fix(analyzer): correct overlay language fidelity #1611

Workflow file for this run

	name: CI

	# Every action is pinned to an immutable commit SHA with the human-readable version
	# in a trailing comment. A tag like `@v6` is a moving pointer: whoever controls the
	# action repo can re-point it at new code, and it runs here with this workflow's
	# token. Dependabot's `github-actions` ecosystem proposes the SHA bumps.
	#
	# `persist-credentials: false` on checkout: by default it writes the job token into
	# `.git/config`, leaving it readable by every later step (including anything a
	# dependency's install script does). No job here pushes, so none of them need it.

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.ref }}
	# Superseded pull-request runs are cancelled; runs on main are not, so a push to the
	# default branch always ends up with a completed run rather than a cancelled one.
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	lint:
	name: Lint & Type Check
	runs-on: ubuntu-latest
	timeout-minutes: 15
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
	with:
	node-version: '24'
	cache: 'npm'

	- run: npm ci

	- name: Audit dependencies
	# Gate ALL dependencies (prod + dev) at high severity. Most transitive
	# advisories are pinned to patched versions via `overrides`; the few with no
	# applicable fix are listed, with a reason and a clearing condition, in the
	# gate's ALLOWLIST. The gate also fails on a stale allowlist entry, so an
	# exception cannot outlive its cause.
	run: npm run audit:gate

	- name: Run ESLint
	run: npm run lint

	- name: Run TypeScript type check
	run: npm run typecheck

	test:
	name: Unit Tests
	runs-on: ubuntu-latest
	timeout-minutes: 20
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
	with:
	node-version: '24'
	cache: 'npm'

	- run: npm ci

	- name: Run tests
	run: npm run test:run

	build:
	name: Build
	runs-on: ubuntu-latest
	timeout-minutes: 15
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
	with:
	node-version: '24'
	cache: 'npm'

	- run: npm ci

	- name: Build
	run: npm run build

	- name: Verify MCP preset dispatch boundary
	run: npx vitest run --config vitest.integration.config.ts src/cli/commands/mcp.conformance.integration.test.ts

	- name: Verify the published tarball contents
	# Runs here rather than in `lint` because it asserts the built entrypoints are
	# present, which needs `dist/`. `files` is an allowlist, so a stray new
	# directory is excluded by default — but widening `files` itself is a one-line
	# diff, and this checks the real `npm pack` manifest rather than the intent.
	run: npm run audit:packlist

	# The Pass-1 extraction worker is loaded by runtime path resolution, and under vitest
	# the .ts entry is always the one resolved — so the COMPILED entry that the npm package
	# actually ships is exercised by no other job. A compile or packaging regression there
	# degrades every installed user to the serial lane silently, so it is checked here,
	# where dist/ exists (change: optimize-parallel-extraction-pool).
	- name: Verify the compiled extraction worker
	run: npx vitest run src/core/analyzer/extraction-pool-threads.test.ts

	- name: Upload build artifacts
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
	with:
	name: dist
	path: dist/
	retention-days: 7

	ci-success:
	name: CI Success
	runs-on: ubuntu-latest
	needs: [lint, test, build]
	if: always()
	permissions:
	contents: read
	steps:
	- name: Check all jobs passed
	run: \|
	if [[ "${{ needs.lint.result }}" != "success" ]] \|\| \
	[[ "${{ needs.test.result }}" != "success" ]] \|\| \
	[[ "${{ needs.build.result }}" != "success" ]]; then
	echo "One or more required jobs failed"
	exit 1
	fi
	echo "All required jobs passed!"

Navigation Menu

fix(analyzer): correct overlay language fidelity #1611

Workflow file

fix(analyzer): correct overlay language fidelity #1611

Uh oh!

Workflow file for this run