mirror of
https://github.com/4gray/iptvnator.git
synced 2026-10-09 09:26:14 -08:00
4gray
cfa602d5b1
Pipeline audit follow-up: reduce wasted runner time on PRs and tighten CI security, without reducing what actually gets validated. Runner-time waste: - Concurrency with PR-only cancel-in-progress on CI, E2E, and docker-build, so a new push cancels the previous commit's still-running checks. Non-PR runs use the unique run_id as the group, because GitHub keeps at most one pending run per group even with cancel-in-progress: false — a shared ref group could silently drop a queued master run. - paths-ignore for docs-only changes (Markdown, docs/, .plans/, .codex/, .claude/) on the Electron build matrix and the E2E suites; E2E also skips apps/website/**. The build workflow keeps apps/website/** because its Linux job builds the website to verify AppStream assets. Tag pushes are unaffected: GitHub does not evaluate paths filters for tags. - PRs lint affected projects only; master pushes keep the full run-many. Lint-global inputs (eslint.config.mjs, tools/eslint/**) now mark all 41 lint projects affected, including the run-commands targets database and packaging, so the max-lines baseline cannot be widened without lint. Hardening: - Explicit least-privilege permissions on CI, E2E, and build-and-make; the create-release job keeps its job-level contents: write. The repository default workflow token was switched to read-only. - New actionlint job (image pinned by digest, shellcheck at warning+), with the shared-anchor false positive suppressed in .github/actionlint.yaml. Fixed one real finding: unquoted $GITHUB_OUTPUT. - .github/dependabot.yml: weekly cadence, minor+patch grouped per ecosystem (npm, GitHub Actions, Docker), majors stay individual PRs. Docs updated: CLAUDE.md, docs/architecture/nx-workspace-boundaries.md, and docs/architecture/validation-map.md now describe affected-lint on PRs and the E2E path-filter exceptions.
113 lines
3.3 KiB
JSON
113 lines
3.3 KiB
JSON
{
|
|
"$schema": "./node_modules/nx/schemas/nx-schema.json",
|
|
"namedInputs": {
|
|
"default": ["{projectRoot}/**/*", "sharedGlobals"],
|
|
"production": [
|
|
"default",
|
|
"!{projectRoot}/.eslintrc.json",
|
|
"!{projectRoot}/eslint.config.mjs",
|
|
"!{projectRoot}/**/?(*.)+(spec|test).[jt]s?(x)?(.snap)",
|
|
"!{projectRoot}/tsconfig.spec.json",
|
|
"!{projectRoot}/jest.config.[jt]s",
|
|
"!{projectRoot}/src/test-setup.[jt]s",
|
|
"!{projectRoot}/test-setup.[jt]s"
|
|
],
|
|
"sharedGlobals": ["{workspaceRoot}/.github/workflows/ci.yml"]
|
|
},
|
|
"targetDefaults": {
|
|
"@angular/build:application": {
|
|
"cache": true,
|
|
"dependsOn": ["^build"],
|
|
"inputs": ["production", "^production"]
|
|
},
|
|
"@nx/eslint:lint": {
|
|
"cache": true,
|
|
"inputs": [
|
|
"default",
|
|
"^default",
|
|
"{workspaceRoot}/.eslintrc.json",
|
|
"{workspaceRoot}/.eslintignore",
|
|
"{workspaceRoot}/eslint.config.mjs",
|
|
"{workspaceRoot}/tools/eslint-rules/**/*",
|
|
"{workspaceRoot}/tools/eslint/**/*"
|
|
]
|
|
},
|
|
"lint": {
|
|
"cache": true,
|
|
"inputs": [
|
|
"default",
|
|
"{workspaceRoot}/.eslintrc.json",
|
|
"{workspaceRoot}/.eslintignore",
|
|
"{workspaceRoot}/eslint.config.mjs",
|
|
"{workspaceRoot}/tools/eslint-rules/**/*",
|
|
"{workspaceRoot}/tools/eslint/**/*"
|
|
]
|
|
},
|
|
"@nx/jest:jest": {
|
|
"cache": true,
|
|
"inputs": [
|
|
"default",
|
|
"^production",
|
|
"{workspaceRoot}/jest.preset.js"
|
|
],
|
|
"options": {
|
|
"passWithNoTests": true
|
|
},
|
|
"configurations": {
|
|
"ci": {
|
|
"ci": true,
|
|
"codeCoverage": true
|
|
}
|
|
}
|
|
},
|
|
"@nx/js:tsc": {
|
|
"cache": true,
|
|
"dependsOn": ["^build"],
|
|
"inputs": ["production", "^production"]
|
|
},
|
|
"e2e-ci--src/*.e2e.ts": {
|
|
"dependsOn": [
|
|
{
|
|
"projects": ["electron-backend"],
|
|
"target": "build-e2e"
|
|
},
|
|
{
|
|
"projects": ["stalker-mock-server", "xtream-mock-server"],
|
|
"target": "serve"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"plugins": [
|
|
{
|
|
"plugin": "@nx/playwright/plugin",
|
|
"options": {
|
|
"targetName": "e2e"
|
|
}
|
|
},
|
|
{
|
|
"plugin": "@nx/eslint/plugin",
|
|
"options": {
|
|
"targetName": "lint"
|
|
}
|
|
}
|
|
],
|
|
"generators": {
|
|
"@nx/angular:application": {
|
|
"e2eTestRunner": "playwright",
|
|
"linter": "eslint",
|
|
"style": "scss",
|
|
"unitTestRunner": "jest"
|
|
},
|
|
"@nx/angular:library": {
|
|
"linter": "eslint",
|
|
"unitTestRunner": "jest"
|
|
},
|
|
"@nx/angular:component": {
|
|
"style": "scss"
|
|
}
|
|
},
|
|
"defaultProject": "web",
|
|
"analytics": false
|
|
}
|