RemoteBridge/.github/workflows/ci.yml at main · Aswellle/RemoteBridge · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  build-and-test:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # CH1: audit 改为 --audit-level=high，高危/严重漏洞时中断构建；
      # 低/中危误报通过 .auditrc / overrides 处理，不再全局静默。
      # CH3: 使用官方 registry 运行审计（npmmirror 不支持 audit 端点）
      - name: Audit dependencies
        run: pnpm audit --prod --audit-level=high --registry https://registry.npmjs.org

      # apps/server, apps/web and apps/desktop all import @remotebridge/shared
      # from its compiled dist/, so it must be built before anything else.
      - name: Build shared package
        run: pnpm --filter @remotebridge/shared build

      - name: Build all packages
        run: pnpm build

      # CH2: 明确构建 desktop 包，确保 electron-vite 打包错误在 CI 中可见
      - name: Build desktop package
        run: pnpm --filter @remotebridge/desktop build

      - name: Lint web
        run: pnpm --filter @remotebridge/web lint

      - name: Typecheck
        run: |
          pnpm --filter @remotebridge/shared exec tsc --noEmit
          pnpm --filter @remotebridge/server exec tsc --noEmit
          pnpm --filter @remotebridge/desktop exec tsc --noEmit
          pnpm --filter @remotebridge/web exec tsc --noEmit

      # CD-H1: coverage threshold gate — statements ≥70%, branches ≥60%, etc.
      # Thresholds are configured in packages/shared/vitest.config.ts.
      - name: Test shared (with coverage)
        run: pnpm --filter @remotebridge/shared exec vitest run --coverage

      # P1-15: vitest globalSetup spawns its own relay on :3099, so this
      # works standalone with no live relay required.
      - name: Test server
        run: pnpm --filter @remotebridge/server test

      - name: Test desktop
        run: pnpm --filter @remotebridge/desktop test

      - name: Test web
        run: pnpm --filter @remotebridge/web test

  # CD-M1: Windows runner validates Windows-specific path blacklists
  # (path-guard.ts has OS-specific blocked dirs) and exercises the
  # desktop test suite end-to-end on the target deployment platform.
  test-windows:
    runs-on: windows-latest

    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build shared package
        run: pnpm --filter @remotebridge/shared build

      - name: Test desktop (Windows)
        run: pnpm --filter @remotebridge/desktop test