Skip to content

fix(ci): allow supported actions/cache major versions #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hoang12122 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(ci): allow supported actions/cache major versions #39

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions scripts/check-operational-performance-invariants.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,11 @@ if (authService.includes("jsonDb.getCollection<any>('roles')")) {
requireText(ouScope, 'select: { id: true }', 'OU scope must query only user IDs on the database path.');
requireText(ouScope, 'where: { ouId: { in: scopeOuIds } }', 'OU scope must push OU filtering into the database query.');

requireText(workflow, 'uses: actions/cache@v4', 'Workflow must cache npm download artifacts without requiring a lockfile.');
const cacheActionMatch = workflow.match(/uses:\s*actions\/cache@v(\d+)\b/);
if (!cacheActionMatch || Number(cacheActionMatch[1]) < 4) {
failures.push('Workflow must use a supported actions/cache version for npm download artifacts.');
}
requireText(workflow, 'path: ~/.npm', 'Workflow must cache the npm download directory.');
Comment on lines +40 to +44

@coderabbitai coderabbitai Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Validate the active cache step as one unit.

These independent text searches can pass on a commented-out uses:/path: pair or on two different steps, so the invariant may report success without an active actions/cache@v4+ step caching ~/.npm. Parse the workflow or scope both assertions to the same non-commented cache step.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/check-operational-performance-invariants.mjs` around lines 40 - 44,
The cache invariant currently validates the actions/cache version and npm path
independently, allowing commented or mismatched steps to pass. Update the
validation around cacheActionMatch and requireText to parse or isolate the same
non-commented actions/cache@v4+ step, and require that step itself to configure
path: ~/.npm.

requireText(workflow, "hashFiles('package.json')", 'Workflow cache must invalidate when package.json changes.');
requireText(workflow, 'npm install --include=dev --ignore-scripts', 'Workflow must use the approved lockfile-free dependency bootstrap.');
requireText(workflow, '--package-lock=false', 'Workflow must not generate an ephemeral package-lock.json.');
Expand All @@ -64,4 +68,4 @@ if (failures.length) {
process.exit(1);
}

console.log('[operational-performance] PASS: scoped pagination, auth reuse, targeted OU queries, lockfile-free CI cache and route loading are enforced.');
console.log('[operational-performance] PASS: scoped pagination, auth reuse, targeted OU queries, lockfile-free CI cache and route loading are enforced.');
Loading