Merge pull request #39 from PointerIDE/codex/fix-release-parallel-exi… #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pointer CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: pointer-ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| repo-health: | |
| name: Repository health | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Validate product metadata | |
| run: | | |
| node <<'NODE' | |
| const fs = require('fs'); | |
| const product = JSON.parse(fs.readFileSync('product.json', 'utf8')); | |
| const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); | |
| const required = { | |
| nameShort: 'Pointer', | |
| nameLong: 'Pointer', | |
| applicationName: 'pointer', | |
| dataFolderName: '.pointer', | |
| urlProtocol: 'pointer', | |
| serverApplicationName: 'pointer-server', | |
| tunnelApplicationName: 'pointer-tunnel' | |
| }; | |
| for (const [key, value] of Object.entries(required)) { | |
| if (product[key] !== value) { | |
| throw new Error(`product.json ${key} must be ${value}, got ${product[key]}`); | |
| } | |
| } | |
| if (pkg.name !== 'pointer-dev') { | |
| throw new Error(`package.json name must be pointer-dev, got ${pkg.name}`); | |
| } | |
| const expectedRepo = 'https://github.com/PointerIDE/Pointer'; | |
| for (const key of ['licenseUrl', 'serverLicenseUrl', 'reportIssueUrl']) { | |
| if (!String(product[key] ?? '').startsWith(expectedRepo)) { | |
| throw new Error(`product.json ${key} must point at ${expectedRepo}`); | |
| } | |
| } | |
| console.log(`Pointer ${pkg.version} metadata looks good.`); | |
| NODE | |
| - name: Validate docs and entrypoints | |
| run: | | |
| test -f README.md | |
| test -f AGENTS.md | |
| test -f docs/PROJECT_GUIDE.md | |
| test -f docs/TECH_STACK.md | |
| test -f docs/RELEASE.md | |
| test -f run/start.bat | |
| test -f run/start-dev.bat | |
| test -f run/dev-stop.bat | |
| test -f run/build-pointer.bat | |
| test -f scripts/dev-windows.ps1 | |
| test -f scripts/build-pointer-release.ps1 | |
| - name: Guard against local-only files | |
| shell: bash | |
| run: | | |
| blocked=( | |
| ".codex-tools" | |
| ".opencode/node_modules" | |
| "pntr_b64.txt" | |
| "pntr_w_b64.txt" | |
| "_validate_json.cjs" | |
| "nul" | |
| ) | |
| for path in "${blocked[@]}"; do | |
| if git ls-files --error-unmatch "$path" >/dev/null 2>&1; then | |
| echo "::error::$path must not be committed" | |
| exit 1 | |
| fi | |
| done | |
| - name: Guard against committed secrets | |
| shell: bash | |
| run: | | |
| if git grep -n -I -E 'BEGIN (RSA|OPENSSH|DSA|EC|PGP) PRIVATE KEY|gh[pousr]_[A-Za-z0-9_]{36,}|github_pat_[A-Za-z0-9_]{22,}_[A-Za-z0-9_]{59,}|sk-(proj-)?[A-Za-z0-9_-]{32,}|xox[baprs]-[A-Za-z0-9-]{20,}' -- . ':!package-lock.json' ':!**/test/**' ':!**/tests/**' ':!**/fixtures/**' ':!**/*.spec.ts'; then | |
| echo "::error::Potential committed secret found" | |
| exit 1 | |
| fi | |
| - name: Validate README image references | |
| run: | | |
| node <<'NODE' | |
| const fs = require('fs'); | |
| const readme = fs.readFileSync('README.md', 'utf8'); | |
| const imageRefs = [...readme.matchAll(/<img[^>]+src="([^"]+)"/g)].map(match => match[1]); | |
| for (const ref of imageRefs) { | |
| if (/^https?:\/\//.test(ref)) { | |
| continue; | |
| } | |
| if (!fs.existsSync(decodeURIComponent(ref))) { | |
| throw new Error(`README image reference is missing: ${ref}`); | |
| } | |
| } | |
| console.log(`Validated ${imageRefs.length} README image references.`); | |
| NODE | |
| typecheck: | |
| name: TypeScript compile check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - name: Install root dependencies | |
| run: npm ci --ignore-scripts | |
| - name: Type-check main sources | |
| run: npm run compile-check-ts-native | |