socket-vscode/.github/workflows/ci.yml at main · SocketDev/socket-vscode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
# Seeded from the socket-wheelhouse CI preset, then owned by this repo:
# edit it here. Fleet CI runs check + test through the LOCAL composite
# actions under .github/actions/, inlined, so there is no cross-repo
# reusable workflow and no first-party `uses:@sha`.
name: ⚡ CI

on:
  push:
    branches: [main]
    tags: ['*']
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Fleet no-phone-home posture: the setup action exports every FLEET_ENV knob at
# runtime from .github/actions/fleet/setup/fleet-env.json, which is THE one list
# the shell-rc bridge, telemetry-env-is-disabled.mts and spawned agents all
# derive from. Declaring them workflow-level as well is a second copy that
# drifts from that list, which is what workflow-env-is-action-supplied flags.

jobs:
  # First step of every job is the third-party actions/checkout (GitHub fetches
  # it independently) to populate the workspace so the LOCAL `./.github/actions/*`
  # composites resolve. setup-and-install then re-checks-out — full history
  # (fetch-depth 0) in the check job, since the commit-history checks it runs
  # (AI-attribution, release-boundary) read the default branch's history and
  # refuse a shallow clone rather than false-green; the test matrix stays at
  # the default depth (25 — covers CI's other git operations) and runs the
  # zizmor Actions audit (its own `strategy.job-total < 2` skip runs it in the
  # non-matrix check job, skips it in the test matrix).
  check:
    name: 🔎 Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15)
        with:
          fetch-depth: 1
          persist-credentials: false
      - uses: ./.github/actions/fleet/setup-and-install
        with:
          # Full history: the commit-history checks (AI-attribution,
          # release-boundary) read the default branch's history and refuse a
          # shallow clone rather than false-green.
          checkout-fetch-depth: '0'
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          # Thin-distribution CI auth: mint a contents:read-only token so the
          # bootstrap fetch (fired by `prepare` during install) can download the
          # fleet release bundle from the private wheelhouse. Both refs are
          # empty on a non-thin member (var/secret unset) - the mint is skipped
          # and the fetch no-ops. A thin member sets a dedicated read-only App's
          # client-id var + private-key secret.
          payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }}
      - uses: ./.github/actions/fleet/run-script
        with:
          main-script: pnpm run check --all

  test:
    name: 🧪 Test
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 (2026-05-15)
        with:
          fetch-depth: 1
          persist-credentials: false
      - uses: ./.github/actions/fleet/setup-and-install
        with:
          socket-api-token: ${{ secrets.SOCKET_API_TOKEN_FOR_CLI_AND_SFW }}
          # Thin-distribution CI auth: mint a contents:read-only token so the
          # bootstrap fetch (fired by `prepare` during install) can download the
          # fleet release bundle from the private wheelhouse. Both refs are
          # empty on a non-thin member (var/secret unset) - the mint is skipped
          # and the fetch no-ops. A thin member sets a dedicated read-only App's
          # client-id var + private-key secret.
          payload-token-client-id: ${{ vars.SOCKET_PAYLOAD_CLIENT_ID }}
          payload-token-private-key: ${{ secrets.SOCKET_PAYLOAD_APP_PRIVATE_KEY }}
      - uses: ./.github/actions/fleet/run-script
        with:
          setup-script: pnpm run build
          main-script: pnpm test --all