also looking at this
ci: dogfood the checked-out source, and smoke the PR's own CLI without secrets
#1445
2 files
+51
-9
| @@ -1,5 +1,8 @@ | ||
| 1 | 1 | name: Buddy |
| 2 | 2 | |
| 3 | # Dogfood: every job runs the checked-out source (bun ./bin/cli.ts), never the | |
| 4 | # published package — merged changes are exercised by the next scheduled run. | |
| 5 | ||
| 3 | 6 | on: |
| 4 | 7 | # Rebase checkbox: fires instantly when a PR body is edited (e.g. checkbox ticked). |
| 5 | 8 | # No polling needed — this replaces the old every-minute cron for rebase detection. |
| @@ -155,6 +158,10 @@ jobs: | ||
| 155 | 158 | with: |
| 156 | 159 | token: ${{ secrets.GITHUB_TOKEN }} |
| 157 | 160 | fetch-depth: 0 # Fetch full history for rebasing |
| 161 | # Pinned: this job also runs on pull_request:edited, where the default | |
| 162 | # checkout is the PR merge commit — never run PR-modified code in a | |
| 163 | # job whose environment holds BUDDY_TOKEN. | |
| 164 | ref: main | |
| 158 | 165 | persist-credentials: true |
| 159 | 166 | |
| 160 | 167 | - name: Setup Bun |
| @@ -193,6 +200,10 @@ jobs: | ||
| 193 | 200 | with: |
| 194 | 201 | token: ${{ secrets.GITHUB_TOKEN }} |
| 195 | 202 | fetch-depth: 0 |
| 203 | # Pinned: this job also runs on pull_request:edited, where the default | |
| 204 | # checkout is the PR merge commit — never run PR-modified code in a | |
| 205 | # job whose environment holds BUDDY_TOKEN. | |
| 206 | ref: main | |
| 196 | 207 | persist-credentials: true |
| 197 | 208 | |
| 198 | 209 | - name: Setup Bun |
| @@ -233,10 +244,10 @@ jobs: | ||
| 233 | 244 | |
| 234 | 245 | if [ "$" = "true" ]; then |
| 235 | 246 | echo "📋 Running in DRY RUN mode..." |
| 236 | bunx @buddysh/buddy update-check --dry-run --verbose | |
| 247 | bun ./bin/cli.ts update-check --dry-run --verbose | |
| 237 | 248 | else |
| 238 | 249 | echo "🔄 Running in LIVE mode..." |
| 239 | bunx @buddysh/buddy update-check --verbose | |
| 250 | bun ./bin/cli.ts update-check --verbose | |
| 240 | 251 | fi |
| 241 | 252 | |
| 242 | 253 | env: |
| @@ -326,15 +337,15 @@ jobs: | ||
| 326 | 337 | |
| 327 | 338 | if [ "$PACKAGES" != "" ]; then |
| 328 | 339 | if [ "$VERBOSE" = "true" ]; then |
| 329 | bunx @buddysh/buddy update --packages "$PACKAGES" --verbose | |
| 340 | bun ./bin/cli.ts update --packages "$PACKAGES" --verbose | |
| 330 | 341 | else |
| 331 | bunx @buddysh/buddy update --packages "$PACKAGES" | |
| 342 | bun ./bin/cli.ts update --packages "$PACKAGES" | |
| 332 | 343 | fi |
| 333 | 344 | else |
| 334 | 345 | if [ "$VERBOSE" = "true" ]; then |
| 335 | bunx @buddysh/buddy update --strategy "$STRATEGY" --verbose | |
| 346 | bun ./bin/cli.ts update --strategy "$STRATEGY" --verbose | |
| 336 | 347 | else |
| 337 | bunx @buddysh/buddy update --strategy "$STRATEGY" | |
| 348 | bun ./bin/cli.ts update --strategy "$STRATEGY" | |
| 338 | 349 | fi |
| 339 | 350 | fi |
| 340 | 351 | |
| @@ -447,7 +458,7 @@ jobs: | ||
| 447 | 458 | set -e # Exit on any error |
| 448 | 459 | |
| 449 | 460 | # Build the command |
| 450 | COMMAND="bunx @buddysh/buddy dashboard" | |
| 461 | COMMAND="bun ./bin/cli.ts dashboard" | |
| 451 | 462 | |
| 452 | 463 | if [ "$TITLE" != "" ]; then |
| 453 | 464 | COMMAND="$COMMAND --title \"$TITLE\"" |
| @@ -470,9 +481,9 @@ jobs: | ||
| 470 | 481 | # Run scan to show what would be included |
| 471 | 482 | echo "🔍 Scanning for dependencies that would be included:" |
| 472 | 483 | if [ "$VERBOSE" = "true" ]; then |
| 473 | bunx @buddysh/buddy scan --verbose | |
| 484 | bun ./bin/cli.ts scan --verbose | |
| 474 | 485 | else |
| 475 | bunx @buddysh/buddy scan | |
| 486 | bun ./bin/cli.ts scan | |
| 476 | 487 | fi |
| 477 | 488 | else |
| 478 | 489 | echo "🚀 Executing dashboard update:" |
| @@ -110,6 +110,37 @@ jobs: | ||
| 110 | 110 | - name: Check docs against source |
| 111 | 111 | run: bun run check:docs |
| 112 | 112 | |
| 113 | # Dogfood smoke: the PR's own code runs its own review, with a read-only | |
| 114 | # token and no API key. Catches a broken command surface before merge | |
| 115 | # without putting PR-modified code near secrets. | |
| 116 | buddy-smoke: | |
| 117 | if: github.event_name == 'pull_request' | |
| 118 | runs-on: ubuntu-latest | |
| 119 | permissions: | |
| 120 | contents: read | |
| 121 | ||
| 122 | steps: | |
| 123 | - uses: actions/checkout@v6 | |
| 124 | with: | |
| 125 | fetch-depth: 0 # the branch review diffs against origin/main | |
| 126 | ||
| 127 | - name: Install Bun | |
| 128 | uses: oven-sh/setup-bun@v2.2.0 | |
| 129 | ||
| 130 | - name: Use cached node_modules | |
| 131 | uses: actions/cache@v5.0.4 | |
| 132 | with: | |
| 133 | path: node_modules | |
| 134 | key: node-modules-${{ hashFiles('**/bun.lock') }} | |
| 135 | restore-keys: | | |
| 136 | node-modules- | |
| 137 | ||
| 138 | - name: Install Dependencies | |
| 139 | run: bun install | |
| 140 | ||
| 141 | - name: Review this branch with its own code | |
| 142 | run: bun ./bin/cli.ts review --branch --base origin/main --light --format github | |
| 143 | ||
| 113 | 144 | publish-commit: |
| 114 | 145 | needs: [lint, typecheck, test, check-docs] |
| 115 | 146 | runs-on: ubuntu-latest |