From 205a2133ae07e212b6384bb88cec9b4bb729362b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robson=20J=C3=BAnior?= Date: Sun, 26 Jul 2026 18:27:33 -0300 Subject: [PATCH 1/5] [NO-ISSUE] ci: align governance gates with local scripts and pin Node 24 --- .github/workflows/app-icons-gallery.yml | 2 +- .github/workflows/app-storybook-dev.yml | 2 +- .../app-storybook-generate-baseline.yml | 2 +- .github/workflows/app-storybook.yml | 2 +- .github/workflows/governance.yml | 35 +++++++++---------- .github/workflows/package-icons.yml | 2 +- .github/workflows/package-theme.yml | 2 +- .github/workflows/package-webkit.yml | 2 +- .nvmrc | 1 + .stylelintrc.json | 8 +++++ package.json | 13 ++++--- packages/webkit/package.json | 4 +-- 12 files changed, 42 insertions(+), 33 deletions(-) create mode 100644 .nvmrc diff --git a/.github/workflows/app-icons-gallery.yml b/.github/workflows/app-icons-gallery.yml index 722f31eed..aff3bcf6d 100644 --- a/.github/workflows/app-icons-gallery.yml +++ b/.github/workflows/app-icons-gallery.yml @@ -27,7 +27,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' registry-url: 'https://registry.npmjs.org' - name: Setup pnpm diff --git a/.github/workflows/app-storybook-dev.yml b/.github/workflows/app-storybook-dev.yml index ee4306302..3cd71b406 100644 --- a/.github/workflows/app-storybook-dev.yml +++ b/.github/workflows/app-storybook-dev.yml @@ -27,7 +27,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' registry-url: 'https://registry.npmjs.org' - name: Setup pnpm diff --git a/.github/workflows/app-storybook-generate-baseline.yml b/.github/workflows/app-storybook-generate-baseline.yml index ff38050dc..65bec1f08 100644 --- a/.github/workflows/app-storybook-generate-baseline.yml +++ b/.github/workflows/app-storybook-generate-baseline.yml @@ -33,7 +33,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies diff --git a/.github/workflows/app-storybook.yml b/.github/workflows/app-storybook.yml index a26e82b58..ef8030ad0 100644 --- a/.github/workflows/app-storybook.yml +++ b/.github/workflows/app-storybook.yml @@ -26,7 +26,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' registry-url: 'https://registry.npmjs.org' - name: Setup pnpm diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 75468aaf4..29bebafb0 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -71,15 +71,14 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies run: pnpm install --frozen-lockfile - name: Audit dependencies - run: pnpm audit - working-directory: packages/webkit + run: pnpm run security:audit - name: Run TruffleHog (secret detection) uses: trufflesecurity/trufflehog@38999f88bed87fce0861ac313cbca06267b439c7 # main @@ -107,7 +106,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies @@ -130,20 +129,20 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies run: pnpm install --frozen-lockfile - name: Run ESLint (zero warnings policy) - run: pnpm eslint packages/webkit/src --ext .js,.ts,.vue --max-warnings 0 + run: pnpm run webkit:lint - name: Run Stylelint - run: pnpm stylelint "packages/webkit/**/*.{css,scss,vue}" + run: pnpm run webkit:lint:style - name: Prettier check (fail on diff) - run: pnpm prettier --check "packages/webkit/**/*.{js,ts,vue,css,json,md}" + run: pnpm run webkit:format:check types: name: TypeScript & Type Coverage @@ -159,19 +158,17 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies run: pnpm install --frozen-lockfile - name: TypeScript check - run: pnpm type-check - working-directory: packages/webkit + run: pnpm run webkit:type-check - name: Type coverage (enforce 95% threshold) - run: npx type-coverage -p . --at-least 95 --detail - working-directory: packages/webkit + run: pnpm run webkit:type-coverage build: name: Build Verification @@ -187,7 +184,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies @@ -215,7 +212,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies @@ -243,7 +240,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies @@ -279,7 +276,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies @@ -306,7 +303,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies @@ -346,7 +343,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' cache: 'pnpm' - name: Install dependencies diff --git a/.github/workflows/package-icons.yml b/.github/workflows/package-icons.yml index d6ddd24f5..c04705ffa 100644 --- a/.github/workflows/package-icons.yml +++ b/.github/workflows/package-icons.yml @@ -50,7 +50,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' registry-url: 'https://registry.npmjs.org' - name: Setup pnpm diff --git a/.github/workflows/package-theme.yml b/.github/workflows/package-theme.yml index d863d61bd..900a5803d 100644 --- a/.github/workflows/package-theme.yml +++ b/.github/workflows/package-theme.yml @@ -50,7 +50,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' registry-url: 'https://registry.npmjs.org' - name: Setup pnpm diff --git a/.github/workflows/package-webkit.yml b/.github/workflows/package-webkit.yml index 08199661f..dec90817c 100644 --- a/.github/workflows/package-webkit.yml +++ b/.github/workflows/package-webkit.yml @@ -50,7 +50,7 @@ jobs: - name: Setup Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: - node-version: 'lts/*' + node-version-file: '.nvmrc' registry-url: 'https://registry.npmjs.org' - name: Setup pnpm diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 000000000..a45fd52cc --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +24 diff --git a/.stylelintrc.json b/.stylelintrc.json index dd95c4f22..b02d31f17 100644 --- a/.stylelintrc.json +++ b/.stylelintrc.json @@ -16,5 +16,13 @@ "value-no-vendor-prefix": [true, { "severity": "warning" }], "selector-max-id": 0 }, + "overrides": [ + { + "files": ["**/*.vue"], + "rules": { + "no-invalid-position-declaration": null + } + } + ], "ignoreFiles": ["**/dist/**", "**/node_modules/**", "**/coverage/**"] } diff --git a/package.json b/package.json index 20586d825..703890265 100644 --- a/package.json +++ b/package.json @@ -8,6 +8,9 @@ "url": "https://github.com/aziontech/webkit.git" }, "packageManager": "pnpm@11.9.0", + "engines": { + "node": ">=24" + }, "scripts": { "prepare": "husky", "icons:gallery:build": "pnpm --filter icons-gallery run build", @@ -31,18 +34,18 @@ "theme:format": "pnpm --filter theme run format", "webkit:lint": "pnpm --filter webkit lint", "webkit:lint:fix": "pnpm --filter webkit lint:fix", - "webkit:lint:style": "pnpm --filter webkit lint:style", - "webkit:lint:style:fix": "pnpm --filter webkit lint:style:fix", + "webkit:lint:style": "stylelint \"packages/webkit/**/*.{css,scss,vue}\"", + "webkit:lint:style:fix": "stylelint \"packages/webkit/**/*.{css,scss,vue}\" --fix", "webkit:type-check": "pnpm --filter webkit type-check", "webkit:type-coverage": "pnpm --filter webkit type-coverage", "webkit:test": "pnpm --filter webkit test", "webkit:test:coverage": "pnpm --filter webkit test:coverage", "webkit:test:watch": "pnpm --filter webkit test:watch", "webkit:test:ui": "pnpm --filter webkit test:ui", - "webkit:format": "pnpm --filter webkit format", - "webkit:format:check": "pnpm --filter webkit format:check", + "webkit:format": "prettier --write \"packages/webkit/**/*.{js,ts,vue,css,json,md}\"", + "webkit:format:check": "prettier --check \"packages/webkit/**/*.{js,ts,vue,css,json,md}\"", "security:audit": "pnpm audit", - "governance": "pnpm run webkit:lint && pnpm run webkit:type-check && pnpm run webkit:format:check && pnpm run security:audit" + "governance": "pnpm run webkit:lint && pnpm run webkit:lint:style && pnpm run webkit:format:check && pnpm run webkit:type-check && pnpm run webkit:type-coverage && pnpm run security:audit" }, "dependencies": { "@tailwindcss/typography": "^0.5.19", diff --git a/packages/webkit/package.json b/packages/webkit/package.json index 6663b2b0e..f4d870794 100644 --- a/packages/webkit/package.json +++ b/packages/webkit/package.json @@ -17,8 +17,8 @@ "pack:check": "! npm pack --dry-run 2>&1 | grep -E '\\.test\\.(ts|js)|src/test/'", "format": "prettier --write src/", "format:check": "prettier --check src/", - "lint": "eslint src --ext .js,.js,.vue --max-warnings 0", - "lint:fix": "eslint src --ext .js,.js,.vue --fix", + "lint": "eslint src --ext .js,.ts,.vue --max-warnings 0", + "lint:fix": "eslint src --ext .js,.ts,.vue --fix", "lint:style": "stylelint \"src/**/*.{css,scss,vue}\"", "lint:style:fix": "stylelint \"src/**/*.{css,scss,vue}\" --fix", "type-check": "vue-tsc --noEmit", From 6e68d8dcb09641e3814eb8d02898a262cb73e26e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robson=20J=C3=BAnior?= Date: Sun, 26 Jul 2026 18:43:46 -0300 Subject: [PATCH 2/5] [NO-ISSUE] ci: webkit owns package-wide format scripts; root re-aliases them --- package.json | 4 ++-- packages/webkit/.prettierignore | 3 +++ packages/webkit/package.json | 4 ++-- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/package.json b/package.json index 703890265..86cc867c0 100644 --- a/package.json +++ b/package.json @@ -42,8 +42,8 @@ "webkit:test:coverage": "pnpm --filter webkit test:coverage", "webkit:test:watch": "pnpm --filter webkit test:watch", "webkit:test:ui": "pnpm --filter webkit test:ui", - "webkit:format": "prettier --write \"packages/webkit/**/*.{js,ts,vue,css,json,md}\"", - "webkit:format:check": "prettier --check \"packages/webkit/**/*.{js,ts,vue,css,json,md}\"", + "webkit:format": "pnpm --filter webkit format", + "webkit:format:check": "pnpm --filter webkit format:check", "security:audit": "pnpm audit", "governance": "pnpm run webkit:lint && pnpm run webkit:lint:style && pnpm run webkit:format:check && pnpm run webkit:type-check && pnpm run webkit:type-coverage && pnpm run security:audit" }, diff --git a/packages/webkit/.prettierignore b/packages/webkit/.prettierignore index a7fc6f870..c143e5151 100644 --- a/packages/webkit/.prettierignore +++ b/packages/webkit/.prettierignore @@ -5,3 +5,6 @@ node_modules *.d.ts.map coverage storybook-static +# Generated by scripts/build-catalog.mjs — the generator is the single source of +# formatting; reformatting it fails `catalog:check` (mirrors root .prettierignore). +catalog.json diff --git a/packages/webkit/package.json b/packages/webkit/package.json index f4d870794..4971fe8d6 100644 --- a/packages/webkit/package.json +++ b/packages/webkit/package.json @@ -15,8 +15,8 @@ "scripts": { "clean": "rm -rf dist/", "pack:check": "! npm pack --dry-run 2>&1 | grep -E '\\.test\\.(ts|js)|src/test/'", - "format": "prettier --write src/", - "format:check": "prettier --check src/", + "format": "prettier --write \"**/*.{js,ts,vue,css,json,md}\"", + "format:check": "prettier --check \"**/*.{js,ts,vue,css,json,md}\"", "lint": "eslint src --ext .js,.ts,.vue --max-warnings 0", "lint:fix": "eslint src --ext .js,.ts,.vue --fix", "lint:style": "stylelint \"src/**/*.{css,scss,vue}\"", From 6868bc6902b2a726694d801d53fffe5a7d43e6e9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robson=20J=C3=BAnior?= Date: Sun, 26 Jul 2026 18:54:19 -0300 Subject: [PATCH 3/5] [NO-ISSUE] ci: delete dev storybook deploy workflow --- .github/workflows/app-storybook-dev.yml | 67 ------------------------- 1 file changed, 67 deletions(-) delete mode 100644 .github/workflows/app-storybook-dev.yml diff --git a/.github/workflows/app-storybook-dev.yml b/.github/workflows/app-storybook-dev.yml deleted file mode 100644 index 3cd71b406..000000000 --- a/.github/workflows/app-storybook-dev.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Deploy Application Storybook (dev) - -on: - push: - branches: - - dev - paths: - - 'apps/storybook/**' - - 'packages/webkit/**' - -permissions: {} - -jobs: - deploy: - name: Deploy - runs-on: ubuntu-latest - - permissions: - contents: read - - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - - - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version-file: '.nvmrc' - registry-url: 'https://registry.npmjs.org' - - - name: Setup pnpm - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 - - - name: Install workspace dependencies - run: pnpm install --frozen-lockfile - - - name: Install Azion CLI - run: | - curl -o azionlinux https://downloads.azion.com/linux/x86_64/azion - sudo mv azionlinux /usr/bin/azion - sudo chmod u+x /usr/bin/azion - - - name: CLI version - run: azion --version - - - name: Configure token - run: | - azion -t ${{ secrets.AZION_PERSONAL_TOKEN }} - azion whoami - - - name: Building Storybook - working-directory: apps/storybook - run: | - pnpm --filter @aziontech/icons build - pnpm build - - - name: Azion Build - working-directory: apps/storybook - run: | - azion build --debug - - - name: Azion Deploy - working-directory: apps/storybook - run: | - azion deploy --local --debug From 540cb8c1d685f102b4d51b60c102748fbf83436f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robson=20J=C3=BAnior?= Date: Sun, 26 Jul 2026 18:54:23 -0300 Subject: [PATCH 4/5] [NO-ISSUE] ci: add concurrency groups to governance and deploy workflows --- .github/workflows/app-icons-gallery.yml | 6 ++++++ .github/workflows/app-storybook.yml | 6 ++++++ .github/workflows/governance.yml | 7 +++++++ 3 files changed, 19 insertions(+) diff --git a/.github/workflows/app-icons-gallery.yml b/.github/workflows/app-icons-gallery.yml index aff3bcf6d..ed4412577 100644 --- a/.github/workflows/app-icons-gallery.yml +++ b/.github/workflows/app-icons-gallery.yml @@ -10,6 +10,12 @@ on: permissions: {} +# Never run two deploys at once; a queued run is replaced by a newer one, +# and an in-flight azion deploy is never cancelled mid-way. +concurrency: + group: deploy-icons-gallery + cancel-in-progress: false + jobs: deploy: name: Deploy diff --git a/.github/workflows/app-storybook.yml b/.github/workflows/app-storybook.yml index ef8030ad0..97c117c2d 100644 --- a/.github/workflows/app-storybook.yml +++ b/.github/workflows/app-storybook.yml @@ -9,6 +9,12 @@ on: permissions: {} +# Never run two deploys at once; a queued run is replaced by a newer one, +# and an in-flight azion deploy is never cancelled mid-way. +concurrency: + group: deploy-storybook + cancel-in-progress: false + jobs: deploy: name: Deploy diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index 29bebafb0..dc383c097 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -10,6 +10,13 @@ permissions: contents: read pull-requests: read +# Cancel superseded runs on the same PR (a new push obsoletes the old run's +# 8 Playwright-sharded jobs); pushes to main/dev queue instead, so every +# landed commit keeps its own complete status. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: changes: name: Detect Changes From e4596c0c4b69c5d67f12dc3f5c55315412954d81 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robson=20J=C3=BAnior?= Date: Sun, 26 Jul 2026 18:55:40 -0300 Subject: [PATCH 5/5] [NO-ISSUE] ci: drop dev branch from governance triggers --- .github/workflows/governance.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml index dc383c097..9242ed554 100644 --- a/.github/workflows/governance.yml +++ b/.github/workflows/governance.yml @@ -2,16 +2,16 @@ name: Governance Pipeline on: pull_request: - branches: [main, dev] + branches: [main] push: - branches: [main, dev] + branches: [main] permissions: contents: read pull-requests: read # Cancel superseded runs on the same PR (a new push obsoletes the old run's -# 8 Playwright-sharded jobs); pushes to main/dev queue instead, so every +# 8 Playwright-sharded jobs); pushes to main queue instead, so every # landed commit keeps its own complete status. concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}