fix: fail the coverage gate on a stale summary instead of passing #62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Identical in every *-le repo. The artifact name is derived from the repo | |
| # rather than hardcoded, so this file is byte-for-byte the same everywhere and | |
| # a change can be copied across without a per-repo edit. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # Least privilege: CI reads the repo and nothing else. | |
| permissions: | |
| contents: read | |
| # A newer push supersedes an in-flight run instead of both burning a 3-OS matrix. | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| commits: | |
| name: Commit messages | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| # The full history of the pushed range, so every new subject is checked | |
| # rather than only the tip. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| # The local commit-msg hook is skippable with --no-verify; this is not. | |
| - name: Validate conventional commits | |
| run: | | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| RANGE="origin/${{ github.base_ref }}..HEAD" | |
| else | |
| RANGE="${{ github.event.before }}..${{ github.sha }}" | |
| fi | |
| node scripts/commit-lint.js --range "$RANGE" | |
| ci: | |
| name: CI on ${{ matrix.os }} | |
| runs-on: ${{ matrix.os }} | |
| # Integration tests drive a real extension host; without a cap a hung | |
| # vscode-test sits for the 6h runner default. | |
| timeout-minutes: 20 | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| fail-fast: false | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: 1.3.13 | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| # PR-only: shows what a dependency change actually pulls in, and fails on | |
| # a known-vulnerable addition — before Dependabot's auto-merge can act. | |
| - name: Dependency review | |
| if: github.event_name == 'pull_request' && runner.os == 'Linux' | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0 | |
| with: | |
| fail-on-severity: high | |
| - name: Lint | |
| run: bun run lint | |
| - name: Typecheck | |
| run: bun run typecheck | |
| - name: Unit tests with coverage | |
| run: bun run test:coverage | |
| # The README's Testing section is generated from the coverage summary. | |
| # Failing here means the committed numbers no longer match a real run — | |
| # which is exactly how the pre-2.0 READMEs drifted into fiction. | |
| - name: README coverage section is current | |
| if: runner.os == 'Linux' | |
| run: bun run coverage:readme:check | |
| - name: Build bundle | |
| run: bun run build | |
| - name: Bundle gate | |
| run: bun run check:bundle | |
| - name: Package VSIX | |
| run: bun run package | |
| - name: Integration tests (Linux) | |
| if: runner.os == 'Linux' | |
| run: xvfb-run -a bun run test:integration | |
| - name: Integration tests (macOS/Windows) | |
| if: runner.os != 'Linux' | |
| run: bun run test:integration | |
| # The only test that exercises the artifact users actually install. | |
| # Linux only: it drives a second VS Code instance and needs xvfb. | |
| - name: Installed-VSIX end-to-end (Linux) | |
| if: runner.os == 'Linux' | |
| run: xvfb-run -a bun run test:e2e-vsix | |
| - name: Upload VSIX artifact | |
| if: runner.os == 'Linux' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ${{ github.event.repository.name }}-vsix | |
| path: release/*.vsix | |
| if-no-files-found: error | |
| retention-days: 14 |