elizaos--eliza/.github/workflows/feed-env-audit.yml

name: Env Audit

on:
  pull_request:
  push:
    branches: [develop]

# CI fan-out fix: the PR-scoped concurrency from #14069 fell back to
# github.run_id on push, so every develop push got a unique group and
# nothing ever superseded. A 37-merge wave queued thousands of push runs
# and starved the self-hosted fleet. Fall back to github.ref (all develop
# pushes share a group) and cancel superseded runs on push too. PR behavior
# is unchanged (pull_request.number still wins the key); merge_group and
# schedule events are not in the cancel set, so the merge queue and nightly
# runs always complete.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'push' }}

env:
  CI: true

# Default to least privilege. Override per-job where needed.
permissions:
  contents: read

jobs:
  env-audit:
    name: env:audit:check
    runs-on: ${{ fromJSON(vars.HETZNER_FLEET_ONLINE == 'false' && '["ubuntu-24.04"]' || '["self-hosted","hetzner-robot"]') }}
    timeout-minutes: 10

    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
        with:
          fetch-depth: 2

      - name: Setup Bun workspace
        uses: ./.github/actions/setup-bun-workspace
        with:
          bun-version: "1.3.14" # pinned: floating canary writes lockfileVersion 2 and breaks --frozen-lockfile (#11184/#9454)
          install-command: bun install

      - name: Env audit check
        run: bun run --cwd packages/feed env:audit:check
        continue-on-error: true