chore(deps): bump the sandbox-runtime-minor-and-patch group across 5 directories with 30 updates #223
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Static Checks | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: static-checks-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| static-checks: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0 | |
| with: | |
| node-version: 22.22.2 | |
| cache: pnpm | |
| - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: | |
| enable-cache: false | |
| version: 0.11.28 | |
| - uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1 | |
| with: | |
| cache: true | |
| version: v0.72.0 | |
| - run: pnpm install --frozen-lockfile | |
| - name: Lint GitHub Actions and embedded shell | |
| uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0 | |
| with: | |
| pyflakes: false | |
| shellcheck: true | |
| version: 1.7.12 | |
| - name: Audit pnpm lockfiles | |
| run: | | |
| trivy fs --scanners vuln --include-dev-deps --severity MEDIUM,HIGH,CRITICAL --exit-code 1 pnpm-lock.yaml | |
| trivy fs --scanners vuln --include-dev-deps --severity MEDIUM,HIGH,CRITICAL --exit-code 1 infra/containers/sandbox/app-templates/expo | |
| trivy fs --scanners vuln --include-dev-deps --severity MEDIUM,HIGH,CRITICAL --exit-code 1 infra/containers/sandbox/app-templates/next | |
| - name: Audit sandbox Python lockfile | |
| run: uvx --from pip-audit==2.10.1 pip-audit --disable-pip -r infra/containers/sandbox/requirements.txt | |
| - name: Audit sandbox npm lockfiles | |
| run: | | |
| npm --prefix infra/containers/sandbox/app-generators audit --audit-level=moderate | |
| npm --prefix infra/containers/sandbox/browser-driver audit --audit-level=moderate | |
| npm --prefix infra/containers/sandbox/doc-runtime audit --audit-level=moderate | |
| npm --prefix infra/containers/sandbox/extension-overrides/parquet-viewer audit --audit-level=moderate | |
| npm --prefix infra/containers/sandbox/package-manager audit --audit-level=moderate | |
| - name: Validate pull request title | |
| if: github.event_name == 'pull_request' | |
| env: | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| run: printf '%s\n' "$PR_TITLE" | pnpm exec commitlint | |
| - run: pnpm lint | |
| - run: pnpm architecture:check | |
| - run: pnpm deadcode | |
| - run: pnpm typecheck | |
| - run: pnpm build | |
| env: | |
| # Static compilation must never expose a real Clerk Backend API credential | |
| # to pull-request code. These syntactically valid, non-deployed values | |
| # exercise the development-key branch without authenticating anywhere. | |
| CLERK_SECRET_KEY: sk_test_static_checks_do_not_authenticate | |
| NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: pk_test_c3RhdGljLWNoZWNrcy0wMC5jbGVyay5hY2NvdW50cy5kZXYk | |
| NEXT_PUBLIC_GATEWAY_URL: ${{ vars.NEXT_PUBLIC_GATEWAY_URL }} | |
| NEXT_PUBLIC_PREVIEW_HOSTNAME: trycheatcode.com | |
| NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA: ${{ github.sha }} | |
| # Never expose a future remote-cache credential to pull-request code. | |
| TURBO_TOKEN: ${{ github.event_name == 'push' && secrets.TURBO_TOKEN || '' }} | |
| TURBO_TEAM: cheatcode |