chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates #38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================= | |
| # SpatialSync — Pull Request Quality Gates | |
| # Runs on every PR to enforce team standards | |
| # 2026 Industry Standard: Automated PR validation | |
| # ============================================================================= | |
| name: PR Checks | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled, unlabeled] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # 1. Conventional Commit Validation | |
| # --------------------------------------------------------------------------- | |
| commit-message: | |
| name: 📝 Commit Convention | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install dependencies | |
| run: npm ci --no-audit --no-fund | |
| - name: Validate PR title matches Conventional Commits | |
| uses: amannn/action-semantic-pull-request@v5 | |
| id: lint_pr_title | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| types: | | |
| feat | |
| fix | |
| docs | |
| style | |
| refactor | |
| perf | |
| test | |
| build | |
| ci | |
| chore | |
| revert | |
| security | |
| - name: Validate commit messages | |
| run: | | |
| npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose || echo "Commit messages validated" | |
| # --------------------------------------------------------------------------- | |
| # 2. PR Size & Scope Check | |
| # --------------------------------------------------------------------------- | |
| pr-size: | |
| name: 📏 PR Size | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check PR size | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const { data: diff } = await github.rest.repos.compareCommits({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| base: context.payload.pull_request.base.sha, | |
| head: context.payload.pull_request.head.sha, | |
| }); | |
| const totalChanges = diff.files.reduce((acc, f) => acc + f.additions + f.deletions, 0); | |
| const message = totalChanges > 1000 | |
| ? `⚠️ This PR is large (${totalChanges} lines). Consider splitting into smaller PRs for faster review.` | |
| : `✅ PR size is reasonable (${totalChanges} lines).`; | |
| core.notice(message); | |
| if (totalChanges > 2000) { | |
| core.warning(`Very large PR: ${totalChanges} lines. Please split into multiple PRs.`); | |
| } | |
| # --------------------------------------------------------------------------- | |
| # 3. TODO / FIXME Check | |
| # --------------------------------------------------------------------------- | |
| todo-check: | |
| name: 🔍 TODO Audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check for unresolved TODOs and FIXMEs | |
| run: | | |
| TODOS=$(grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.php" --include="*.js" --include="*.css" --include="*.blade.php" resources/ app/ config/ routes/ database/ 2>/dev/null || true) | |
| if [ -n "$TODOS" ]; then | |
| echo "⚠️ Found unresolved markers:" | |
| echo "$TODOS" | |
| echo "::warning::Found TODO/FIXME/HACK markers in the codebase" | |
| else | |
| echo "✅ No TODO/FIXME markers found" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # 4. Dependency Diff Check | |
| # --------------------------------------------------------------------------- | |
| dependency-check: | |
| name: 📦 Dependency Diff | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Check for dependency changes | |
| id: dep-changes | |
| run: | | |
| if git diff --name-only HEAD~1 | grep -qE "composer.(json|lock)|package.(json|lock)"; then | |
| echo "⚠️ Dependencies have changed — review carefully for security implications." | |
| echo "changed=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "changed=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Comment on dependency changes | |
| if: steps.dep-changes.outputs.changed == 'true' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: '⚠️ **Dependencies changed in this PR.**\n\nPlease verify:\n- [ ] No breaking changes\n- [ ] No known vulnerabilities\n- [ ] Changes are necessary\n\nRun `composer audit` and `npm audit` locally to verify.' | |
| }) |