Workflows in .maggot/workflows run shell steps on pushes, pull requests and by hand.
name: CI
on:
push:
branches: [master]
pull_request:
workflow_dispatch:
schedule:
- cron: "0 6 * * 1-5" # weekdays at 06:00 UTC
jobs:
test:
runs-on: ubuntu-latest # the repository's default runner
strategy:
matrix:
node: [22, 24]
steps:
- uses: actions/checkout@v4 # built in: the commit is always checked out
- uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node }}
- uses: actions/cache@v4 # built in, stored in R2
with:
path: ~/.npm
key: npm-${{ hashFiles('package-lock.json') }}
restore-keys: npm-
- run: npm ci && npm test
- uses: actions/upload-artifact@v4
if: failure()
with:
name: logs-${{ matrix.node }}
path: test-results/
build:
needs: test
runs-on: depot-4 # a 4 vCPU Depot sandbox
outputs:
version: ${{ steps.v.outputs.version }}
steps:
- id: v
run: echo "version=$(git describe --always)" >> "$GITHUB_OUTPUT"
- run: npm ci && npm run build
env:
API_TOKEN: ${{ secrets.API_TOKEN }}| on | push and pull_request (branches or branches-ignore with * ** ? and !; pull_request types opened, synchronize, reopened), workflow_dispatch (no inputs), schedule (cron, UTC, at least 5 minutes apart, on the default branch) |
| name, env | The workflow's name and environment |
| defaults.run | shell and working-directory for run steps, at workflow or job level |
| permissions | Read access only: read-all, or scopes set to read or none |
| jobs.<id> | name, runs-on, needs, if, outputs, strategy, timeout-minutes (1–360, default 30), env, defaults, permissions, steps. At most 50 jobs, 256 once matrices are expanded |
| strategy | matrix (lists of values, include, exclude), fail-fast (default true), max-parallel |
| runs-on | cloudflare, depot, depot-<2|4|8|16|32|64>, or ubuntu-latest / ubuntu-<version> / linux for the repository's default runner. x64 only |
| steps[] | run (bash or sh) or uses, name, with, shell, working-directory, env, if, continue-on-error, id, timeout-minutes. At most 50 |
| uses | actions/checkout (built in; fetch-depth), actions/cache (and cache/restore, cache/save) and actions/upload-artifact / download-artifact (built in, kept in R2), JavaScript and composite actions from GitHub (owner/repo[/path]@ref) or this repository (./path). Not Docker actions |
| ${{ }} | github, env, secrets, matrix, strategy, steps.<id>.outputs / outcome / conclusion, needs.<id>.outputs / result, job, runner, inputs (in composite actions); operators ! == != < <= > >= && ||; contains, startsWith, endsWith, format, join, toJSON, fromJSON, hashFiles, success(), failure(), cancelled(), always() |
| Not yet | services, containers, concurrency, environments, reusable workflows, workflow_dispatch inputs, vars, Docker actions |
Jobs run on Linux in /workspace with Internet access. Runs from forks' pull requests wait for approval and never get secrets. Caches are scoped like GitHub's: a branch restores its own, then its base's and the default branch's. Artifacts are kept 30 days unless retention-days says otherwise (up to 90).