installers: detect shadowing dcd and auto-persist PATH on Unix #51
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CLI CI | |
| on: | |
| push: | |
| branches: [ dev ] | |
| pull_request: | |
| branches: [ dev ] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint-and-test: | |
| runs-on: ubuntu-latest | |
| # The mock-api lives in the private moropo-com/dcd repo, checked out via an | |
| # SSH deploy key. GitHub does NOT expose secrets to pull_request workflows | |
| # triggered from forks, so that checkout (and the integration tests that need | |
| # it) can only run for same-repo events. Fork PRs still run lint/typecheck/build. | |
| env: | |
| HAS_PRIVATE_ACCESS: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} | |
| steps: | |
| - name: Checkout CLI | |
| uses: actions/checkout@v5 | |
| with: | |
| path: cli | |
| - name: Checkout dcd (mock-api) | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| uses: actions/checkout@v5 | |
| with: | |
| repository: moropo-com/dcd | |
| path: dcd | |
| ssh-key: ${{ secrets.DCD_SSH_DEPLOY_KEY }} | |
| # api/swagger.json is a file, which cone-mode sparse checkout rejects | |
| # as of git 2.51 ("is not a directory") — use non-cone patterns. | |
| sparse-checkout-cone-mode: false | |
| sparse-checkout: | | |
| /mock-api/ | |
| /api/swagger.json | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 10 | |
| run_install: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v5 | |
| with: | |
| node-version: '22' | |
| cache: 'pnpm' | |
| cache-dependency-path: './cli/pnpm-lock.yaml' | |
| - name: Install CLI dependencies | |
| working-directory: ./cli | |
| run: pnpm install --frozen-lockfile | |
| - name: Install Mock API dependencies | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| working-directory: ./dcd/mock-api | |
| run: pnpm install --frozen-lockfile | |
| - name: Run CLI linter | |
| working-directory: ./cli | |
| run: pnpm lint | |
| - name: Type check (strict, src + tests) | |
| working-directory: ./cli | |
| run: pnpm typecheck | |
| - name: Run CLI tests | |
| if: env.HAS_PRIVATE_ACCESS == 'true' | |
| working-directory: ./cli | |
| env: | |
| MOCK_API_DIR: ${{ github.workspace }}/dcd/mock-api | |
| run: pnpm test | |
| - name: Skip integration tests (fork PR — no mock-api access) | |
| if: env.HAS_PRIVATE_ACCESS != 'true' | |
| run: echo "::notice::Integration tests skipped — the mock-api (private moropo-com/dcd) is not accessible from fork PRs. Lint, typecheck, and build still ran." | |
| - name: Build CLI | |
| working-directory: ./cli | |
| run: pnpm build | |
| - name: Security audit | |
| working-directory: ./cli | |
| run: pnpm audit --audit-level moderate |