Say Pearl where the e2e suite and comments still claimed a retired de… #837
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Frontend main-push gate | |
| # Production deploys happen via Netlify's NATIVE Git integration (netlify.toml → | |
| # `npm run build`, publish frontend/dist): it applies the SPA fallback, the | |
| # CSP/security headers, and the Clerk auth proxy. The old Actions deploy job | |
| # (nwtgck/actions-netlify) bypassed all three, was hard-disabled 2026-06-25, and | |
| # was REMOVED 2026-07-11 — it sat one deleted `if:` line from re-arming against | |
| # prod. This workflow is now purely the push-to-main CI gate for frontend/**. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'frontend/**' | |
| - '.github/workflows/deploy-frontend.yml' | |
| concurrency: | |
| group: deploy-frontend | |
| cancel-in-progress: false | |
| jobs: | |
| ci-frontend: | |
| name: Frontend CI Gate | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: 'npm' | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install | |
| run: npm ci --ignore-scripts | |
| - name: Type check | |
| run: npx tsc --noEmit | |
| - name: Lint | |
| run: npm run lint | |
| # Mirrors ci.yml's A9/E8 safety gate — the deploy path previously skipped | |
| # it, so a fund-unsafe feature flag could ship via a direct push to main | |
| # (deploy-frontend and ci run independently). Keep in sync with ci.yml; | |
| # longer-term this duplication should collapse into a reusable workflow | |
| # (see PR notes). | |
| - name: "Safety gate: AAA feature flags (A9/E8)" | |
| working-directory: . | |
| run: | | |
| FAIL=0 | |
| for FLAG in VITE_ENABLE_TREASURY_SPEND VITE_ENABLE_AGENT_CREDITS; do | |
| VALUE=$(grep "^${FLAG}=" .env.example | cut -d= -f2 || true) | |
| if [ "$VALUE" = "true" ]; then | |
| echo "::error::SAFETY GATE FAILED — ${FLAG}=true in .env.example. This flag gates a feature with incomplete on-chain enforcement." | |
| FAIL=1 | |
| fi | |
| done | |
| if [ "$FAIL" = "1" ]; then exit 1; fi | |
| echo "✅ All safety-gated feature flags are disabled in .env.example" | |
| - name: Test | |
| run: npm test -- --run | |
| - name: Build | |
| run: npm run build | |
| - name: Check bundle size | |
| run: | | |
| MAIN_CHUNK=$(find dist/assets -name 'index-*.js' ! -name '*.map' -exec wc -c {} + | tail -1 | awk '{print $1}') | |
| MAIN_KB=$((MAIN_CHUNK / 1024)) | |
| echo "Main chunk: ${MAIN_KB}KB" | |
| if [ "$MAIN_KB" -gt 600 ]; then | |
| echo "::error::Main chunk ${MAIN_KB}KB exceeds 600KB budget" | |
| exit 1 | |
| fi | |
| - name: Security audit | |
| run: npm run audit:ci |