From b65fe9082d461fd04312b8dfd1ddb083149b4476 Mon Sep 17 00:00:00 2001 From: mvm Date: Mon, 20 Jul 2026 13:35:02 -0500 Subject: [PATCH 1/5] ci: skip docs CI for flue-only PRs, add Flue CI workflow --- .github/workflows/ci.yml | 2 + .github/workflows/flue-ci.yml | 72 +++++++++++++++++++++++++++++++++++ 2 files changed, 74 insertions(+) create mode 100644 .github/workflows/flue-ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 47f6142161c..ead17da98de 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,8 @@ on: pull_request: branches: - production + paths-ignore: + - ".flue/**" concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} diff --git a/.github/workflows/flue-ci.yml b/.github/workflows/flue-ci.yml new file mode 100644 index 00000000000..c4766d05316 --- /dev/null +++ b/.github/workflows/flue-ci.yml @@ -0,0 +1,72 @@ +name: Flue CI + +on: + pull_request: + branches: + - production + paths: + - ".flue/**" + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + pre-build: + name: Pre Build + runs-on: ubuntu-latest + steps: + - name: Check out repo + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Set up pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 11 + + - name: Set up node + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + with: + node-version: 24.x + + - name: Install node_modules + run: pnpm install --frozen-lockfile + working-directory: .flue + + - name: Typecheck + run: pnpm run typecheck + working-directory: .flue + + build: + name: Build + needs: pre-build + runs-on: ubuntu-latest + steps: + - name: Check out repo + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: Set up pnpm + uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5 + with: + version: 11 + + - name: Set up node + uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 + with: + node-version: 24.x + + - name: Install node_modules + run: pnpm install --frozen-lockfile + working-directory: .flue + + - name: Build + run: pnpm run build + working-directory: .flue + + post-build: + name: Post Build + needs: build + runs-on: ubuntu-latest + steps: + - name: No post-build checks yet + run: echo "No post-build checks for flue yet." From 7659a2910566e02ce6247a44fb20c5ad2e4804fd Mon Sep 17 00:00:00 2001 From: mvm Date: Mon, 20 Jul 2026 13:37:32 -0500 Subject: [PATCH 2/5] ci: add permissions block to flue-ci.yml --- .github/workflows/flue-ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/flue-ci.yml b/.github/workflows/flue-ci.yml index c4766d05316..6d63fde99de 100644 --- a/.github/workflows/flue-ci.yml +++ b/.github/workflows/flue-ci.yml @@ -11,6 +11,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: pre-build: name: Pre Build From e69de8e788f07a885b7ddb52522e6b4dc2b78983 Mon Sep 17 00:00:00 2001 From: vance Date: Mon, 20 Jul 2026 13:38:33 -0500 Subject: [PATCH 3/5] Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .github/workflows/flue-ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/flue-ci.yml b/.github/workflows/flue-ci.yml index 6d63fde99de..000e3d0d308 100644 --- a/.github/workflows/flue-ci.yml +++ b/.github/workflows/flue-ci.yml @@ -7,6 +7,9 @@ on: paths: - ".flue/**" +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true From 90d99aa4f9a98f4f223a291c4ffca27ee00615a9 Mon Sep 17 00:00:00 2001 From: mvm Date: Mon, 20 Jul 2026 13:44:05 -0500 Subject: [PATCH 4/5] ci: remove duplicate permissions block in flue-ci.yml --- .github/workflows/flue-ci.yml | 3 --- 1 file changed, 3 deletions(-) diff --git a/.github/workflows/flue-ci.yml b/.github/workflows/flue-ci.yml index 000e3d0d308..f023b018897 100644 --- a/.github/workflows/flue-ci.yml +++ b/.github/workflows/flue-ci.yml @@ -14,9 +14,6 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true -permissions: - contents: read - jobs: pre-build: name: Pre Build From a2ff0adbdc42be3569e655c110144312da8b5f93 Mon Sep 17 00:00:00 2001 From: mvm Date: Mon, 20 Jul 2026 14:03:04 -0500 Subject: [PATCH 5/5] ci: cache pnpm store in flue-ci.yml to avoid redundant installs --- .github/workflows/flue-ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/flue-ci.yml b/.github/workflows/flue-ci.yml index f023b018897..6ca8eb3f985 100644 --- a/.github/workflows/flue-ci.yml +++ b/.github/workflows/flue-ci.yml @@ -31,6 +31,8 @@ jobs: uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: 24.x + cache: pnpm + cache-dependency-path: .flue/pnpm-lock.yaml - name: Install node_modules run: pnpm install --frozen-lockfile @@ -57,6 +59,8 @@ jobs: uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6 with: node-version: 24.x + cache: pnpm + cache-dependency-path: .flue/pnpm-lock.yaml - name: Install node_modules run: pnpm install --frozen-lockfile