Enhance Security in modularRedirect #317
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Chromatic Deployment" | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| types: [opened, synchronize, ready_for_review] | |
| branches: [main] | |
| concurrency: | |
| group: chromatic-deployment-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| check_conditions: | |
| name: "Check Conditions" | |
| runs-on: ubuntu-latest | |
| outputs: | |
| should_run: ${{ steps.set_output.outputs.should_run }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Determine if deployment should proceed | |
| id: set_output | |
| run: | | |
| should_run=true | |
| if [[ "${{ github.event_name }}" == "pull_request" && "${{ github.event.pull_request.draft }}" == "true" ]]; then | |
| echo "Not deploying. It is a draft pull request." | |
| should_run=false | |
| else | |
| echo "Deploying. It is a non-draft pull request." | |
| fi | |
| echo "should_run=${should_run}" >> $GITHUB_OUTPUT | |
| deploy_chromatic: | |
| name: "Run Chromatic" | |
| runs-on: ubuntu-latest | |
| needs: check_conditions | |
| if: needs.check_conditions.outputs.should_run == 'true' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install pnpm | |
| uses: pnpm/action-setup@v4 | |
| with: | |
| version: 9 | |
| run_install: false | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: ".nvmrc" | |
| cache: "pnpm" | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile # Install dependencies with lockfile's versions to ensure consistency | |
| - name: Cache Build | |
| id: cache-build | |
| uses: actions/cache@v4 | |
| with: | |
| path: dist | |
| key: ${{ runner.os }}-build-${{ hashFiles('**/*.ts', '**/*.tsx', '**/*.mdx') }} # Cache key based on OS and file hashes | |
| restore-keys: | | |
| ${{ runner.os }}-build- | |
| - name: Build | |
| if: steps.cache-build.outputs.cache-hit != 'true' | |
| run: pnpm build | |
| - uses: chromaui/action@v11 | |
| with: | |
| projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| diagnostics: true | |
| exitZeroOnChanges: true |