Repository navigation
feat: social icons take a tone, separate from their shape #2786
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| # Principle of least privilege: every job in this workflow only reads the | |
| # repo (checkout, build, test, upload-artifact within the workflow run). | |
| # No job pushes, comments, opens PRs, or touches deployments — so the | |
| # default token scope is restricted to `contents: read`. The Codecov | |
| # upload uses `secrets.CODECOV_TOKEN` and does not need GITHUB_TOKEN | |
| # write scopes. Adding a write permission here would expand blast radius | |
| # without enabling any current job. The `e2e` / `e2e-consumer` / `examples` container | |
| # jobs additionally grant `packages: read` at the job level so the runner | |
| # can pull the Playwright image from our GHCR mirror (still read-only). | |
| permissions: | |
| contents: read | |
| # Version Packages PRs (opened by changesets/action on `changeset-release/*` | |
| # branches) intentionally skip the real CI work — every check already ran on | |
| # the feature PR that produced the changeset. To keep branch-protection | |
| # happy, each required job still STARTS (so a status is reported) but its | |
| # steps no-op when the branch matches `changeset-release/*`. The job-level | |
| # env flag `IS_VP` drives that gate; do NOT replace it with a job-level `if:` | |
| # because a skipped job reports no status and required-check rules will | |
| # block the PR forever. | |
| # | |
| # For workflows to fire on the VP PR at all, the changesets/action push must | |
| # be made with a non-`GITHUB_TOKEN` identity — see publish.yml. | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR. Original checks ran on the producing PR." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| - if: env.IS_VP != 'true' | |
| uses: actions/cache@v6 | |
| with: | |
| path: node_modules/.cache/eslint | |
| key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'pnpm-lock.yaml') }}-${{ github.sha }} | |
| restore-keys: | | |
| eslint-${{ runner.os }}-${{ hashFiles('eslint.config.mjs', 'pnpm-lock.yaml') }}- | |
| eslint-${{ runner.os }}- | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run format:check | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run lint | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run deps:check | |
| typecheck: | |
| runs-on: ubuntu-latest | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run typecheck | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: [lint, typecheck] | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run build | |
| # Docs are otherwise never built in CI, and Renovate auto-merges | |
| # devDependency bumps (including vitepress prerelease updates) — this is | |
| # the only gate against a docs-breaking upgrade landing unnoticed. | |
| - if: env.IS_VP != 'true' | |
| run: pnpm --filter @templatical/docs run build | |
| # Guard the editor's published-tarball install footprint. Catches anyone | |
| # adding a runtime `dependency` that re-bloats consumer node_modules or | |
| # re-introduces the duplicate-Vue-instance bug. See packages/editor/scripts/verify-pack.mjs. | |
| - if: env.IS_VP != 'true' | |
| run: pnpm --filter @templatical/editor run verify:pack | |
| # Hard gate: every showcase template must pass the accessibility linter. | |
| # Runs after build because the script imports the built quality dist — | |
| # tsx can't evaluate `import.meta.glob` from source. | |
| - if: env.IS_VP != 'true' | |
| run: pnpm --filter @templatical/playground run lint:templates | |
| - if: env.IS_VP != 'true' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: dist | |
| path: packages/*/dist | |
| retention-days: 1 | |
| include-hidden-files: true | |
| test: | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| - if: env.IS_VP != 'true' | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: dist | |
| path: packages/ | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run test:coverage | |
| - if: env.IS_VP != 'true' | |
| uses: codecov/codecov-action@v7 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| directory: . | |
| # The CLI can report a queued upload while Codecov never processes | |
| # it (deactivated repo, rejected token). The README badge then sits | |
| # on a stale percentage with a green test job. Failing here is the | |
| # signal that the badge has gone stale. | |
| fail_ci_if_error: true | |
| e2e: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| # Playwright's official image ships Chromium + every system dep | |
| # preinstalled, skipping the ~5 min `playwright install-deps` step that | |
| # fresh ubuntu-latest runners would otherwise pay every run (apt state | |
| # isn't cacheable across runs). | |
| # | |
| # Pulled from our GHCR mirror, NOT mcr.microsoft.com directly: MCR's Azure | |
| # edge intermittently throttles concurrent pulls ("The request is | |
| # blocked."), which fails "Initialize containers" and turns this job red at | |
| # random. GHCR is co-located with the runners and isn't throttled. The | |
| # mirror is kept in sync by .github/workflows/mirror-playwright.yml. The tag | |
| # must match the pinned `@playwright/test` version in pnpm-lock.yaml AND the | |
| # tag that workflow mirrors. | |
| container: | |
| image: ghcr.io/templatical/playwright:v1.63.0-jammy | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| needs: [build] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| shard: [1, 2, 3] | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| - if: env.IS_VP != 'true' | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: dist | |
| path: packages/ | |
| - if: env.IS_VP != 'true' | |
| run: pnpm exec playwright test --shard=${{ matrix.shard }}/3 | |
| - if: env.IS_VP != 'true' && !cancelled() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: blob-report-${{ matrix.shard }} | |
| path: blob-report/ | |
| retention-days: 1 | |
| e2e-consumer: | |
| # Smoke-test the editor as a real consumer would: pack, install into a | |
| # fresh project, mount, click. Catches the duplicate-Vue-instance class of | |
| # bug that the workspace-resolved playground e2e cannot see. | |
| # | |
| # Skipped on Version Packages PRs (changeset-release/*) because the packed | |
| # tarballs reference the about-to-be-released workspace versions, which | |
| # aren't on npm yet — `npm install` would fail with ETARGET. The original | |
| # gate already ran on the producing PR; the post-merge run on `main` (after | |
| # publish) re-covers the surface. | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| # Same rationale as the `e2e` job — the Playwright image skips the | |
| # system-dep install step, pulled from our GHCR mirror to dodge MCR's | |
| # intermittent edge throttling (see the `e2e` job + mirror-playwright.yml). | |
| container: | |
| image: ghcr.io/templatical/playwright:v1.63.0-jammy | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| needs: [build] | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR. Tarballs reference unreleased versions." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| # No dist download: the prep script builds what it packs, and every | |
| # workspace package those builds read from dist/, from this checkout | |
| # (`buildOrder` in packages/editor/scripts/consumer-fixture.mjs). A | |
| # downloaded dist would hide a missing build edge until a fresh local | |
| # checkout hit it. | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run test:e2e:consumer | |
| - if: env.IS_VP != 'true' && failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: e2e-consumer-report | |
| path: playwright-report/ | |
| retention-days: 7 | |
| webpack-consumer: | |
| # Build the editor as a real Webpack 5 consumer would. Catches issue #63: | |
| # if anyone adds a dynamic `import()` to an optional peer without try/catch, | |
| # webpack escalates "Module not found" from warning to error and breaks the | |
| # consumer's production build. See packages/editor/scripts/webpack-consumer-verify.mjs. | |
| runs-on: ubuntu-latest | |
| needs: [build] | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| # No dist download, for the same reason as e2e-consumer. | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run test:webpack-consumer | |
| examples: | |
| # Build and run each examples/<name> app the way a new user would, against | |
| # this PR's packed packages: materialize it with every @templatical | |
| # dependency pointed at a tarball, npm install, production build, typecheck, | |
| # start, then the Playwright smoke spec. The nextjs build is Next.js 16's | |
| # Turbopack build, which fails on a UMD/AMD define() wrapper in the editor | |
| # bundle with `error TP1200` (issue #67). | |
| # See packages/editor/scripts/examples-verify.mjs. | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| packages: read | |
| # Same image and mirror as the `e2e` job. | |
| container: | |
| image: ghcr.io/templatical/playwright:v1.63.0-jammy | |
| credentials: | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| needs: [build] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| example: [nextjs, nuxt, sveltekit, react-router, react-vite] | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| # The packages are packed from the build job's dist, not rebuilt. | |
| - if: env.IS_VP != 'true' | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: dist | |
| path: packages/ | |
| - if: env.IS_VP != 'true' | |
| run: pnpm run test:examples ${{ matrix.example }} | |
| - if: env.IS_VP != 'true' && failure() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: examples-report-${{ matrix.example }} | |
| path: playwright-report/ | |
| retention-days: 7 | |
| e2e-report: | |
| runs-on: ubuntu-latest | |
| needs: [e2e] | |
| if: ${{ !cancelled() && needs.e2e.result != 'skipped' }} | |
| env: | |
| IS_VP: ${{ startsWith(github.head_ref, 'changeset-release/') || startsWith(github.ref_name, 'changeset-release/') }} | |
| steps: | |
| - name: Skip on Version Packages PR | |
| if: env.IS_VP == 'true' | |
| run: echo "Skipped — Version Packages PR. No e2e artifacts produced." | |
| - if: env.IS_VP != 'true' | |
| uses: actions/checkout@v7 | |
| - if: env.IS_VP != 'true' | |
| uses: ./.github/actions/setup | |
| - if: env.IS_VP != 'true' | |
| uses: actions/download-artifact@v8 | |
| with: | |
| path: all-blob-reports | |
| pattern: blob-report-* | |
| merge-multiple: true | |
| - if: env.IS_VP != 'true' | |
| run: pnpm exec playwright merge-reports --reporter html ./all-blob-reports | |
| - if: env.IS_VP != 'true' | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: playwright-report | |
| path: playwright-report/ | |
| retention-days: 7 |