Allowlist unfixable image-size advisories in dependency audit #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| # A newer push to the same branch/PR cancels the in-flight run. | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Typecheck & build | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Match the release workflow's Tauri system dependencies so `cargo check` | |
| # links against the same libraries the real build uses. | |
| - name: Install Linux dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: lts/* | |
| cache: npm | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust cache | |
| uses: swatinem/rust-cache@v2 | |
| with: | |
| workspaces: "./src-tauri -> target" | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| # Unit tests for pure helpers (paths, frontmatter, session, …). | |
| - name: Unit tests | |
| run: npm test | |
| # tsc + vite build — produces dist/, which tauri-build needs to validate | |
| # the config in the cargo check step below. | |
| - name: Typecheck & build frontend | |
| run: npm run build | |
| - name: Check Rust | |
| run: cargo check --manifest-path src-tauri/Cargo.toml | |
| audit: | |
| name: Dependency audit | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: lts/* | |
| cache: npm | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| # Fail on high/critical advisories in shipped (non-dev) dependencies. | |
| # Advisories with no upstream fix are allowlisted in audit-ci.jsonc, | |
| # each with a rationale and a note to remove once patched. | |
| - name: npm audit | |
| run: npx audit-ci@^7 --config audit-ci.jsonc --show-found | |
| # Prebuilt binary — avoids a long cargo install compile. | |
| - name: Install cargo-audit | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-audit | |
| - name: Rust security audit | |
| run: cargo audit --file src-tauri/Cargo.lock |