This repository was archived by the owner on Aug 17, 2026. It is now read-only.

chore(deps): bump nodemailer from 8.0.11 to 9.0.3 #463

Workflow file for this run

	# GitHub Actions CI for the open-source template (nest-base).
	#
	# This is the OSS-side mirror of `.gitlab-ci.yml`. Consumer projects forked
	# off this template typically deploy from GitLab and keep the GitLab pipeline;
	# the GitHub workflow exists so the public template repository on GitHub
	# itself is gated by the same six quality bars: lint, format, test:unit,
	# test:e2e, test:types, test:coverage, build, plus a non-blocking audit.
	#
	# Every job runs on ubuntu-latest because the e2e + coverage jobs use
	# testcontainers (Docker is preinstalled on the GitHub-hosted runner).

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	# Run on every PR regardless of target branch (so feature → develop
	# PRs gate the same way as feature → main). The pull_request trigger
	# defaults to types: [opened, synchronize, reopened], which covers
	# initial open + each push + reopen-after-close.
	branches: ["**"]
	# Allows the dependabot-lockfile workflow to re-trigger CI after regenerating
	# bun.lock (GITHUB_TOKEN pushes do not re-fire pull_request events).
	workflow_dispatch:

	# Cancel in-flight runs on the same ref when a newer commit arrives — saves
	# Action minutes on rapid pushes (squash-merge cadence).
	concurrency:
	group: ci-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	lint:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Lint
	run: bun run lint
	# Tenant-scoped models (those with a `tenantId` column) MUST be paired
	# with an `ENABLE ROW LEVEL SECURITY` migration — otherwise the whole
	# multi-tenant isolation contract is silently bypassed. The audit is
	# cheap (no DB / no Nest bootstrap), so it lives in the lint job
	# rather than as its own ~30s checkout-and-install pipeline.
	#
	# Static-only on purpose: this job has no Postgres available, and
	# `bun run check:rls` (without DATABASE_URL) auto-skips the runtime
	# half with an info note. The runtime mode is a developer-side /
	# downstream-consumer defense-in-depth — it catches the failure
	# mode where a consumer edits an applied migration file post-deploy,
	# leaving the live DB unprotected while the static scan stays green.
	# Run `bun run check:rls --runtime` locally (or wire it into a
	# consumer's prod CI gate that already has a DB) to verify
	# `pg_class.relrowsecurity` against the live cluster.
	- name: RLS coverage audit (static)
	run: bun run check:rls

	format:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Format check
	run: bun run format

	test-types:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: TypeScript type-check
	run: bun run test:types

	test-unit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Unit tests
	run: bun run test:unit

	test-e2e:
	runs-on: ubuntu-latest
	services:
	redis:
	image: redis:7-alpine
	ports: ["6379:6379"]
	options: >-
	--health-cmd "redis-cli ping"
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5
	env:
	TEST_REDIS_URL: redis://localhost:6379
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: Build Dev-Portal SPA
	run: bun run build:dev-portal
	- name: E2E + story tests (testcontainers spins up Postgres)
	run: bun run test:e2e

	test-coverage:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: Build Dev-Portal SPA
	run: bun run build:dev-portal
	- name: Coverage report
	run: bun run test:coverage
	- name: Upload coverage report
	if: always()
	uses: actions/upload-artifact@v7
	with:
	name: coverage-report
	path: reports/coverage/
	retention-days: 14

	build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: Build
	run: bun run build
	- name: Upload build artifact
	uses: actions/upload-artifact@v7
	with:
	name: dist
	path: dist/
	retention-days: 7

	# PRD line 260 pins "OpenAPI snapshot drift + SDK drift" as required
	# checks. Both gates run in `verify-spec.sh` (SC.QG.13 + SC.QG.14)
	# but were not exposed as PR-blocking jobs until iter-153. Each job
	# invokes the same `bun run` script the local verify-spec gate uses
	# so the contract is single-sourced.
	openapi-snapshot-drift:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Generate Prisma client
	run: bun run prepare:schema && bun run prisma:generate
	- name: OpenAPI snapshot drift check
	# The drift gate dumps the live OAS document and asserts
	# byte-for-byte equality with `docs/openapi.snapshot.json`.
	# A change to a controller's `@ApiOperation` / Zod schema /
	# response DTO that the author forgot to commit is the
	# canonical failure mode.
	run: bun run dump:openapi --check

	sdk-drift:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: SDK consumability check
	# `sdk:check` runs kubb against the committed OAS snapshot to
	# confirm the snapshot still produces a working TS SDK. A
	# break here means downstream consumers' generated `sdk.gen.ts`
	# would no longer compile.
	run: bun run sdk:check

	audit:
	runs-on: ubuntu-latest
	# Advisory only — vulnerable transitive deps are surfaced but never
	# gate a merge. Same posture as the GitLab pipeline.
	continue-on-error: true
	steps:
	- uses: actions/checkout@v6
	- uses: oven-sh/setup-bun@v2
	with:
	bun-version: latest
	- name: Install dependencies
	run: bun install --frozen-lockfile
	- name: Dependency audit (advisory)
	# `\|\| true` — vulnerable transitive deps are surfaced in the log
	# for visibility but never gate a merge. Same posture as the
	# GitLab pipeline; flip on `bun audit --severity high` once the
	# transitive ecosystem catches up.
	run: bun audit \|\| true

	# Aggregator gate — depends on every required job. Add THIS job to
	# GitHub branch protection's "required status checks" list and you
	# get one switch that flips green only when all required gates pass.
	# `audit` is intentionally excluded (continue-on-error: true).
	# `setup-smoke` runs from its own workflow file (`setup-smoke.yml`)
	# and registers as its own required check; it is NOT included here
	# because workflows can't depend on jobs in other workflows.
	ci-success:
	runs-on: ubuntu-latest
	needs:
	- lint
	- format
	- test-types
	- test-unit
	- test-e2e
	- test-coverage
	- build
	- openapi-snapshot-drift
	- sdk-drift
	if: always()
	steps:
	- name: Verify every required job passed
	run: \|
	if [[ "${{ contains(needs..result, 'failure') \|\| contains(needs..result, 'cancelled') }}" == "true" ]]; then
	echo "::error::One or more required CI jobs failed."
	exit 1
	fi
	echo "All required CI jobs passed."

Navigation Menu

Uh oh!

chore(deps): bump nodemailer from 8.0.11 to 9.0.3 #463

Workflow file

chore(deps): bump nodemailer from 8.0.11 to 9.0.3 #463

Uh oh!

Workflow file for this run