
| components: clippy | |
| - name: Rust cache | |
| uses: swatinem/rust-cache@v2 | |
| # Caching is an optimization — a flaky GitHub cache service must never | |
| # fail the build (it took down a Windows release once). | |
| continue-on-error: true | |
| with: | |
| workspaces: './src-tauri -> target' | |
| - name: Install Linux dependencies | |
| if: matrix.platform == 'ubuntu-24.04' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev patchelf | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: latest | |
| - name: Install frontend dependencies | |
| # --frozen-lockfile makes CI fail if bun.lock doesn't match package.json, | |
| # so a PR can't silently swap or add dependencies without an obvious | |
| # lockfile diff to review. | |
| run: bun install --frozen-lockfile | |
| - name: Build frontend (tsc + vite) | |
| run: bun run build | |
| - name: Run frontend tests | |
| run: bun run test | |
| # clippy compiles the crate (so it subsumes `cargo check`) while also | |
| # failing the build on any lint warning, keeping the Rust side clean. | |
| - name: Lint Rust (clippy) | |
| working-directory: src-tauri | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Test Rust | |
| working-directory: src-tauri | |
| run: cargo test | |
| # ─── Supply-chain: Rust dependencies ────────────────────────── | |
| # Fails the build on a known-vulnerable crate (RUSTSEC advisory), a banned | |
| # crate, or a dependency pulled from anywhere other than crates.io. Config | |
| # lives in src-tauri/deny.toml. Runs once on Linux (not per-platform) since | |
| # it only reads Cargo.lock — it doesn't compile the project. | |
| cargo-deny: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-deny | |
| run: cargo install cargo-deny --locked | |
| - name: Check advisories, bans, and sources | |
| run: cargo deny --manifest-path src-tauri/Cargo.toml check advisories bans sources | |
| # ─── Supply-chain: known-vulnerability scan (npm + Cargo) ───── | |
| # Scans every lockfile in the repo against the OSV database and fails on any | |
| # package with a known vulnerability. Covers the frontend (package-lock.json) | |
| # and Rust (Cargo.lock) in one pass. | |
| # | |
| # Tag verified against github.com/google/osv-scanner-action releases; Dependabot | |
| # (github-actions ecosystem) will keep it current. | |
| osv-scan: | |
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| with: | |
| # Report-only for now: the existing dependency tree already has known npm | |
| # advisories, so blocking would fail every PR on pre-existing debt. Results | |
| # still upload to the Security tab. Once the current vulns are cleaned up, | |
| # set this to true to make it a hard gate on newly-introduced vulnerabilities. | |
| fail-on-vuln: false | |
| scan-args: |- | |
| -r | |
| ./ |