From 9d9890f45f6f6ed0f22448f4ba9bf22b6fab5f79 Mon Sep 17 00:00:00 2001 From: DMV Throwers Yoyo Club Date: Fri, 23 Oct 2026 10:08:29 -0400 Subject: [PATCH 1/2] Remove inert OSV-Scanner copy (broken v1.7.1; nothing to scan in this repo) --- .github/workflows/osv-scanner.yml | 48 ------------------------------- 1 file changed, 48 deletions(-) delete mode 100644 .github/workflows/osv-scanner.yml diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml deleted file mode 100644 index 2083ea4..0000000 --- a/.github/workflows/osv-scanner.yml +++ /dev/null @@ -1,48 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities, -# in addition to a PR check which fails if new vulnerabilities are introduced. -# -# For more examples and options, including how to ignore specific vulnerabilities, -# see https://google.github.io/osv-scanner/github-action/ - -name: OSV-Scanner - -on: - pull_request: - branches: [ "main" ] - merge_group: - branches: [ "main" ] - schedule: - - cron: '45 6 * * 6' - push: - branches: [ "main" ] - -permissions: - # Require writing security events to upload SARIF file to security tab - security-events: write - # Read commit contents - contents: read - -jobs: - scan-scheduled: - if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@1f1242919d8a60496dd1874b24b62b2370ed4c78" # v1.7.1 - with: - # Example of specifying custom arguments - scan-args: |- - -r - --skip-git - ./ - scan-pr: - if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@1f1242919d8a60496dd1874b24b62b2370ed4c78" # v1.7.1 - with: - # Example of specifying custom arguments - scan-args: |- - -r - --skip-git - ./ From 1521afbac1fc1d52ea2e545d96a1fc3ce8894512 Mon Sep 17 00:00:00 2001 From: DMV Throwers Yoyo Club Date: Fri, 23 Oct 2026 16:08:04 -0400 Subject: [PATCH 2/2] Remove broken copied CI workflow (expects pnpm-lock.yaml, copied from yoyo-player-map) --- .github/workflows/ci.yml | 141 --------------------------------------- 1 file changed, 141 deletions(-) delete mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index 5b104e3..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,141 +0,0 @@ -name: CI - -on: - pull_request: - branches: [main] - push: - branches: [main] - -permissions: - contents: read - -# Cancel any in-flight run for the same ref when a new commit is pushed, -# so stale checks don't queue up and waste runner minutes. -concurrency: - group: ci-${{ github.ref }} - cancel-in-progress: true - -jobs: - # ── Workspace packages (lib/*, artifacts/*, scripts) ───────────────────── - check-workspace: - name: Workspace — Typecheck & Audit - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v4 - - - uses: pnpm/action-setup@v4 - with: - version: 10 - - - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: pnpm - cache-dependency-path: pnpm-lock.yaml - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - - name: Typecheck (libs + artifacts + scripts) - run: pnpm typecheck - - - name: Security audit - # --audit-level=high fails only on high/critical; low/moderate are informational. - run: pnpm audit --audit-level=high - continue-on-error: false - - # ── yoyomap app: typecheck + lint ──────────────────────────────────────── - typecheck-and-lint: - name: Typecheck & Lint (yoyomap) - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v6 - - - uses: pnpm/action-setup@v6 - with: - version: 10 - - - uses: actions/setup-node@v6 - with: - node-version: 20 - # yoyomap/ is a standalone app with its own lockfile — cache against it. - cache: pnpm - cache-dependency-path: yoyomap/pnpm-lock.yaml - - - name: Install dependencies - working-directory: yoyomap - # --ignore-workspace prevents pnpm from picking up the parent - # pnpm-workspace.yaml and using the root lockfile instead of - # yoyomap/pnpm-lock.yaml (yoyomap is a standalone app, not a - # workspace member). - run: pnpm install --frozen-lockfile --ignore-workspace - - - name: Typecheck - working-directory: yoyomap - run: pnpm exec tsc --noEmit - - - name: Lint - working-directory: yoyomap - run: pnpm lint - - - name: Security audit - working-directory: yoyomap - run: pnpm audit --audit-level=high --ignore-workspace - continue-on-error: false - # ── yoyomap app: next build ─────────────────────────────────────────────────── - build: - name: Build (yoyomap) - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v6 - - - uses: pnpm/action-setup@v6 - with: - version: 10 - - - uses: actions/setup-node@v6 - with: - node-version: 20 - cache: pnpm - cache-dependency-path: yoyomap/pnpm-lock.yaml - - - name: Install dependencies - working-directory: yoyomap - run: pnpm install --frozen-lockfile --ignore-workspace - - - name: Build - working-directory: yoyomap - # Stub the two NEXT_PUBLIC_* vars required at build-time for bundle - # inlining. Runtime-only secrets (service role key, Resend key, etc.) - # are never needed during a build. - env: - NEXT_PUBLIC_SUPABASE_URL: https://placeholder.supabase.co - NEXT_PUBLIC_SUPABASE_ANON_KEY: placeholder-anon-key - run: pnpm build - - # ── root workspace: typecheck libs / artifacts / scripts ───────────────────── - workspace-typecheck: - name: Typecheck (workspace) - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v6 - - - uses: pnpm/action-setup@v6 - with: - version: 10 - - - uses: actions/setup-node@v6 - with: - node-version: 20 - cache: pnpm - cache-dependency-path: pnpm-lock.yaml - - - name: Install dependencies - run: pnpm install --frozen-lockfile - - - name: Typecheck - run: pnpm typecheck