fix: recover cleanly when the stored session is dead #176
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI CI | |
| on: | |
| push: | |
| branches: [ dev, production ] | |
| pull_request: | |
| # `production` is included so the dev→production promotion PR is also gated | |
| # by lint/typecheck/build (and is required by the production ruleset). | |
| branches: [ dev, production ] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (full history) | |
| uses: actions/checkout@v7 | |
| with: | |
| # Full history so gitleaks scans every commit, not just the tip. | |
| fetch-depth: 0 | |
| - name: Run gitleaks | |
| env: | |
| # Pinned release; bump deliberately. Run the binary directly rather than | |
| # gitleaks/gitleaks-action@v2, which requires a paid GITLEAKS_LICENSE for | |
| # organization-owned repos. | |
| GITLEAKS_VERSION: 8.30.1 | |
| run: | | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz gitleaks | |
| ./gitleaks git . --redact --verbose --no-banner | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| # The mock-api lives in the private devicecloud-dev/dcd repo, checked out via an | |
| # SSH deploy key. GitHub does NOT expose secrets to pull_request workflows | |
| # triggered from forks, so that checkout (and the integration tests that need | |
| # it) can only run for same-repo events. Fork PRs still run lint/typecheck/build. | |
| # | |
| # Dependabot PRs branch from this repo (so the fork check passes) but ALSO run | |
| # without secrets — treat them like forks and skip the private checkout, or | |
| # the mock-api clone fails with an empty DCD_SSH_DEPLOY_KEY. | |
| env: | |
| HAS_PRIVATE_ACCESS: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && github.actor != 'dependabot[bot]' }} | |
| steps: | |
| - name: Checkout CLI | |
| uses: actions/checkout@v7 | |
| with: | |
| path: cli | |
| - name: Checkout dcd (mock-api) | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: devicecloud-dev/dcd | |
| path: dcd | |
| ssh-key: ${{ secrets.DCD_SSH_DEPLOY_KEY }} | |
| # api/swagger.json is a file, which cone-mode sparse checkout rejects | |
| # as of git 2.51 ("is not a directory") — use non-cone patterns. | |
| sparse-checkout-cone-mode: false | |
| sparse-checkout: | | |
| /mock-api/ | |
| /api/swagger.json | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6 | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: '22' | |
| cache: 'pnpm' | |
| cache-dependency-path: './cli/pnpm-lock.yaml' | |
| - name: Install CLI dependencies | |
| working-directory: ./cli | |
| run: pnpm install --frozen-lockfile | |
| - name: Install Mock API dependencies | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| working-directory: ./dcd/mock-api | |
| run: pnpm install --frozen-lockfile | |
| - name: Run CLI linter | |
| working-directory: ./cli | |
| run: pnpm lint | |
| - name: Type check (strict, src + tests) | |
| working-directory: ./cli | |
| run: pnpm typecheck | |
| - name: Run CLI tests | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| working-directory: ./cli | |
| env: | |
| MOCK_API_DIR: ${{ github.workspace }}/dcd/mock-api | |
| run: pnpm test | |
| - name: Skip integration tests (fork PR — no mock-api access) | |
| if: env.HAS_PRIVATE_ACCESS != 'true' | |
| run: echo "::notice::Integration tests skipped — the mock-api (private devicecloud-dev/dcd) is not accessible from fork PRs. Lint, typecheck, and build still ran." | |
| - name: Build CLI | |
| working-directory: ./cli | |
| run: pnpm build | |
| - name: Security audit | |
| working-directory: ./cli | |
| run: pnpm audit --audit-level moderate |