mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-18 21:16:47 +00:00
Maurice
8e695cc267
The ruleset required only `lint` (shared's eslint and prettier) and `check-target`. Types, lint, coverage, end-to-end and the S3 contract were advisory, and the three health PRs merged with red checks. Nothing on a PR into dev built the Dockerfile or rendered the Helm chart either, which is how #2610 shipped a Dockerfile no build could parse. ci-ok needs every gate, test, image and chart job and is meant to be the one check the ruleset requires. It runs with always(), fails when a job it needs failed or was cancelled, and passes when they passed or were skipped. The Sonar scan stays outside: its quality gate reports on the PR by itself, and an outage there should not block merges. A required check cannot sit behind a workflow-level path filter: on a docs-only PR the workflow never starts and the check never reports. The filter moves into a `changes` job. It diffs the PR's merge commit against its base (or a push against the previous head) and scripts/ci/ changed-areas.mjs maps the files to code, image and deploy areas. It fails closed: no usable diff, an empty one or a path it cannot read cleanly runs everything. Its tests run in the same job. docker-image builds the Dockerfile with buildx (layer cache written by pushes only, read by PRs), starts it with the same hardening as docker-compose.yml, waits up to three minutes for /api/health/ready, checks the VERSION file and that / serves the client, and prints the container log. deploy-manifests lints the chart, renders it with the default values and with each secret, persistence and ingress mode, validates the output with kubeconform, and runs `docker compose config` on every compose file. helm and kubeconform are pinned by version and sha256. While the file is open: every job runs on ubuntu-24.04 instead of the moving ubuntu-latest, reads its Node version from .nvmrc (the plugin-sdk jobs ran 22 under a comment saying it matched the server, which runs 24), download-artifact moves from v6, still on Node 20, to v7, and the Sonar action is pinned by commit.
65 lines
3.7 KiB
JSON
65 lines
3.7 KiB
JSON
{
|
|
"name": "@trek/root",
|
|
"private": true,
|
|
"version": "4.3.3",
|
|
"engines": {
|
|
"node": "^22.22.2 || ^24.15.0 || >=26.0.0"
|
|
},
|
|
"workspaces": [
|
|
"client",
|
|
"server",
|
|
"shared"
|
|
],
|
|
"scripts": {
|
|
"version:major": "npm version major --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:minor": "npm version minor --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:patch": "npm version patch --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:premajor": "npm version premajor --preid=rc --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:preminor": "npm version preminor --preid=beta --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:prepatch": "npm version prepatch --preid=alpha --workspaces --include-workspace-root --no-git-tag-version",
|
|
"version:prerelease": "npm version prerelease --preid=pre --workspaces --include-workspace-root --no-git-tag-version",
|
|
"dev": "npm run build --workspace=shared && concurrently --names shared,server,client \"npm run build:watch --workspace=shared\" \"npm run dev --workspace=server\" \"npm run dev --workspace=client\"",
|
|
"build": "npm run build --workspace=shared && npm run build --workspace=server && npm run build --workspace=client",
|
|
"test": "npm run test --workspace=shared && npm run test --workspace=server && npm run test --workspace=client",
|
|
"test:cov": "npm run test:coverage --workspace=shared && npm run test:coverage --workspace=server && npm run test:coverage --workspace=client && npm run test:coverage --prefix plugin-sdk",
|
|
"test:e2e": "npm run test:e2e --workspace=server",
|
|
"test:ci-scripts": "node --test scripts/ci/*.test.mjs",
|
|
"lint": "npm run lint --workspace=shared && npm run lint --workspace=server && npm run lint --workspace=client",
|
|
"format": "npm run format --workspace=shared && npm run format --workspace=server && npm run format --workspace=client",
|
|
"format:check": "npm run format:check --workspace=shared && npm run format:check --workspace=server && npm run format:check --workspace=client"
|
|
},
|
|
"devDependencies": {
|
|
"concurrently": "^10.0.4",
|
|
"unrun": "^0.3.1"
|
|
},
|
|
"comment:scarfSettings": "swagger-ui-dist ships @scarf/scarf install-time analytics; TREK sends no telemetry, so it stays off.",
|
|
"scarfSettings": {
|
|
"enabled": false
|
|
},
|
|
"comment:overrides": "React and react-dom: one React 19 across the workspace, so the test renderer (@testing-library/react) and the app share one react-dom. Everything else is a security floor. npm reads overrides from the root package.json only, so a floor in a workspace package.json does nothing. A floor never crosses a major its dependents ask for (brace-expansion is pinned per line for that reason), and npm ls <name> shows whether it holds.",
|
|
"overrides": {
|
|
"react": "19.3.0",
|
|
"react-dom": "19.3.0",
|
|
"@hono/node-server": "^1.19.13",
|
|
"brace-expansion@^2.0.0": "^2.1.7",
|
|
"dompurify": "^3.4.16",
|
|
"fast-uri": "^3.1.8",
|
|
"file-type": "^21.3.4",
|
|
"hono": "^4.12.16",
|
|
"ip-address": "^10.7.1",
|
|
"js-yaml@^5.0.0": "^5.4.1",
|
|
"multer": "^2.4.0",
|
|
"proxy-addr": "^2.0.8",
|
|
"qs": "^6.15.2",
|
|
"source-map-js": "^1.2.2",
|
|
"ws": "^8.21.3"
|
|
},
|
|
"comment:optionalDependencies": "The lockfile is generated on glibc, so the musl builds the Alpine image needs never land in it on their own. Keep the @img/* pins on the same version as client's sharp — a mismatch nests the binary away from libvips and the image build dies in generate-icons.",
|
|
"optionalDependencies": {
|
|
"@img/sharp-linuxmusl-arm64": "0.35.4",
|
|
"@img/sharp-linuxmusl-x64": "0.35.4",
|
|
"@rollup/rollup-linux-arm64-musl": "4.62.0",
|
|
"@rollup/rollup-linux-x64-musl": "4.62.0"
|
|
}
|
|
}
|