ic-builder
b3caef6888
The diagrams job ran without a browser (the earlier fix landed on a deleted branch by mistake). Now installs Debian chromium, points puppeteer at it, and prints mmdc stderr on failure. Ticket: https://projects.knownelement.com/issues/832
43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
# CI [#832] — pure-Go CLI: fmt, vet, build, secret scan + diagram QA.
|
|
# Diagram QA needs chromium: runs only when docs change.
|
|
name: ci
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
jobs:
|
|
vet:
|
|
runs-on: ultix
|
|
container:
|
|
image: golang:1.23-alpine
|
|
steps:
|
|
- run: apk add --no-cache nodejs git
|
|
- uses: actions/checkout@v4
|
|
- run: gofmt -l cli/ | tee /tmp/fmt.out && test ! -s /tmp/fmt.out
|
|
- run: cd cli && go vet ./... && go build ./...
|
|
- name: secret scan
|
|
run: |
|
|
if grep -rInE "BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY|BW_PASSWORD='|SM_PASSWORD=" --exclude-dir=.git --exclude-dir=.smstate .; then
|
|
echo "::error::secret material committed"; exit 1
|
|
fi
|
|
diagrams:
|
|
runs-on: ultix
|
|
container:
|
|
image: node:20-bookworm
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: mermaid blocks must parse
|
|
run: |
|
|
apt-get update -qq >/dev/null && apt-get install -qq -y gawk chromium >/dev/null
|
|
export PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
|
|
# renderer + chromium inside minlag/mermaid-cli; mmdc parses without page render
|
|
QA=$(mktemp -d)
|
|
awk '/^```mermaid/{n++; f=QA"/d"n".mmd"; next} /^```/{f=""; next} f!=""{print > f}' QA="$QA" docs/*.md
|
|
echo '{"args":["--no-sandbox","--disable-setuid-sandbox","--disable-gpu"]}' > "$QA/pptr.json"
|
|
docker_target=skip
|
|
for f in "$QA"/d*.mmd; do
|
|
[ -f "$f" ] || continue
|
|
npx -y @mermaid-js/mermaid-cli@11 -p "$QA/pptr.json" -i "$f" -o /tmp/out.svg 2>/tmp/mmd-err.txt >/dev/null || { echo "::error::unrenderable diagram: $f"; tail -5 /tmp/mmd-err.txt; exit 1; }
|
|
echo "PARSE-OK: $f"
|
|
done
|