Record and verify the 0.1.0 release #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| clean-room: | |
| name: Clean-room release checks | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| env: | |
| OPENAI_API_KEY: voiceinput-security-openai-canary | |
| ELEVENLABS_API_KEY: voiceinput-security-elevenlabs-canary | |
| DEEPGRAM_API_KEY: voiceinput-security-deepgram-canary | |
| BROWSERSTACK_ACCESS_KEY: voiceinput-security-browserstack-canary | |
| VOICEINPUT_DEV_AUTH_SECRET: voiceinput-security-auth-canary | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Verify artifact-free checkout | |
| shell: bash | |
| run: | | |
| generated="$(find packages apps -type d \( -name dist -o -name .next -o -name .turbo \) -print -quit)" | |
| tarball="$(find packages -type f -name '*.tgz' -print -quit)" | |
| if [[ -n "$generated" || -n "$tarball" || -d .turbo ]]; then | |
| echo "Generated artifacts were present before validation." | |
| exit 1 | |
| fi | |
| - name: Install Gitleaks 8.30.1 | |
| shell: bash | |
| run: | | |
| archive="$RUNNER_TEMP/gitleaks.tar.gz" | |
| curl --fail --location --silent --show-error \ | |
| https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz \ | |
| --output "$archive" | |
| echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb $archive" | sha256sum --check | |
| tar -xzf "$archive" -C "$RUNNER_TEMP" gitleaks | |
| echo "$RUNNER_TEMP" >> "$GITHUB_PATH" | |
| - run: node scripts/scan-secrets.mjs repository | |
| - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6 | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: 22.22.0 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm exec playwright install --with-deps chromium firefox webkit | |
| - name: Start Linux audio backend for Firefox | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y pulseaudio | |
| pulseaudio --start --exit-idle-time=-1 | |
| - run: node scripts/record-desktop-versions.mjs > desktop-versions.json | |
| - run: pnpm format:check | |
| - run: pnpm lint | |
| - run: pnpm typecheck | |
| - run: pnpm test | |
| - run: pnpm test:browser | |
| - run: pnpm build | |
| - run: pnpm validate:packages | |
| - run: node scripts/scan-secrets.mjs tarballs | |
| - run: pnpm --filter @voiceinput/website test:dev | |
| - run: pnpm test:e2e | |
| - if: always() | |
| run: pnpm test:security | |
| - name: Store immutable package candidate | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: release-candidate-${{ github.sha }} | |
| path: | | |
| .release-manifest.json | |
| desktop-versions.json | |
| packages/*/*.tgz | |
| if-no-files-found: error | |
| include-hidden-files: true | |
| compression-level: 0 | |
| retention-days: 30 | |
| - if: failure() | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: playground-e2e-report | |
| path: | | |
| playwright-report/ | |
| test-results/ | |
| if-no-files-found: ignore | |
| retention-days: 7 | |
| consumer-runtime: | |
| name: Package runtime (Node ${{ matrix.node }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| node: [22.22.3, 24.20.0, 26.8.1] | |
| steps: | |
| - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 | |
| - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6 | |
| - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| - run: pnpm test:node-compat |