feat: redesign open-source page with on-site contribution roadmap #27

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main, develop]
	pull_request:
	branches: [main, develop]

	# Default permissions for all jobs - principle of least privilege
	permissions:
	contents: read

	jobs:
	lint-and-typecheck:
	name: Lint and Type Check
	runs-on: ubuntu-latest
	permissions:
	contents: read

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version-file: '.nvmrc'
	cache: 'npm'

	- name: Install dependencies
	run: npm ci

	- name: Run linter
	run: npm run lint

	- name: Run type check
	run: npm run type-check

	security:
	name: Security Scanning
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write

	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version-file: '.nvmrc'
	cache: 'npm'

	- name: Install dependencies
	run: npm ci

	# Vulnerability scanning with npm audit
	- name: Run npm audit
	run: npm audit --audit-level=high
	continue-on-error: true

	# License compliance check
	- name: Check license compliance
	run: \|
	npx license-checker --production --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;CC0-1.0;CC-BY-3.0;CC-BY-4.0;Unlicense;0BSD;BlueOak-1.0.0" --summary
	continue-on-error: true

	# Secrets scanning with gitleaks
	- name: Run Gitleaks
	uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
	continue-on-error: true

	# Generate SBOM (Software Bill of Materials)
	- name: Generate SBOM
	run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format json
	continue-on-error: true

	- name: Upload SBOM artifact
	uses: actions/upload-artifact@v4
	with:
	name: sbom
	path: sbom.json
	retention-days: 30
	if: success() \|\| failure()

	test:
	name: Test
	runs-on: ubuntu-latest
	permissions:
	contents: read

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version-file: '.nvmrc'
	cache: 'npm'

	- name: Install dependencies
	run: npm ci

	- name: Run tests with coverage
	run: npm run test:coverage
	env:
	CI: true

	- name: Upload coverage reports
	uses: codecov/codecov-action@v4
	with:
	token: ${{ secrets.CODECOV_TOKEN }}
	files: ./coverage/lcov.info
	flags: unittests
	name: codecov-cursor-boston
	fail_ci_if_error: false
	verbose: true

	- name: Check coverage threshold
	run: \|
	COVERAGE=$(cat coverage/coverage-summary.json \| jq '.total.lines.pct')
	echo "Current coverage: $COVERAGE%"
	if (( $(echo "$COVERAGE < 50" \| bc -l) )); then
	echo "::warning::Coverage is below 50% threshold"
	fi
	continue-on-error: true

	build:
	name: Build
	runs-on: ubuntu-latest
	needs: [lint-and-typecheck, test]
	permissions:
	contents: read

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version-file: '.nvmrc'
	cache: 'npm'

	- name: Install dependencies
	run: npm ci

	- name: Validate environment variables
	run: npm run validate-env
	env:
	# Use placeholder values for CI - actual values not needed for build validation
	NEXT_PUBLIC_FIREBASE_API_KEY: "test-api-key"
	NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: "test-project.firebaseapp.com"
	NEXT_PUBLIC_FIREBASE_PROJECT_ID: "test-project-id"
	NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: "test-project.appspot.com"
	NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: "123456789"
	NEXT_PUBLIC_FIREBASE_APP_ID: "1:123456789:web:abcdef"
	NEXT_PUBLIC_FIREBASE_DATABASE_URL: "https://test-project.firebaseio.com"

	- name: Build application
	run: npm run build
	env:
	# Use placeholder values for CI build
	NEXT_PUBLIC_FIREBASE_API_KEY: "test-api-key"
	NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: "test-project.firebaseapp.com"
	NEXT_PUBLIC_FIREBASE_PROJECT_ID: "test-project-id"
	NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: "test-project.appspot.com"
	NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: "123456789"
	NEXT_PUBLIC_FIREBASE_APP_ID: "1:123456789:web:abcdef"
	NEXT_PUBLIC_FIREBASE_DATABASE_URL: "https://test-project.firebaseio.com"

	docker:
	name: Docker Build
	runs-on: ubuntu-latest
	needs: [lint-and-typecheck, test]
	if: github.event_name == 'push' && github.ref == 'refs/heads/main'
	permissions:
	contents: read
	packages: write

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Build Docker image
	uses: docker/build-push-action@v5
	with:
	context: .
	file: docker/Dockerfile
	push: false
	tags: cursor-boston:${{ github.sha }}
	cache-from: type=gha
	cache-to: type=gha,mode=max
	build-args: \|
	NEXT_PUBLIC_FIREBASE_API_KEY=build-placeholder
	NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=build-placeholder.firebaseapp.com
	NEXT_PUBLIC_FIREBASE_PROJECT_ID=build-placeholder
	NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=build-placeholder.appspot.com
	NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=000000000000
	NEXT_PUBLIC_FIREBASE_APP_ID=1:000000000000:web:placeholder
	NEXT_PUBLIC_FIREBASE_DATABASE_URL=https://build-placeholder.firebaseio.com

Navigation Menu

feat: redesign open-source page with on-site contribution roadmap #27

Workflow file

feat: redesign open-source page with on-site contribution roadmap #27

Uh oh!

Workflow file for this run