Baton/.github/workflows/ci.yml at main · OpenLyceum/Baton · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
name: CI

on:
  workflow_call:
    inputs:
      node-version:
        # Default Node version for the fleet. Mirrored in every Baton workflow that
        # runs setup-node — bump them together (enforced by check-node-version.sh).
        # See Baton/README.md ("Node version").
        type: string
        default: "26"
      run-tests:
        # Tri-state: "true" forces the test step on, "false" forces it off, and the
        # default "" means auto — run tests when the repo defines a "test" npm script.
        # String (not boolean) so "unset" is distinguishable from "off".
        type: string
        default: ""

permissions:
  contents: read

# No concurrency block here: this workflow is workflow_call-only, and callers
# already define the ci-${{ github.workflow }}-${{ github.ref }} group. Declaring
# the same group in the called workflow makes GitHub detect a deadlock with the
# caller's run and kill the reusable call at startup, so the build never runs.

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7.0.1

      - name: Setup Node.js
        uses: actions/setup-node@v7.1.0
        with:
          node-version: ${{ inputs.node-version }}
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Security audit
        # Must stay fully qualified: `uses:` accepts no expressions, and inside a
        # reusable workflow a local `./` path resolves against the CALLER's
        # checkout, not this repo. Renaming the org means editing this line.
        uses: OpenLyceum/Baton/.github/actions/security-audit@main

      - name: Lint
        run: npm run lint

      - name: Type check
        run: npm run check

      # SceneryStack sims ship a "test" script (fleet-standard). Auto-run when the
      # script exists; force on/off via run-tests "true"/"false". Non-sim callers
      # without a test script stay green without per-repo config.
      - name: Test
        if: inputs.run-tests != 'false'
        env:
          RUN_TESTS: ${{ inputs.run-tests }}
        run: |
          set -euo pipefail
          if [ "$RUN_TESTS" = "true" ]; then
            npm test
          elif jq -e '.scripts.test // empty' package.json >/dev/null 2>&1; then
            npm test
          else
            echo "No \"test\" script defined and run-tests not forced; skipping."
          fi

      - name: Build
        run: npm run build