diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f116aa4..70072f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -157,15 +157,16 @@ jobs: name: Publish preview runs-on: ubuntu-latest needs: test - # Opened, synchronize and reopened runs publish on a feat/fix branch or with `preview`; a label run only when it - # adds `preview` to any other branch. + # A feat/fix branch publishes on opened, synchronize and reopened. Any other branch publishes from the label run + # that adds `preview` (a PR opened with it gets one too), then on synchronize and reopened while it has it. if: >- - ${{ (github.event.action == 'labeled' + ${{ (github.event.action != 'labeled' + && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix'))) + || (github.event.action == 'labeled' && github.event.label.name == 'preview' && !startsWith(github.head_ref, 'feat') && !startsWith(github.head_ref, 'fix')) - || (github.event.action != 'labeled' - && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix') - || contains(github.event.pull_request.labels.*.name, 'preview'))) }} + || ((github.event.action == 'synchronize' || github.event.action == 'reopened') + && contains(github.event.pull_request.labels.*.name, 'preview')) }} # One publish to `pr-` at a time: label runs don't share the workflow's group. concurrency: group: ${{ github.workflow }}-preview-${{ github.ref }} diff --git a/docs/development.md b/docs/development.md index 4e62a8b..b855a5f 100644 --- a/docs/development.md +++ b/docs/development.md @@ -51,7 +51,7 @@ In the repo, `pnpm rr` and `pnpm vland`, or `rr` and `vland` with mise, run each ## CI -- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools with [mise-action](https://github.com/jdx/mise-action), then runs `pnpm install --frozen-lockfile`, `pnpm rr check`, `pnpm test` and `pnpm build`, once on the Node floor in `mise.floor.toml` and once on the version in `mise.toml`. Beside them, gitleaks scans the pull request's commits for secrets. The required `Test` check passes when all three do. Adding a label runs CI again, and labels added at once don't cancel one another's runs. Of those runs, only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview. Workflow audit runs [zizmor](https://docs.zizmor.sh) on every workflow in the repo, including those the vland templates generate. +- **On each pull request to `main`:** CI sets up mise 2026.10.19 and the locked tools with [mise-action](https://github.com/jdx/mise-action), then runs `pnpm install --frozen-lockfile`, `pnpm rr check`, `pnpm test` and `pnpm build`, once on the Node floor in `mise.floor.toml` and once on the version in `mise.toml`. Beside them, gitleaks scans the pull request's commits for secrets. The required `Test` check passes when all three do. Adding a label runs CI again, and labels added at once don't cancel one another's runs. Of those runs, only one that adds `preview` to a branch other than `feat/*` or `fix/*` publishes a preview, and a pull request opened on such a branch with `preview` publishes from its label run, not its `opened` run. Workflow audit runs [zizmor](https://docs.zizmor.sh) on every workflow in the repo, including those the vland templates generate. - **Git hooks** ([lefthook](https://lefthook.dev)): `lefthook.yml` extends the two configs that `@rrlab/cli` ships, `run-run/cli/lefthook/base.yml` and `run-run/cli/lefthook/turborepo.yml`, and its own `shared-hooks` job fails a commit, saying to run `pnpm install`, when they are missing from `node_modules`. Their jobs are listed in [the cli's README](../run-run/cli/README.md#git-hooks). `lefthook/turborepo.yml` is not dx's: it holds the hooks that other repos fetch remotely. - **Every Monday:** `pnpm audit` on the lockfile, which keeps an issue labeled `dependency-audit` open while it finds known vulnerabilities (Dependency audit).