Add CI verification and dependency maintenance - #41
Draft
ryanduguid wants to merge 2 commits into
Draft
Conversation
Verify runs build and tests on pull requests and pushes to main, with a blocking npm audit scoped to runtime dependencies (--omit=dev), so PRs fail only on advisories that affect the published CLI. A separate weekly scheduled workflow audits the full tree including devDependencies, keeping new dev-only advisories out of unrelated pull requests.
Weekly grouped npm updates and GitHub Actions updates complement the scheduled audit by proposing dependency bumps proactively.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Verifyworkflow for pull requests and pushes tomainthat installs the locked dependency tree, builds the CLI, runs the test suite and audits production dependencies.Why it changed
The repository needs a consistent baseline for testing contributions and surfacing dependency risk. The scheduled full-tree audit keeps newly published development-only advisories visible without making an unrelated pull request fail merely because an advisory was published after it was opened.
User or developer impact
There is no CLI runtime change. Contributors receive repeatable build, test and production-audit feedback, while maintainers receive scheduled full audits and bounded dependency-update pull requests.
Root cause
The current default branch has no repository-owned GitHub Actions workflow or Dependabot configuration, so build, test and dependency checks are not enforced consistently at the pull-request event source.
Validation
mainat96f68a839741412d48e6c317e92a81db81e9c0f8: this exact head is 0 commits behind and 2 ahead.actions/checkoutandactions/setup-nodecommits exist, are signature-verified and are the currentv4tag targets.npm ci --ignore-scripts: passed.npm run build: passed.npm test: 130 tests passed across 8 files.git diff --check: passed.Dependency gate: the current base reports 15 total audit findings and 5 production findings, so the new production-audit step is expected to fail until #38 lands or this branch is updated onto its equivalent dependency repair. Exact-head validation for #38 passed clean install plus full and production audits with zero findings. This pull request should remain draft until that prerequisite and its hosted checks are resolved.