mirror of
https://github.com/neondatabase/agent-skills.git
synced 2026-09-14 19:07:52 +08:00
Andre Landgraf
42cd370daf
Fork pull requests cannot mint an OIDC token, so they stay on ubuntu-latest and the public registry. Same-repo runs install through the Databricks npm mirror, which is what the group can reach.
88 lines
2.7 KiB
YAML
88 lines
2.7 KiB
YAML
name: Validate
|
|
|
|
# Skill and plugin validation, covering the root Agent Plugins v1 package and
|
|
# the Claude/Cursor packaging under plugins/. Supply-chain hardened: SHA-pinned
|
|
# actions, npm ci --ignore-scripts from package-lock.json, harden-runner egress
|
|
# audit. Keep aligned with neondatabase/neon-for-agent-platforms — see AGENTS.md.
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- 'skills/**'
|
|
- 'plugins/**'
|
|
- 'scripts/**'
|
|
- 'plugin.json'
|
|
- 'mcp.json'
|
|
- 'kimi.plugin.json'
|
|
- '.claude-plugin/**'
|
|
- '.cursor-plugin/**'
|
|
- 'package.json'
|
|
- 'package-lock.json'
|
|
- '.github/workflows/validate.yml'
|
|
- '.github/dependabot.yml'
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- 'skills/**'
|
|
- 'plugins/**'
|
|
- 'scripts/**'
|
|
- 'plugin.json'
|
|
- 'mcp.json'
|
|
- 'kimi.plugin.json'
|
|
- '.claude-plugin/**'
|
|
- '.cursor-plugin/**'
|
|
- 'package.json'
|
|
- 'package-lock.json'
|
|
- '.github/workflows/validate.yml'
|
|
- '.github/dependabot.yml'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
jobs:
|
|
validate:
|
|
name: Validate
|
|
# Fork PRs cannot mint OIDC tokens, and the protected group cannot reach npmjs.
|
|
runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || fromJSON('{"group":"neondatabase-protected-runner-group","labels":"linux-ubuntu-latest"}') }}
|
|
steps:
|
|
- name: Harden the runner (Audit all outbound calls)
|
|
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Check out repository
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: Setup JFrog CLI with OIDC
|
|
if: ${{ !github.event.pull_request.head.repo.fork }}
|
|
id: setup-jfrog
|
|
uses: jfrog/setup-jfrog-cli@279b1f629f43dd5bc658d8361ac4802a7ef8d2d5 # v4.9.1
|
|
env:
|
|
JF_URL: https://databricks.jfrog.io
|
|
with:
|
|
oidc-provider-name: github-actions
|
|
|
|
- name: Configure npm registry (Databricks JFrog mirror)
|
|
if: ${{ !github.event.pull_request.head.repo.fork }}
|
|
run: |
|
|
cat > ~/.npmrc <<EOF
|
|
registry=https://databricks.jfrog.io/artifactory/api/npm/db-npm/
|
|
//databricks.jfrog.io/artifactory/api/npm/db-npm/:_authToken=${{ steps.setup-jfrog.outputs.oidc-token }}
|
|
always-auth=true
|
|
EOF
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
|
|
with:
|
|
node-version: "20"
|
|
cache: "npm"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci --ignore-scripts
|
|
|
|
- name: Run validation
|
|
run: npm run validate:ci
|