chore(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates #453
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Prisma Example README E2E | |
| # Outside-in walkthrough of `examples/prisma/README.md`'s "Run it" | |
| # section: copies .env.example, brings up the bundled Postgres, runs | |
| # `pnpm install`, `pnpm emit`, `pnpm migration:plan --name initial`, | |
| # `pnpm migration:apply`, then `pnpm start`, asserting each command | |
| # exits 0 and that `pnpm start` prints the documented "Expected | |
| # output" lines. | |
| # | |
| # Lives in the root `e2e/` workspace as | |
| # `tests/prisma-example-readme.e2e.test.ts`. Auth-gated: skips | |
| # cleanly on fork PRs where ZeroKMS secrets are unavailable. | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - 'examples/prisma/**' | |
| - '.github/workflows/prisma-example-readme-e2e.yml' | |
| # The walkthrough encrypts against the live service, so the native | |
| # binding and the action that builds it are inputs to this suite. Added | |
| # with that build step: without them a protect-ffi change would reach main | |
| # having never run the walkthrough. They are repeated verbatim under | |
| # `pull_request` below, which is what makes that a gate rather than a | |
| # report — a PR touching any of these runs the walkthrough before the | |
| # change lands, not after. | |
| - '.github/actions/build-ffi-binding/**' | |
| - 'packages/protect-ffi/crates/**' | |
| - 'packages/protect-ffi/src/**' | |
| - 'packages/protect-ffi/Cargo.toml' | |
| - 'packages/protect-ffi/Cargo.lock' | |
| - 'packages/protect-ffi/package.json' | |
| - 'packages/protect-ffi/mise.toml' | |
| # Out of that package, and a compile input all the same: the cdylib | |
| # crate carries | |
| # `eql-bindings = { path = "../../../eql/crates/eql-bindings" }`, so the | |
| # EQL wire types are linked into the `index.node` this job encrypts | |
| # through. The native cache key in `.github/actions/build-ffi-binding` | |
| # hashes both, so an edit here misses that cache and the binding gets | |
| # rebuilt — correctly. Without these two entries the miss never happens, | |
| # because the workflow does not trigger at all: a payload-encoding change | |
| # under packages/eql/crates merges with this walkthrough green by absence. | |
| # Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs. | |
| - 'packages/eql/crates/**' | |
| - 'packages/eql/Cargo.toml' | |
| pull_request: | |
| branches: | |
| - '**' | |
| paths: | |
| - 'examples/prisma/**' | |
| - '.github/workflows/prisma-example-readme-e2e.yml' | |
| # The same entries as under `push` above, and the copy that does the | |
| # work: a PR touching the native binding or the action that builds it | |
| # runs the walkthrough on the PR, so a protect-ffi change is gated by | |
| # this suite rather than reaching main unexercised. (GitHub Actions has | |
| # no YAML anchors, so the list is written twice; | |
| # scripts/__tests__/workflow-paths-filter-parity.test.mjs compares the | |
| # two copies.) | |
| - '.github/actions/build-ffi-binding/**' | |
| - 'packages/protect-ffi/crates/**' | |
| - 'packages/protect-ffi/src/**' | |
| - 'packages/protect-ffi/Cargo.toml' | |
| - 'packages/protect-ffi/Cargo.lock' | |
| - 'packages/protect-ffi/package.json' | |
| - 'packages/protect-ffi/mise.toml' | |
| # Out of that package, and a compile input all the same: the cdylib | |
| # crate carries | |
| # `eql-bindings = { path = "../../../eql/crates/eql-bindings" }`, so the | |
| # EQL wire types are linked into the `index.node` this job encrypts | |
| # through. The native cache key in `.github/actions/build-ffi-binding` | |
| # hashes both, so an edit here misses that cache and the binding gets | |
| # rebuilt — correctly. Without these two entries the miss never happens, | |
| # because the workflow does not trigger at all: a payload-encoding change | |
| # under packages/eql/crates merges with this walkthrough green by absence. | |
| # Pinned by scripts/__tests__/wasm-build-inputs-paths-filter.test.mjs. | |
| - 'packages/eql/crates/**' | |
| - 'packages/eql/Cargo.toml' | |
| jobs: | |
| walkthrough: | |
| name: Run README walkthrough | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| # Skip cleanly on fork PRs where secrets aren't available. The | |
| # test's `describe.skipIf(!authConfigured)` would also skip, but | |
| # gating at the job level produces a clean "skipped" status. | |
| # Every OTHER event runs, which is why this gates on "not a fork PR" rather | |
| # than listing the event names allowed through: the listing form skipped | |
| # the job on `workflow_dispatch` in integration-protect-ffi.yml, making a | |
| # declared manual trigger do nothing. Enforced by | |
| # scripts/__tests__/workflow-dispatch-job-conditions.test.mjs. | |
| if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }} | |
| env: | |
| CS_WORKSPACE_CRN: ${{ vars.CS_WORKSPACE_CRN }} | |
| CS_CLIENT_ID: ${{ vars.CS_CLIENT_ID }} | |
| CS_CLIENT_KEY: ${{ secrets.CS_CLIENT_KEY }} | |
| CS_CLIENT_ACCESS_KEY: ${{ secrets.CS_CLIENT_ACCESS_KEY }} | |
| steps: | |
| - name: Checkout Repo | |
| uses: actions/checkout@v6 | |
| - uses: pnpm/action-setup@v6.0.10 | |
| name: Install pnpm | |
| with: | |
| run_install: false | |
| - name: Install Node.js | |
| uses: actions/setup-node@v6.5.0 | |
| with: | |
| node-version: 22 | |
| cache: 'pnpm' | |
| # node-pty's install hook falls back to `node-gyp rebuild` when no | |
| # linux-x64 prebuild matches. pnpm/action-setup v6 no longer ships | |
| # node-gyp on PATH, so install it explicitly. | |
| - name: Install node-gyp | |
| run: npm install -g node-gyp | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| # A missing / rotated / fork-PR-absent secret makes the walkthrough skip | |
| # its live steps silently, hiding regressions behind a green job. Fail loud. | |
| # First, ahead of the binding build: this costs seconds and that costs | |
| # minutes on a cold cache. | |
| - name: Require CipherStash secrets | |
| uses: ./.github/actions/require-cs-secrets | |
| with: | |
| workspace-crn: ${{ vars.CS_WORKSPACE_CRN }} | |
| client-id: ${{ vars.CS_CLIENT_ID }} | |
| client-key: ${{ secrets.CS_CLIENT_KEY }} | |
| client-access-key: ${{ secrets.CS_CLIENT_ACCESS_KEY }} | |
| # The walkthrough encrypts against the live service, so it needs the | |
| # native binding — `packages/protect-ffi` is a workspace package now, so | |
| # `index.node` is a build output rather than tarball contents. This step | |
| # runs on push to main and on any PR whose diff matches the paths filter | |
| # above, the absorption PR that introduced the need included: that PR | |
| # edits this workflow, the build action, and the package itself, and all | |
| # three are in the filter. The exception is a fork PR — it triggers the | |
| # workflow, but the job's `if` skips it for want of CS_* credentials. | |
| - name: Build the protect-ffi binding | |
| uses: ./.github/actions/build-ffi-binding | |
| # Build via turbo so `^build` on `@cipherstash/stack-prisma` and | |
| # its `@cipherstash/stack` peer is honoured. The test's | |
| # `pnpm install` subprocess inside `examples/prisma/` is a no-op | |
| # given the lockfile is already in steady state from this step. | |
| - name: Build @cipherstash/stack-prisma | |
| run: pnpm exec turbo run build --filter @cipherstash/stack-prisma | |
| - name: Run README walkthrough e2e | |
| run: pnpm exec turbo run test:e2e --filter @cipherstash/e2e -- --run tests/prisma-example-readme.e2e.test.ts | |
| - name: Tear down bundled Postgres (best-effort) | |
| if: always() | |
| working-directory: examples/prisma | |
| run: docker compose down -v || true |