mirror of
https://github.com/4gray/iptvnator.git
synced 2026-10-09 01:16:15 -08:00
4gray
cfa602d5b1
Pipeline audit follow-up: reduce wasted runner time on PRs and tighten CI security, without reducing what actually gets validated. Runner-time waste: - Concurrency with PR-only cancel-in-progress on CI, E2E, and docker-build, so a new push cancels the previous commit's still-running checks. Non-PR runs use the unique run_id as the group, because GitHub keeps at most one pending run per group even with cancel-in-progress: false — a shared ref group could silently drop a queued master run. - paths-ignore for docs-only changes (Markdown, docs/, .plans/, .codex/, .claude/) on the Electron build matrix and the E2E suites; E2E also skips apps/website/**. The build workflow keeps apps/website/** because its Linux job builds the website to verify AppStream assets. Tag pushes are unaffected: GitHub does not evaluate paths filters for tags. - PRs lint affected projects only; master pushes keep the full run-many. Lint-global inputs (eslint.config.mjs, tools/eslint/**) now mark all 41 lint projects affected, including the run-commands targets database and packaging, so the max-lines baseline cannot be widened without lint. Hardening: - Explicit least-privilege permissions on CI, E2E, and build-and-make; the create-release job keeps its job-level contents: write. The repository default workflow token was switched to read-only. - New actionlint job (image pinned by digest, shellcheck at warning+), with the shared-anchor false positive suppressed in .github/actionlint.yaml. Fixed one real finding: unquoted $GITHUB_OUTPUT. - .github/dependabot.yml: weekly cadence, minor+patch grouped per ecosystem (npm, GitHub Actions, Docker), majors stay individual PRs. Docs updated: CLAUDE.md, docs/architecture/nx-workspace-boundaries.md, and docs/architecture/validation-map.md now describe affected-lint on PRs and the E2E path-filter exceptions.
85 lines
6.2 KiB
JSON
85 lines
6.2 KiB
JSON
{
|
|
"$schema": "../../node_modules/nx/schemas/project-schema.json",
|
|
"name": "packaging",
|
|
"projectType": "library",
|
|
"sourceRoot": "tools/packaging",
|
|
"targets": {
|
|
"test": {
|
|
"executor": "nx:run-commands",
|
|
"cache": true,
|
|
"inputs": [
|
|
"default",
|
|
"{workspaceRoot}/package.json",
|
|
"{workspaceRoot}/electron-builder.json",
|
|
"{workspaceRoot}/.github/workflows/build-and-make.yaml",
|
|
"{workspaceRoot}/.github/workflows/publish-snap.yaml",
|
|
"{workspaceRoot}/apps/electron-backend/build-embedded-mpv.js",
|
|
"{workspaceRoot}/apps/electron-backend/project.json",
|
|
"{workspaceRoot}/apps/electron-backend/native/src/embedded_mpv_win32.cc",
|
|
"{workspaceRoot}/apps/electron-backend/src/app/options/maker.options.json",
|
|
"{workspaceRoot}/tools/packaging/generate-electron-builder-metadata.mjs",
|
|
"{workspaceRoot}/tools/packaging/asar-dependency-closure.mjs",
|
|
"{workspaceRoot}/tools/packaging/asar-dependency-closure.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/embedded-mpv-packaging.cjs",
|
|
"{workspaceRoot}/tools/packaging/embedded-mpv-arch.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/flatpak-launcher-validation.cjs",
|
|
"{workspaceRoot}/tools/packaging/flatpak-launcher-validation.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/configure-linux-frame-copy-build.mjs",
|
|
"{workspaceRoot}/tools/packaging/configure-linux-frame-copy-build.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/linux-after-pack.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/linux-frame-copy-profile.cjs",
|
|
"{workspaceRoot}/tools/packaging/linux-frame-copy-profile.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/prepare-linux-runtime-source-snapshot.cjs",
|
|
"{workspaceRoot}/tools/packaging/prepare-linux-runtime-source-snapshot.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/publish-snap-workflow.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/release-snap-assets.cjs",
|
|
"{workspaceRoot}/tools/packaging/release-snap-assets.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/release-snap-source-binding.cjs",
|
|
"{workspaceRoot}/tools/packaging/verify-linux-frame-copy-runtime.mjs",
|
|
"{workspaceRoot}/tools/packaging/verify-linux-frame-copy-runtime.test.mjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/build-linux-runtime.cjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/build-linux-runtime.mjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/build-linux-runtime.test.mjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/generate-linux-runtime-notices.cjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/generate-linux-runtime-notices.test.mjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/linux-runtime-manifest.cjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/linux-runtime-manifest.test.mjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/linux-source-archive-contract.cjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/linux-source-archive-contract.d.cts",
|
|
"{workspaceRoot}/tools/embedded-mpv/runtime-probe-contract.cjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/runtime-probe-contract.d.cts",
|
|
"{workspaceRoot}/tools/embedded-mpv/stage-runtime.mjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/stage-windows-runtime-archive.mjs"
|
|
],
|
|
"options": {
|
|
"command": "node --test tools/packaging/electron-package-identity.test.mjs tools/packaging/asar-dependency-closure.test.mjs tools/packaging/embedded-mpv-arch.test.mjs tools/packaging/flatpak-launcher-validation.test.mjs tools/packaging/configure-linux-frame-copy-build.test.mjs tools/packaging/linux-after-pack.test.mjs tools/packaging/linux-frame-copy-profile.test.mjs tools/packaging/prepare-linux-runtime-source-snapshot.test.mjs tools/packaging/publish-snap-workflow.test.mjs tools/packaging/release-snap-assets.test.mjs tools/packaging/verify-linux-frame-copy-runtime.test.mjs tools/embedded-mpv/build-linux-runtime.test.mjs tools/embedded-mpv/generate-linux-runtime-notices.test.mjs tools/embedded-mpv/linux-runtime-manifest.test.mjs",
|
|
"cwd": "{workspaceRoot}"
|
|
}
|
|
},
|
|
"lint": {
|
|
"inputs": [
|
|
"default",
|
|
"{workspaceRoot}/eslint.config.mjs",
|
|
"{workspaceRoot}/tools/eslint-rules/**/*",
|
|
"{workspaceRoot}/tools/eslint/**/*",
|
|
"{workspaceRoot}/.github/workflows/build-and-make.yaml",
|
|
"{workspaceRoot}/.github/workflows/publish-snap.yaml",
|
|
"{workspaceRoot}/tools/packaging/prepare-linux-runtime-source-snapshot.cjs",
|
|
"{workspaceRoot}/tools/packaging/prepare-linux-runtime-source-snapshot.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/publish-snap-workflow.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/release-snap-assets.cjs",
|
|
"{workspaceRoot}/tools/packaging/release-snap-assets.test.mjs",
|
|
"{workspaceRoot}/tools/packaging/release-snap-source-binding.cjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/build-linux-runtime.mjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/build-linux-runtime.test.mjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/linux-source-archive-contract.cjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/linux-source-archive-contract.d.cts",
|
|
"{workspaceRoot}/tools/embedded-mpv/runtime-probe-contract.cjs",
|
|
"{workspaceRoot}/tools/embedded-mpv/runtime-probe-contract.d.cts"
|
|
],
|
|
"command": "eslint \"tools/packaging/**/*.{js,cjs,mjs,ts}\" \"tools/embedded-mpv/build-linux-runtime.{mjs,test.mjs}\" \"tools/embedded-mpv/generate-linux-runtime-notices.{cjs,test.mjs}\" \"tools/embedded-mpv/linux-source-archive-contract.cjs\" \"tools/embedded-mpv/runtime-probe-contract.cjs\""
|
|
}
|
|
},
|
|
"tags": ["scope:tools", "domain:packaging", "type:tool"]
|
|
}
|