ci: add GitHub Actions pipeline with lint, typecheck, build, audit, SBOM - #4
ci: add GitHub Actions pipeline with lint, typecheck, build, audit, SBOM#4isaJrKai wants to merge 1 commit into
Conversation
Adds .github/workflows/ci.yml with 3 parallel jobs: 1. quality — npm ci, prisma generate, tsc --noEmit, eslint, next build 2. security-audit — npm audit, fails on high/critical CVEs 3. generate-sbom — generates CycloneDX SBOM, uploads as artifact (30-day retention) Also adds npm run sbom script to package.json for local SBOM generation. All jobs run on PRs to main and on pushes to main. Build uses placeholder env vars (DATABASE_URL, JWT_SECRET) so next build can complete without a real database — the build step validates that the app compiles, not that it can connect to a DB.
|
Warning Review limit reached
More reviews will be available in 28 minutes and 3 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
What this adds
A GitHub Actions CI pipeline that runs on every PR to
mainand every push tomain. Three parallel jobs:Job 1:
quality(lint + typecheck + build)npm ci— reproducible install from lockfilenpx prisma generate— generate Prisma clientnpx tsc --noEmit— TypeScript type checkingnpm run lint— ESLintnpm run build— Next.js production build (with placeholder env vars)Job 2:
security-auditnpm audit --audit-level=high --omit=dev— fails on high/critical CVEsJob 3:
generate-sbomsbom.cdx.json)Also adds
npm run sbomscript inpackage.jsonfor local SBOM generationFiles changed
.github/workflows/ci.yml(new) — 3-job CI pipelinepackage.json— addedsbomscriptVercel env vars
None needed. The CI pipeline uses placeholder env vars for the build step.
Deployment risk
Zero. This only adds CI checks — it doesn't change the deployed app at all. If a CI check fails on an existing PR, that's a signal the PR needs fixing before merge.
Notes
qualityjob uses placeholder env vars (DATABASE_URL=postgresql://placeholder...,JWT_SECRET=ci-placeholder-...) sonext buildcan complete without a real database. The build validates compilation, not DB connectivity.security-auditjob uses--omit=devto only check production dependencies. Dev dependencies (eslint, etc.) are not deployed.@cyclonedx/cyclonedx-npm, the standard tool for npm SBOM generation.