fix(whoami): say when an API key overrides the stored session (#194) #494
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI CI | |
| on: | |
| push: | |
| branches: [ dev, production ] | |
| pull_request: | |
| # `production` is included so the dev→production promotion PR is also gated | |
| # by lint/typecheck/build (and is required by the production ruleset). | |
| branches: [ dev, production ] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout (full history) | |
| uses: actions/checkout@v7 | |
| with: | |
| # Full history so gitleaks scans every commit, not just the tip. | |
| fetch-depth: 0 | |
| - name: Run gitleaks | |
| env: | |
| # Pinned release; bump deliberately. Run the binary directly rather than | |
| # gitleaks/gitleaks-action@v2, which requires a paid GITLEAKS_LICENSE for | |
| # organization-owned repos. | |
| GITLEAKS_VERSION: 8.30.1 | |
| run: | | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz gitleaks | |
| # --log-opts=HEAD scopes the scan to commits reachable from what's | |
| # checked out: the whole history of this branch (or of the PR merge | |
| # commit, i.e. base + PR commits), but NOT unrelated branches. | |
| # `fetch-depth: 0` fetches refs/heads/* — every branch — and gitleaks | |
| # otherwise scans all of them, so an open branch that legitimately | |
| # commits a high-entropy value plus its own .gitleaks.toml allowlist | |
| # would fail every OTHER branch's scan, which is judged against the | |
| # allowlist at its own tip. Each branch is still fully scanned by its | |
| # own PR, and pushes to dev/production scan their full history. | |
| ./gitleaks git . --redact --verbose --no-banner --log-opts=HEAD | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| # This repo is PUBLIC and runs no step that reaches into the private | |
| # devicecloud-dev/dcd repo. It used to check out that repo's mock-api over an | |
| # SSH deploy key to run test/integration/*, which meant a private-repo | |
| # credential lived in a public repo's secrets and the API's OpenAPI spec was | |
| # pulled onto the runner on every same-repo PR. dcd#1036 deleted that mock-api; | |
| # rather than re-point at it, the linkage is gone. | |
| # | |
| # The consequence is deliberate: test/integration/* does NOT run here, and | |
| # neither does the swagger contract-drift check it provided (spec drift used to | |
| # surface as a Prism 422). Only test/unit/* runs — pure, no backend. To run the | |
| # integration suite locally, point MOCK_API_DIR at a mock; see CLAUDE.md. | |
| steps: | |
| - name: Checkout CLI | |
| uses: actions/checkout@v7 | |
| with: | |
| path: cli | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v6.1.0 | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: 'pnpm' | |
| cache-dependency-path: './cli/pnpm-lock.yaml' | |
| - name: Install CLI dependencies | |
| working-directory: ./cli | |
| run: pnpm install --frozen-lockfile | |
| - name: Run CLI linter | |
| working-directory: ./cli | |
| run: pnpm lint | |
| - name: Type check (strict, src + tests) | |
| working-directory: ./cli | |
| run: pnpm typecheck | |
| - name: Run CLI unit tests | |
| working-directory: ./cli | |
| run: pnpm test:unit | |
| - name: Note skipped integration tests | |
| run: echo "::notice::Integration tests are not run in CI — they need a mock of the dcd API, and this public repo does not reach into the private one. Lint, typecheck, unit tests, build and audit all ran." | |
| - name: Build CLI | |
| working-directory: ./cli | |
| run: pnpm build | |
| - name: Security audit | |
| working-directory: ./cli | |
| run: pnpm audit --audit-level moderate | |
| # Promotions to `production` MUST pin the stable version with a `Release-As:` | |
| # footer on a commit. Without it release-please derives the stable version | |
| # from the most recent tag reachable from `production` — and because a | |
| # promotion is a merge commit, every beta tag is reachable, so it picks up a | |
| # `-beta` version. That is exactly how 5.6.0 ended up with `production` | |
| # carrying 5.6.0-beta.1 in package.json and a release PR that could not | |
| # publish. 5.5.0 got a pin (`chore: pin the 5.5.0 promotion`) and came out | |
| # correct; 5.6.0's was abandoned and did not. | |
| # | |
| # It has to be on a NORMAL commit, not the merge commit — release-please's | |
| # commit splitting is unreliable on merges. | |
| promotion-pin: | |
| if: github.event_name == 'pull_request' && github.base_ref == 'production' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Require a stable Release-As pin | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| git fetch --quiet origin dev | |
| # Scope matters more than the pattern here. A promotion merges the whole | |
| # of `dev`, whose history carries a `Release-As:` footer from every past | |
| # promotion (5.0.0, 5.1.0, 5.1.1, 5.2.0, 5.3.0, 5.3.1 …). Scanning | |
| # `base..head` therefore always finds one and passes vacuously — checked | |
| # against the real #176, which it waved through. Only commits unique to | |
| # this promotion branch count: everything on `production` and everything | |
| # on `dev` is excluded. `--no-merges` because release-please's commit | |
| # splitting is unreliable on merge commits, so a pin has to sit on an | |
| # ordinary one. | |
| # | |
| # NB `^ref` not `--not ref`: --not is a TOGGLE over everything that | |
| # follows, so `--not A --not B` excludes A and re-includes B. | |
| MESSAGES=$(git log --no-merges --format=%B "$HEAD_SHA" "^$BASE_SHA" "^origin/dev") | |
| if echo "$MESSAGES" | grep -qE '^Release-As:[[:space:]]*[0-9]+\.[0-9]+\.[0-9]+[[:space:]]*$'; then | |
| echo "Found $(echo "$MESSAGES" | grep -oE '^Release-As:[[:space:]]*[0-9]+\.[0-9]+\.[0-9]+' | head -1)" | |
| exit 0 | |
| fi | |
| if echo "$MESSAGES" | grep -qE '^Release-As:'; then | |
| echo "::error::This promotion pins a PRERELEASE version. The stable line must be pinned to a plain X.Y.Z." | |
| echo "$MESSAGES" | grep -E '^Release-As:' >&2 | |
| exit 1 | |
| fi | |
| echo "::error::No 'Release-As: X.Y.Z' footer on any non-merge commit unique to this promotion." | |
| { | |
| echo "Add one as its own commit on the promotion branch:" | |
| echo " git commit --allow-empty -m 'chore: pin the X.Y.Z promotion' -m 'Release-As: X.Y.Z'" | |
| echo | |
| echo "Do not skip it on the grounds that the conventional commits since the last" | |
| echo "stable already imply the right bump. They do not: a promotion is a merge, so" | |
| echo "every beta tag becomes reachable from production, and release-please picks the" | |
| echo "newest reachable tag as its base. That is how the 5.6.0 promotion — which" | |
| echo "reasoned exactly that way — produced a 'chore(production): release 5.6.0-beta.1'" | |
| echo "release PR and left production carrying a prerelease in package.json." | |
| } >&2 | |
| exit 1 |