Skip to content

ci: pin ubuntu-24.04, Node 24 actions, self-hosted fonts - #13

Merged
rNLKJA merged 2 commits into
mainfrom
ci/harden-2026-10
Oct 9, 2026
Merged

rNLKJA merged 2 commits into
mainfrom
ci/harden-2026-10

Conversation

@rNLKJA

@rNLKJA rNLKJA commented Oct 9, 2026

Copy link
Copy Markdown
Owner

What changes

CI (.github/workflows/ci.yml)

  • runs-on: ubuntu-24.04 instead of ubuntu-latest, which moves to 26.04 on 19 October.
  • actions/checkout@v7, actions/setup-node@v7 (same node-version, cache: pnpm and cache-dependency-path) and pnpm/action-setup@v6 (same package_json_file, so pnpm still comes from packageManager).
  • Concurrency group ci-${{ github.workflow }}-${{ github.ref }}, cancelling in-progress runs everywhere except main.
  • timeout-minutes: 15 on the web job and permissions: contents: read.
  • CI now runs pnpm format:check, which main already passes.
  • web/package.json typecheck is now next typegen && tsc --noEmit instead of bare tsc --noEmit.

Fonts (web/src/app/layout.tsx, web/src/app/fonts/)

  • next/font/google is replaced by next/font/local, so the build no longer depends on reaching Google Fonts.
  • Latin woff2 files come from @fontsource-variable/bricolage-grotesque, @fontsource-variable/geist and @fontsource-variable/geist-mono (5.3.0, taken with npm pack, so no new dependency).
  • --font-display, --font-geist-sans and --font-geist-mono and the className wiring on <html> are unchanged, with display: "swap". The font constants are renamed to bricolage, geist and geistMono, so the generated family names say which face they are.
  • The SIL OFL 1.1 licence for each family sits next to its files, and fonts/README.md records the source of each file.
  • grep -rn next/font/google web/src is now empty.

Gates run locally

pnpm install --frozen-lockfile, lint, format:check, typecheck, test (989 passed) and build all pass.

🤖 Generated with Claude Code

rNLKJA and others added 2 commits October 9, 2026 16:18
…currency

- runs-on ubuntu-24.04 instead of ubuntu-latest
- actions/checkout@v7, actions/setup-node@v7 and pnpm/action-setup@v6
- concurrency is keyed on workflow and ref, and only cancels outside main
- 15 minute job timeout and a read-only GITHUB_TOKEN
- CI now runs format:check, which the repo already passes
- typecheck runs `next typegen` before `tsc --noEmit`, so route types exist on a clean checkout

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bricolage Grotesque, Geist and Geist Mono now load through
next/font/local from latin woff2 files taken from the
@fontsource-variable packages with npm pack, so no dependency is added.
The --font-display, --font-geist-sans and --font-geist-mono variables
and the className wiring are unchanged and display is swap. The SIL OFL
1.1 licence ships next to each family.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rNLKJA
rNLKJA merged commit 6d8aaad into main Oct 9, 2026
1 check passed
@rNLKJA
rNLKJA deleted the ci/harden-2026-10 branch October 9, 2026 05:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant