Workflow: .github/workflows/ci.yaml
| Job | Purpose |
|---|---|
| Commit messages | commitlint vs base…head |
| Lint | npm run lint |
| Property | npm run test:property |
| E2E | Cypress (Chrome) |
| Component | Cypress component |
Also on PRs (separate workflows): Dependency Review, CodeQL (as configured).
Vercel previews: Git integration deploys on push (Preview check). CI does not gate the preview deploy.
Workflow: .github/workflows/release.yml
- commitlint, lint, property, Cypress (same gates as CI)
npx --no-install semantic-release→ GitHub Release + GHCR image tags- On new release: Syft SBOM, Cosign sign/attest, provenance on the Release, Trivy SARIF
package.json version stays 0.0.0-dev; semver is git tags / Releases / GHCR.
.github/workflows/scorecard.yml— schedule, after successful Release, branch-protection changes, and workflow_dispatch (always analyzes tip ofdev)- Dependabot:
.github/dependabot.yml(npm, GitHub Actions, Docker) - Cosign verify examples: root README
| Target | How |
|---|---|
| Production web | Vercel from dev (vercel.json: npm run build → dist/client) |
| Self-host | ghcr.io/wfcd/warframe-hub tags from Release (see README Docker section) |
Production alias gating (Deployment Checks after CI) can be enabled in the Vercel dashboard if desired.
Release-note / CVE-fix policy for operators and the Best Practices form: RELEASES.md.