This repository was archived by the owner on Aug 17, 2026. It is now read-only.

feat(auth): device-handling + new-device email (closes #13) #107

Workflow file for this run

	# GitHub Actions CI for the open-source template (nest-base).
	#
	# This is the OSS-side mirror of `.gitlab-ci.yml`. Consumer projects forked
	# off this template typically deploy from GitLab and keep the GitLab pipeline;
	# the GitHub workflow exists so the public template repository on GitHub
	# itself is gated by the same six quality bars: lint, format, test:unit,
	# test:e2e, test:types, test:coverage, build, plus a non-blocking audit.
	#
	# Every job runs on ubuntu-latest because the e2e + coverage jobs use
	# testcontainers (Docker is preinstalled on the GitHub-hosted runner).

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	# Run on every PR regardless of target branch (so feature → develop
	# PRs gate the same way as feature → main). The pull_request trigger
	# defaults to types: [opened, synchronize, reopened], which covers
	# initial open + each push + reopen-after-close.
	branches: ["**"]

	# Cancel in-flight runs on the same ref when a newer commit arrives — saves
	# Action minutes on rapid pushes (squash-merge cadence).
	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	lint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Lint
	run: bun run lint

	format:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Format check
	run: bun run format

	test-types:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: TypeScript type-check
	run: bun run test:types

	test-unit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Unit tests
	run: bun run test:unit

	test-e2e:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: Build Dev-Portal SPA
	run: bun run build:dev-portal
	- name: E2E + story tests (testcontainers spins up Postgres)
	run: bun run test:e2e

	test-coverage:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: Build Dev-Portal SPA
	run: bun run build:dev-portal
	- name: Coverage report
	run: bun run test:coverage
	- name: Upload coverage report
	if: always()
	uses: actions/upload-artifact@v7
	with:
	name: coverage-report
	path: reports/coverage/
	retention-days: 14

	build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: Build
	run: bun run build
	- name: Upload build artifact
	uses: actions/upload-artifact@v7
	with:
	name: dist
	path: dist/
	retention-days: 7

	audit:
	runs-on: ubuntu-latest
	# Advisory only — vulnerable transitive deps are surfaced but never
	# gate a merge. Same posture as the GitLab pipeline.
	continue-on-error: true
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Dependency audit (advisory)
	# `\|\| true` — vulnerable transitive deps are surfaced in the log
	# for visibility but never gate a merge. Same posture as the
	# GitLab pipeline; flip on `bun audit --severity high` once the
	# transitive ecosystem catches up.
	run: bun audit \|\| true

	# Aggregator gate — depends on every required job. Add THIS job to
	# GitHub branch protection's "required status checks" list and you
	# get one switch that flips green only when all required gates pass.
	# `audit` is intentionally excluded (continue-on-error: true).
	# `setup-smoke` runs from its own workflow file (`setup-smoke.yml`)
	# and registers as its own required check; it is NOT included here
	# because workflows can't depend on jobs in other workflows.
	ci-success:
	runs-on: ubuntu-latest
	needs:
	- lint
	- format
	- test-types
	- test-unit
	- test-e2e
	- test-coverage
	- build
	if: always()
	steps:
	- name: Verify every required job passed
	run: \|
	if [[ "${{ contains(needs..result, 'failure') \|\| contains(needs..result, 'cancelled') }}" == "true" ]]; then
	echo "::error::One or more required CI jobs failed."
	exit 1
	fi
	echo "All required CI jobs passed."

Navigation Menu

Uh oh!

feat(auth): device-handling + new-device email (closes #13) #107

Workflow file

feat(auth): device-handling + new-device email (closes #13) #107

Uh oh!

Workflow file for this run