This repository was archived by the owner on Jun 9, 2026. It is now read-only.
Repository navigation
chore(deps): bump @google/genai from 1.52.0 to 2.3.0 in /.opencode #517
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI — Lint, Typecheck, Secrets | |
| on: | |
| pull_request: | |
| branches: | |
| - dev | |
| - main | |
| push: | |
| branches: | |
| - dev | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| ci: | |
| name: Lint + Typecheck + Secrets | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| # ⚠️ CRITICAL: Bun only — NEVER use npm/pnpm (per TECHSTACKPREFERENCES.md) | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 | |
| with: | |
| bun-version: "1.x" # pin to major — avoids breaking changes from Bun 2.x | |
| - name: Install dependencies | |
| run: bun install | |
| # Typecheck nur wenn tsconfig.json existiert | |
| - name: Typecheck (if TypeScript configured) | |
| run: | | |
| if [ -f "tsconfig.json" ]; then | |
| echo "TypeScript config found — running typecheck..." | |
| bunx tsc --noEmit | |
| else | |
| echo "No tsconfig.json — skipping typecheck" | |
| fi | |
| # Biome lint/format nur wenn biome.json existiert | |
| - name: Biome Check (if configured) | |
| run: | | |
| if [ -f "biome.json" ]; then | |
| echo "Biome config found — running check..." | |
| bunx @biomejs/biome check . | |
| else | |
| echo "No biome.json — skipping Biome check" | |
| fi | |
| # Secret Scan — case-insensitive für common patterns | |
| - name: Scan for hardcoded secrets | |
| run: | | |
| # Case-insensitive check for common secret patterns with 20+ char values. | |
| # Covers: sk- prefixes (OpenAI-style keys), api_key/api-key/API_KEY/API-KEY/ | |
| # client_secret with = or : assignments, values may contain letters, digits, | |
| # hyphens, underscores, dots. | |
| # Short values (< 20 chars) are excluded to avoid false positives from | |
| # module names like 'task-manager', 'publishTask', 'publish-task-model', etc. | |
| # Lines annotated with "# pragma: allowlist secret" are intentional env-var | |
| # reads and are excluded from the scan. | |
| # Search in common code directories | |
| SEARCH_DIRS="Tools .opencode skill-packs" | |
| FOUND=0 | |
| for dir in $SEARCH_DIRS; do | |
| if [ -d "$dir" ]; then | |
| if grep -rEin "sk-[a-zA-Z0-9._-]{20,}|(api[_-]?key|client[_-]?secret|password|token)[[:space:]]*[:=][[:space:]]*['\"]?[a-zA-Z0-9._-]{20,}['\"]?" \ | |
| --exclude-dir=node_modules \ | |
| "$dir" --include="*.ts" --include="*.js" 2>/dev/null \ | |
| | grep -v "pragma: allowlist secret"; then | |
| FOUND=1 | |
| fi | |
| fi | |
| done | |
| if [ $FOUND -eq 1 ]; then | |
| echo "❌ Potential hardcoded secret found!" | |
| exit 1 | |
| fi | |
| echo "✅ No obvious hardcoded secrets found" | |
| # Test job — vorbereitet für wenn Tests existieren | |
| - name: Tests (if tests exist) | |
| run: | | |
| if find . -name "*.test.ts" -o -name "*.spec.ts" | grep -q .; then | |
| echo "Test files found — running tests..." | |
| bun test | |
| else | |
| echo "No test files found — skipping (add tests to enable)" | |
| fi | |
| env: | |
| NODE_ENV: test |