hotcrm/.github/workflows/code-quality.yml at main · objectstack-ai/hotcrm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
name: Code Quality

on:
  pull_request:
    branches: [ main, develop ]
    paths:
      - '**.ts'
      - '**.js'
      - '**.mjs'
      - '**.json'
      - '**.yml'
      - '**.yaml'

jobs:
  quality-check:
    name: Quality Checks
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: '22.x'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Replaces three inline greps that scanned `packages/` — a directory this
      # repo does not have — each with `continue-on-error: true`. The script
      # scans this repo's first-party files and fails on a hit; it also fails
      # loudly, each guard with its own message, when a directory or a root
      # file it is told to scan has gone missing, so the check can never
      # silently go vacuous again. It prints the surface it actually reads on
      # every run — read that banner; every copy of it kept here has gone stale.
      - name: Source hygiene (scripts/check-source-hygiene.mjs)
        run: node scripts/check-source-hygiene.mjs

      # Shrink-only ceiling on the authored surface, in estimated tokens
      # (#1183) — the gate behind the README's context-window claim. The same
      # step runs in `CI`, which has no `paths:` filter; this copy keeps the
      # measurement visible in the review-facing Quality Checks output.
      - name: Source token ratchet (authored surface, only-down)
        run: node scripts/check-source-token-ratchet.mjs

      - name: Check TypeScript compilation
        run: pnpm run typecheck

      - name: Validate metadata (protocol/schema)
        run: pnpm run validate

      # `objectstack lint` exits 0 on warnings and suggestions and non-zero only
      # on real errors, so `continue-on-error` was suppressing nothing but the
      # errors we actually want to hear about.
      - name: Lint metadata conventions
        run: pnpm run lint

      # The step above cannot fail on `i18n/missing-*` warnings (only a
      # default-locale miss is an error — everything else is a warning that
      # `objectstack lint`'s own exit code ignores). PR #1080 merged 25
      # enumerated `i18n/missing-page` warnings through a green run before
      # #1084 zeroed that debt; this step asserts the count stays zero (#1018).
      - name: i18n lint gate (zero `i18n/missing-*`)
        run: pnpm run lint:i18n-gate