Skip to content

Commit 2c1f656

Browse files
kripa-sindhu-007kripa-sindhu-007
authored
Merge pull request #1 from kripa-sindhu-007/copilot/setup-ci-cd-pipeline
feat: Add CI/CD pipeline with PR validation, branch protection, and security controls
2 parents 24263cf + e1dcbb7 commit 2c1f656

5 files changed

Lines changed: 364 additions & 2 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Default owner for all files
2+
* @kripa-sindhu-007
3+
4+
# Package ownership
5+
/packages/404-ui/ @kripa-sindhu-007
6+
7+
# Documentation ownership
8+
/apps/docs/ @kripa-sindhu-007
9+
*.md @kripa-sindhu-007
10+
11+
# CI/CD and configuration ownership
12+
/.github/ @kripa-sindhu-007
13+
/*.json @kripa-sindhu-007
14+
/package.json @kripa-sindhu-007
15+
/tsconfig*.json @kripa-sindhu-007
16+
/turbo.json @kripa-sindhu-007
17+
*.yml @kripa-sindhu-007
18+
*.yaml @kripa-sindhu-007

‎.github/pull_request_template.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
## Description
2+
3+
<!-- Provide a clear and concise description of your changes -->
4+
5+
## Type of Change
6+
7+
<!-- Check all that apply -->
8+
9+
- [ ] 🐛 Bug fix (non-breaking change which fixes an issue)
10+
- [ ] ✨ New feature (non-breaking change which adds functionality)
11+
- [ ] 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
12+
- [ ] 📝 Documentation update
13+
- [ ] 🎨 Style/formatting changes (no functional changes)
14+
- [ ] ♻️ Code refactoring (no functional changes)
15+
- [ ] ⚡ Performance improvement
16+
- [ ] ✅ Test updates
17+
- [ ] 🔧 Configuration/build changes
18+
19+
## Checklist
20+
21+
<!-- Check all that apply -->
22+
23+
- [ ] My code follows the style guidelines of this project
24+
- [ ] I have performed a self-review of my own code
25+
- [ ] I have commented my code, particularly in hard-to-understand areas
26+
- [ ] I have made corresponding changes to the documentation
27+
- [ ] My changes generate no new warnings
28+
- [ ] I have added tests that prove my fix is effective or that my feature works
29+
- [ ] New and existing unit tests pass locally with my changes
30+
- [ ] I have added a changeset (if applicable)
31+
32+
## Changeset
33+
34+
<!-- If your changes should trigger a release, run `pnpm changeset` and describe your changes -->
35+
<!-- The changeset file will be automatically detected by the PR validation workflow -->
36+
37+
- [ ] I have added a changeset (required for package changes that should be released)
38+
- [ ] No changeset needed (docs-only, CI/CD, or other non-package changes)
39+
40+
## Screenshots
41+
42+
<!-- If applicable, add screenshots to help explain your changes -->
43+
44+
## Additional Notes
45+
46+
<!-- Add any other context about the pull request here -->

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ name: CI
33
on:
44
push:
55
branches: [main]
6-
pull_request:
7-
branches: [main]
86

97
concurrency:
108
group: ${{ github.workflow }}-${{ github.ref }}

‎.github/workflows/pr-validation.yml‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
name: PR Validation
2+
3+
on:
4+
pull_request:
5+
branches: [main]
6+
7+
# Limit GITHUB_TOKEN permissions to read-only
8+
permissions:
9+
contents: read
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
13+
cancel-in-progress: true
14+
15+
jobs:
16+
lint:
17+
name: Lint (ESLint)
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v4
22+
23+
- name: Setup pnpm
24+
uses: pnpm/action-setup@v4
25+
26+
- name: Setup Node.js
27+
uses: actions/setup-node@v4
28+
with:
29+
node-version: "20"
30+
cache: "pnpm"
31+
32+
- name: Install dependencies
33+
run: pnpm install --frozen-lockfile
34+
35+
- name: Run ESLint
36+
run: pnpm lint
37+
38+
prettier:
39+
name: Format Check (Prettier)
40+
runs-on: ubuntu-latest
41+
steps:
42+
- name: Checkout
43+
uses: actions/checkout@v4
44+
45+
- name: Setup pnpm
46+
uses: pnpm/action-setup@v4
47+
48+
- name: Setup Node.js
49+
uses: actions/setup-node@v4
50+
with:
51+
node-version: "20"
52+
cache: "pnpm"
53+
54+
- name: Install dependencies
55+
run: pnpm install --frozen-lockfile
56+
57+
- name: Check formatting
58+
run: pnpm format:check
59+
60+
typecheck:
61+
name: Type Check
62+
runs-on: ubuntu-latest
63+
steps:
64+
- name: Checkout
65+
uses: actions/checkout@v4
66+
67+
- name: Setup pnpm
68+
uses: pnpm/action-setup@v4
69+
70+
- name: Setup Node.js
71+
uses: actions/setup-node@v4
72+
with:
73+
node-version: "20"
74+
cache: "pnpm"
75+
76+
- name: Install dependencies
77+
run: pnpm install --frozen-lockfile
78+
79+
- name: Run TypeScript
80+
run: pnpm typecheck
81+
82+
build:
83+
name: Build
84+
runs-on: ubuntu-latest
85+
steps:
86+
- name: Checkout
87+
uses: actions/checkout@v4
88+
89+
- name: Setup pnpm
90+
uses: pnpm/action-setup@v4
91+
92+
- name: Setup Node.js
93+
uses: actions/setup-node@v4
94+
with:
95+
node-version: "20"
96+
cache: "pnpm"
97+
98+
- name: Install dependencies
99+
run: pnpm install --frozen-lockfile
100+
101+
- name: Build packages
102+
run: pnpm build
103+
104+
- name: Upload build artifacts
105+
uses: actions/upload-artifact@v4
106+
with:
107+
name: dist
108+
# Artifact paths match the monorepo structure: packages/*/dist and apps/docs/dist
109+
path: |
110+
packages/*/dist
111+
apps/docs/dist
112+
retention-days: 7
113+
114+
release-check:
115+
name: Release Check (Dry Run)
116+
runs-on: ubuntu-latest
117+
outputs:
118+
has-changeset: ${{ steps.check-changeset.outputs.has-changeset }}
119+
steps:
120+
- name: Checkout
121+
uses: actions/checkout@v4
122+
with:
123+
fetch-depth: 0
124+
125+
- name: Setup pnpm
126+
uses: pnpm/action-setup@v4
127+
128+
- name: Setup Node.js
129+
uses: actions/setup-node@v4
130+
with:
131+
node-version: "20"
132+
cache: "pnpm"
133+
134+
- name: Install dependencies
135+
run: pnpm install --frozen-lockfile
136+
137+
- name: Check for changeset files
138+
id: check-changeset
139+
run: |
140+
# Check if any changeset files were added or modified in this PR
141+
# Compare against the base branch to find changed files
142+
git fetch origin ${{ github.base_ref }}
143+
CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
144+
145+
# Check if any .md files in .changeset directory (excluding README.md specifically)
146+
CHANGESET_FILES=$(echo "$CHANGED_FILES" | grep -E '^\.changeset/.*\.md$' | grep -v '^\.changeset/README\.md$' || true)
147+
148+
if [ -n "$CHANGESET_FILES" ]; then
149+
echo "has-changeset=true" >> $GITHUB_OUTPUT
150+
echo "✅ Changeset file(s) found:"
151+
echo "$CHANGESET_FILES"
152+
else
153+
echo "has-changeset=false" >> $GITHUB_OUTPUT
154+
echo "ℹ️ No changeset files found in this PR"
155+
echo "If this PR includes changes that should be released, please add a changeset:"
156+
echo " pnpm changeset"
157+
fi
158+
159+
- name: Validate changeset format
160+
if: steps.check-changeset.outputs.has-changeset == 'true'
161+
run: |
162+
echo "Validating changeset format..."
163+
pnpm changeset status
164+
echo "✅ Changeset validation passed! This PR will trigger a release."
165+
166+
- name: Skip validation
167+
if: steps.check-changeset.outputs.has-changeset == 'false'
168+
run: |
169+
echo "ℹ️ Skipping changeset validation (no changesets in this PR)"
170+
echo "This PR will not trigger a release."
171+
172+
pr-validation-complete:
173+
name: PR Validation Complete
174+
runs-on: ubuntu-latest
175+
if: always()
176+
needs: [lint, prettier, typecheck, build, release-check]
177+
steps:
178+
- name: Check job status
179+
run: |
180+
echo "Checking status of all required jobs..."
181+
182+
# Check each job status
183+
if [ "${{ needs.lint.result }}" != "success" ]; then
184+
echo "❌ Lint job failed or was cancelled"
185+
exit 1
186+
fi
187+
188+
if [ "${{ needs.prettier.result }}" != "success" ]; then
189+
echo "❌ Prettier job failed or was cancelled"
190+
exit 1
191+
fi
192+
193+
if [ "${{ needs.typecheck.result }}" != "success" ]; then
194+
echo "❌ TypeCheck job failed or was cancelled"
195+
exit 1
196+
fi
197+
198+
if [ "${{ needs.build.result }}" != "success" ]; then
199+
echo "❌ Build job failed or was cancelled"
200+
exit 1
201+
fi
202+
203+
if [ "${{ needs.release-check.result }}" != "success" ]; then
204+
echo "❌ Release Check job failed or was cancelled"
205+
exit 1
206+
fi
207+
208+
echo "✅ All validation checks passed successfully!"

‎docs/BRANCH_PROTECTION_SETUP.md‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
# Branch Protection Setup Guide
2+
3+
This guide explains how to set up branch protection rules for the main branch of your repository.
4+
5+
## Prerequisites
6+
7+
- Repository admin access
8+
- GitHub account with appropriate permissions
9+
10+
## Setup Steps
11+
12+
### 1. Navigate to Branch Protection Settings
13+
14+
1. Go to your repository on GitHub
15+
2. Click on "Settings" tab
16+
3. Click on "Branches" in the left sidebar
17+
4. Under "Branch protection rules", click "Add rule"
18+
19+
### 2. Configure Protection Rules
20+
21+
#### Branch Name Pattern
22+
23+
- Enter `main` as the branch name pattern
24+
25+
#### Protection Settings
26+
27+
Enable the following rules:
28+
29+
- **Require a pull request before merging**
30+
- Require approvals: 1
31+
- Dismiss stale pull request approvals when new commits are pushed
32+
- Require review from Code Owners (if applicable)
33+
- **Require status checks to pass before merging**
34+
- Require branches to be up to date before merging
35+
- Add status checks:
36+
- CI tests
37+
- Linting
38+
- Build verification
39+
- **Require conversation resolution before merging**
40+
- **Require signed commits** (optional but recommended)
41+
- **Require linear history** (optional)
42+
- **Include administrators** (applies rules to admins too)
43+
44+
### 3. Additional Recommended Settings
45+
46+
- **Restrict who can push to matching branches**: Limit to specific users/teams
47+
- **Allow force pushes**: Disabled (recommended)
48+
- **Allow deletions**: Disabled (recommended)
49+
50+
## Verification
51+
52+
After setting up branch protection:
53+
54+
1. Try to push directly to main (should be blocked)
55+
2. Create a PR and verify that checks run
56+
3. Verify that approval is required before merging
57+
58+
## Common Issues
59+
60+
### Issue: Can't push to main
61+
62+
**Solution**: This is expected. Create a feature branch and submit a PR instead.
63+
64+
### Issue: Status checks not appearing
65+
66+
**Solution**: Ensure your CI/CD workflow is properly configured and has run at least once.
67+
68+
### Issue: Need to bypass protection temporarily
69+
70+
**Solution**: If you're an admin, you can temporarily disable protection rules, but this is not recommended.
71+
72+
## Best Practices
73+
74+
1. Always work on feature branches
75+
2. Keep pull requests small and focused
76+
3. Ensure all tests pass before requesting review
77+
4. Address review comments promptly
78+
5. Keep your branch up to date with main
79+
80+
## Resources
81+
82+
- [GitHub Branch Protection Documentation](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches)
83+
- [GitHub Flow Guide](https://guides.github.com/introduction/flow/)
84+
85+
## Support
86+
87+
If you encounter issues with branch protection setup, please:
88+
89+
1. Check the GitHub documentation
90+
2. Review repository settings
91+
3. Contact your repository administrator
92+
4. Open an issue in the repository

0 commit comments

Comments
 (0)