From 9cc1a89e54b9a1df66b3cd6648d6c3cc6a0e00a5 Mon Sep 17 00:00:00 2001 From: Srthk Pthk Date: Fri, 28 Aug 2026 14:44:39 +0530 Subject: [PATCH 1/2] ci: Gate every push and PR on tests and the maximum pub.dev score Add a GitHub Actions workflow with two jobs: - test: dart format --set-exit-if-changed, dart analyze --fatal-infos, dart test --exclude-tags live, and a check that the committed json_serializable output matches a fresh build_runner run - score: run pana with --json, write the per-section breakdown to the job summary, upload the report as an artifact, and fail unless grantedPoints equals maxPoints Add the CI badge to the README and document the gate in CLAUDE.md. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 49 ++++++++++++++++++++++++++++++++++++++++ CLAUDE.md | 1 + README.md | 1 + 3 files changed, 51 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..2036acf --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,49 @@ +name: CI + +on: + push: + branches: [master] + pull_request: + +jobs: + test: + name: Format, analyze, test + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: dart-lang/setup-dart@v1 + with: + sdk: stable + - run: dart pub get + - run: dart format --output=none --set-exit-if-changed . + - run: dart analyze --fatal-infos + - run: dart test --exclude-tags live + - name: Generated code is committed and current + run: | + dart run build_runner build + dart format lib/src/models + git diff --exit-code -- lib/src/models + + score: + name: pub.dev score (pana) + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: dart-lang/setup-dart@v1 + with: + sdk: stable + - run: dart pub global activate pana + - name: Run pana and require the maximum score + run: | + dart pub global run pana --json --no-warning . > pana.json + granted=$(jq -r '.scores.grantedPoints' pana.json) + max=$(jq -r '.scores.maxPoints' pana.json) + echo "## pub.dev score: $granted / $max" >> "$GITHUB_STEP_SUMMARY" + jq -r '.report.sections[] | "- \(.title): \(.grantedPoints)/\(.maxPoints)"' pana.json >> "$GITHUB_STEP_SUMMARY" + jq -r '.report.sections[] | select(.grantedPoints < .maxPoints) | .summary' pana.json + test "$granted" -eq "$max" + - uses: actions/upload-artifact@v4 + if: always() + with: + name: pana-report + path: pana.json diff --git a/CLAUDE.md b/CLAUDE.md index 05ab88d..3aaa5bb 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -21,6 +21,7 @@ dart pub publish --dry-run # pana/publish validation ``` Notes: +- `.github/workflows/ci.yml` runs on every push/PR: format, `analyze --fatal-infos`, `test --exclude-tags live`, a check that the committed `*.g.dart` match a fresh `build_runner build`, and `pana`, which **fails unless the score is the maximum** (currently 160/160). Run `dart pub global run pana --no-warning .` locally to reproduce. - `build_runner` ≥ 2.15 removed `--delete-conflicting-outputs`; passing it prints a warning and is ignored. - `pubspec.lock` is intentionally untracked (library package). - `spec/`, `build.yaml`, `CLAUDE.md`, `.serena/` and `.metadata` are excluded from the pub tarball via `.pubignore`. diff --git a/README.md b/README.md index f96b4c0..0365158 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,7 @@ # Splitwise API for Dart [![pub package](https://img.shields.io/pub/v/splitwise_api.svg)](https://pub.dev/packages/splitwise_api) +[![CI](https://github.com/srthkpthk/splitwise_api/actions/workflows/ci.yml/badge.svg)](https://github.com/srthkpthk/splitwise_api/actions/workflows/ci.yml) [![License](https://img.shields.io/badge/license-MIT-orange.svg)](https://github.com/srthkpthk/splitwise_api/blob/master/LICENSE) ![GitHub stars](https://img.shields.io/github/stars/srthkpthk/splitwise_api) From 7e8ab6ddf64cfe1ff4868d437a12a364bcd6ff75 Mon Sep 17 00:00:00 2001 From: Srthk Pthk Date: Fri, 28 Aug 2026 14:48:17 +0530 Subject: [PATCH 2/2] ci: Pin actions to commit SHAs and drop the token to read-only Reference actions/checkout, dart-lang/setup-dart and actions/upload-artifact by full commit SHA (tag noted in a comment) so a moved upstream tag cannot change what the workflow executes, and set `permissions: contents: read` since neither job writes to the repo. Co-Authored-By: Claude Fable 5 --- .github/workflows/ci.yml | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2036acf..9001bf8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,13 +5,18 @@ on: branches: [master] pull_request: +# Actions are pinned to full commit SHAs (tag shown in the comment) so an +# upstream tag move cannot change what runs here. +permissions: + contents: read + jobs: test: name: Format, analyze, test runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dart-lang/setup-dart@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1 with: sdk: stable - run: dart pub get @@ -28,8 +33,8 @@ jobs: name: pub.dev score (pana) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 - - uses: dart-lang/setup-dart@v1 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + - uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1 with: sdk: stable - run: dart pub global activate pana @@ -38,11 +43,12 @@ jobs: dart pub global run pana --json --no-warning . > pana.json granted=$(jq -r '.scores.grantedPoints' pana.json) max=$(jq -r '.scores.maxPoints' pana.json) + echo "pub.dev score: $granted / $max" echo "## pub.dev score: $granted / $max" >> "$GITHUB_STEP_SUMMARY" jq -r '.report.sections[] | "- \(.title): \(.grantedPoints)/\(.maxPoints)"' pana.json >> "$GITHUB_STEP_SUMMARY" jq -r '.report.sections[] | select(.grantedPoints < .maxPoints) | .summary' pana.json test "$granted" -eq "$max" - - uses: actions/upload-artifact@v4 + - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 if: always() with: name: pana-report