@taraxvoid/voidflow 0.8.3 → 0.9.0

package/README.md

@@ -43,11 +43,34 @@ jobs:
       runner: my-hosted-runner
 ```
 
+### pnpm sites, build env, extra e2e paths
+
+```yaml
+jobs:
+  validate:
+    uses: taraxvoid/voidflow/.github/workflows/site-ci.yml@<sha> # <version>
+    with:
+      package-manager: pnpm # default: bun
+      e2e-extra-paths: '["wrangler.jsonc", "site.vars.json"]' # JSON array of globs
+      build-env: ${{ format('{{"PUBLIC_SITE_URL":"https://example.com","GIT_SHA":"{0}"}}', github.sha) }}
+```
+
+With `pnpm`, the pnpm version comes from `packageManager` and Node from `volta`
+or `engines` in `package.json`. The lockfile (`bun.lock` or `pnpm-lock.yaml`)
+follows the package manager. `build-env` is a JSON object, visible in logs, so
+no secrets.
+
 ## Workflow Types
 
 ### Validation / Checks
 
-Runs lint, typecheck, check for GPL licenses, e2e with Playwright
+Runs lint, typecheck, check for GPL licenses, e2e with Playwright.
+
+`site-ci.yml` runs these `package.json` scripts: `lint`, `check`, `build`,
+`test:unit`, `check:licenses`, `test:e2e:full` (PRs into `main`),
+`test:e2e:all` (PRs into `next` and `live`), `test:e2e:a11y` (`next` and
+`live`), and `test:e2e:lighthouse` (`live`). A script the site does not define
+is skipped with a notice, so none of them is required.
 
 ### Unlighthouse (performance / SEO budgets)
 
@@ -125,6 +148,11 @@ jobs:
           cloudflare-api-token: ${{ secrets.CLOUDFLARE_API_TOKEN }}
 ```
 
+Sites with a single production environment and per-PR previews (no `next` or
+`live` branch) pass `with: { single-environment: true }` to `resolve-env.yml`
+(or the same input on `actions/branch-env-map`). `main` then maps to `prod` and
+`pull_request` events map to `preview`; any other ref fails.
+
 ### Versioning
 
 This project uses semver, released with [release-please](https://github.com/googleapis/release-please)
@@ -149,13 +177,13 @@ This repo validates its own workflows and composite actions (`.github/workflows/
 
 - **actionlint**: workflow schema/logic; also shellchecks `run:` steps in `.github/workflows/*.yml` automatically (`shellcheck` ships on `ubuntu-latest`)
 - **check-jsonschema**: schema-checks `actions/**/action.yml` and the workflow files against [SchemaStore](https://www.schemastore.org/)'s `github-action.json` / `github-workflow.json`
-- **shellcheck** (`scripts/shellcheck-actions.sh`): checks `run:` steps inside `actions/**/action.yml`, which actionlint doesn't reach
+- **shellcheck** (`scripts/shellcheck-actions.ts`): checks `run:` steps inside `actions/**/action.yml`, which actionlint doesn't reach
 - **zizmor**: security audit (unpinned refs, script injection via `${{ }}` in `run:`, excess permissions, etc.)
 
 ### Local dev setup
 
 ```sh
-brew install just lefthook actionlint shellcheck yq act uv
+brew install just lefthook actionlint shellcheck bun act uv
 lefthook install
 ```
 
@@ -166,6 +194,6 @@ lefthook install
 
 **Colima users:** `.actrc` already disables the docker-socket mount (`--container-daemon-socket -`). `act` binds `/var/run/docker.sock` by default, which doesn't exist under Colima and fails with `operation not supported`. None of these workflow steps need docker-in-docker, so this is safe.
 
-**Run `just dry-run` from a normal checkout, not a linked git worktree.** `act` copies the working tree via `docker cp` rather than a real clone, so a worktree's `.git` pointer back to the parent repo doesn't resolve inside the container, so `git ls-files`-based steps (schema validation, `scripts/shellcheck-actions.sh`) silently see zero files instead of erroring. Verified clean end-to-end (`🏁 Job succeeded`) from a plain clone.
+**Run `just dry-run` from a normal checkout, not a linked git worktree.** `act` copies the working tree via `docker cp` rather than a real clone, so a worktree's `.git` pointer back to the parent repo doesn't resolve inside the container, so `git ls-files`-based steps (schema validation, `scripts/shellcheck-actions.ts`) silently see zero files instead of erroring. Verified clean end-to-end (`🏁 Job succeeded`) from a plain clone.
 
 Provided as is under the [MIT license](LICENSE). Issues and pull requests are welcome.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@taraxvoid/voidflow",
-    "version": "0.8.3",
+    "version": "0.9.0",
     "description": "Shared workflows, actions and tooling for @taraxvoid sites",
     "license": "MIT",
     "keywords": [