ci(repo): Version Packages #1497
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| workflow_call: | |
| inputs: | |
| ref: | |
| type: string | |
| default: "" | |
| description: Git ref to checkout. Leave empty for default checkout behavior. | |
| run-e2e: | |
| type: boolean | |
| default: true | |
| description: Whether to run E2E tests | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| CLERK_TELEMETRY_DISABLED: "1" | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - uses: oven-sh/setup-bun@v2 | |
| # Skip cache restore when invoked via workflow_call from release.yml's | |
| # snapshot path (issue_comment trigger). That path checks out | |
| # PR-author-controlled code in the default branch's privileged context; | |
| # consuming a cached install in that context is a poisoning surface. | |
| - if: github.event_name != 'issue_comment' | |
| uses: actions/cache/restore@v6 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: bun-${{ runner.os }}- | |
| - run: bun install --frozen-lockfile | |
| - run: bun run build | |
| lint: | |
| name: Lint | |
| needs: [build] | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - uses: oven-sh/setup-bun@v2 | |
| - if: github.event_name != 'issue_comment' | |
| uses: actions/cache/restore@v6 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: bun-${{ runner.os }}- | |
| - run: bun install --frozen-lockfile | |
| - run: bun run format:check | |
| - run: bun run lint | |
| - run: bun run typecheck | |
| test: | |
| name: Test | |
| needs: [build] | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - uses: oven-sh/setup-bun@v2 | |
| - if: github.event_name != 'issue_comment' | |
| uses: actions/cache/restore@v6 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: bun-${{ runner.os }}- | |
| - run: bun install --frozen-lockfile | |
| - run: bun run check:patches | |
| - run: bun run test | |
| test-e2e: | |
| name: E2E Test | |
| needs: [build] | |
| # For workflow_call: respect the run-e2e input. | |
| # For pull_request: skip fork PRs (no access to secrets) and Dependabot PRs | |
| # (cannot access Actions secrets, so CLERK_CLI_TEST_APP_ID would be empty). | |
| if: >- | |
| (github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| github.actor != 'dependabot[bot]') || | |
| (github.event_name != 'pull_request' && inputs.run-e2e) | |
| runs-on: blacksmith-8vcpu-ubuntu-2404 | |
| container: | |
| image: mcr.microsoft.com/playwright:v1.60.0-noble | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Install unzip (required by setup-bun) | |
| run: apt-get update && apt-get install -y unzip | |
| - name: Pin localhost to IPv4 in /etc/hosts | |
| # The playwright image resolves `localhost` to `::1` first, which | |
| # breaks Next.js dev: Next's internal proxy connects to `localhost` | |
| # regardless of the -H flag, so if localhost is IPv6-only the | |
| # proxy gets ECONNRESET. Drop the `::1 localhost` entry so every | |
| # consumer (Next dev proxy, Bun fetch, Chromium) reaches 127.0.0.1. | |
| run: | | |
| grep -v '::1.*localhost' /etc/hosts > /tmp/hosts.new | |
| cat /tmp/hosts.new > /etc/hosts | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ inputs.ref }} | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: 24 | |
| - name: Mark workspace as safe for git | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - uses: oven-sh/setup-bun@v2 | |
| - if: github.event_name != 'issue_comment' | |
| uses: actions/cache/restore@v6 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }} | |
| restore-keys: bun-${{ runner.os }}- | |
| - run: bun install --frozen-lockfile | |
| - name: Cleanup stale test users | |
| run: bun scripts/cleanup-test-users.ts | |
| env: | |
| CLERK_CLI_TEST_APP_ID: ${{ secrets.CLERK_CLI_TEST_APP_ID }} | |
| CLERK_PLATFORM_API_KEY: ${{ secrets.CLERK_PLATFORM_API_KEY }} | |
| - name: Run E2E tests | |
| run: bun run test:e2e | |
| env: | |
| CLERK_CLI_TEST_APP_ID: ${{ secrets.CLERK_CLI_TEST_APP_ID }} | |
| CLERK_PLATFORM_API_KEY: ${{ secrets.CLERK_PLATFORM_API_KEY }} | |
| CLERK_E2E_DEBUG: "1" |