feat(cohorts): add pagination to unbounded find() queries in CohortsS… #1046
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| - '*' | |
| pull_request: | |
| jobs: | |
| # ── Guard: build artifacts must never be committed ──────────────────────── | |
| # Scans the git index for dist/ files and *.tsbuildinfo files. | |
| # These are machine-generated outputs; committing them causes large diffs, | |
| # guaranteed merge conflicts, and the risk of deploying a stale build. | |
| no-build-artifacts: | |
| name: No build artifacts in git | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Fail if build artifacts are tracked | |
| run: | | |
| ARTIFACTS=$(git ls-files 'dist/' '*.tsbuildinfo') | |
| if [ -n "$ARTIFACTS" ]; then | |
| echo "::error::Build artifacts found in git index. Remove them with 'git rm --cached' and add to .gitignore." | |
| echo "" | |
| echo "Offending paths:" | |
| echo "$ARTIFACTS" | |
| exit 1 | |
| fi | |
| echo "✓ No build artifacts tracked." | |
| # ── Main validation pipeline ────────────────────────────────────────────── | |
| validate: | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:16-alpine | |
| env: | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: teachlink | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| env: | |
| DATABASE_HOST: localhost | |
| DATABASE_PORT: 5432 | |
| DATABASE_USER: postgres | |
| DATABASE_PASSWORD: postgres | |
| DATABASE_NAME: teachlink | |
| NODE_ENV: ci | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Install dependencies | |
| run: pnpm install --no-frozen-lockfile | |
| - name: Run lint | |
| run: pnpm run lint:ci | |
| - name: Check TypeScript errors | |
| run: pnpm run typecheck | |
| - name: Build application | |
| run: pnpm run build | |
| - name: Run migrations | |
| run: pnpm run migration:run | |
| - name: Check for schema drift | |
| run: pnpm run migration:generate:check | |
| - name: Revert migrations | |
| run: pnpm run migration:revert | |
| # Vulnerability and license compliance scanning. Runs in addition to the | |
| # validation job so deploy-blocking checks do not couple with lint/typecheck. | |
| security-scan: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 11 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: 'pnpm' | |
| - name: Install dependencies | |
| run: pnpm install --no-frozen-lockfile | |
| # pnpm-equivalent of `npm audit`. Reports high/critical vulnerabilities | |
| # against `pnpm-lock.yaml`. | |
| # | |
| # `continue-on-error: true` is in place for the PHASED ROLLOUT of #529: | |
| # the scan still surfaces findings in the workflow log and in the PR | |
| # checks UI, but does NOT block merges until the existing 30 high + | |
| # 1 critical CVEs inherited from upstream have been remediated via | |
| # Dependabot PRs and explicit upgrades. Once audit is clean we MUST | |
| # remove `continue-on-error` so the gate hard-fails going forward. | |
| - name: Audit dependencies for known vulnerabilities | |
| continue-on-error: true | |
| run: pnpm audit --audit-level=high | |
| # scripts/scan-licenses.js reads package-lock.json to enumerate licenses. | |
| # Generate it without touching node_modules so pnpm's tree stays intact. | |
| - name: Generate package-lock.json for license scan | |
| run: npm install --package-lock-only --ignore-scripts --no-audit | |
| - name: License compliance scan | |
| run: npm run license:scan |