Skip to content

Commit cf518be

Browse files
bartvenemanbartveneman
authored
chore: align GitHub Actions with other projectwallace repositories (#626)
- lock down permissions - use multi-step release process to avoid leaking secrets - add 7 day cooldown to dependabot - update knip
1 parent c6ba845 commit cf518be

6 files changed

Lines changed: 268 additions & 396 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
version: 2
55
updates:
6-
- package-ecosystem: 'npm' # pnpm is detected automatically via pnpm-lock.yaml
6+
- package-ecosystem: 'npm'
77
directory: '/'
88
schedule:
99
interval: 'monthly'
@@ -16,6 +16,8 @@ updates:
1616
- '*'
1717
exclude-patterns:
1818
- '@projectwallace/*'
19+
cooldown:
20+
default-days: 7
1921
- package-ecosystem: 'github-actions'
2022
directory: '/'
2123
schedule:
@@ -24,3 +26,5 @@ updates:
2426
github-actions:
2527
patterns:
2628
- '*'
29+
cooldown:
30+
default-days: 7

‎.github/workflows/dependency-diff.yml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ jobs:
1414
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
1515
with:
1616
ref: main
17+
persist-credentials: false
1718
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
1819
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
1920
with:
@@ -22,7 +23,7 @@ jobs:
2223
- run: pnpm install --frozen-lockfile --ignore-scripts
2324
- run: pnpm run build
2425
- run: pnpm pack --pack-destination ./base-packs
25-
- uses: actions/upload-artifact@v7
26+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
2627
with:
2728
name: base-packages
2829
path: ./base-packs/*.tgz
@@ -34,6 +35,8 @@ jobs:
3435
contents: read
3536
steps:
3637
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
38+
with:
39+
persist-credentials: false
3740
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
3841
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
3942
with:
@@ -42,7 +45,7 @@ jobs:
4245
- run: pnpm install --frozen-lockfile --ignore-scripts
4346
- run: pnpm run build
4447
- run: pnpm pack --pack-destination ./source-packs
45-
- uses: actions/upload-artifact@v7
48+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
4649
with:
4750
name: source-packages
4851
path: ./source-packs/*.tgz
@@ -58,11 +61,12 @@ jobs:
5861
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
5962
with:
6063
fetch-depth: 0
61-
- uses: actions/download-artifact@v8
64+
persist-credentials: false
65+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
6266
with:
6367
name: base-packages
6468
path: ./base-packs
65-
- uses: actions/download-artifact@v8
69+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
6670
with:
6771
name: source-packages
6872
path: ./source-packs
@@ -71,5 +75,4 @@ jobs:
7175
base-packages: './base-packs/*.tgz'
7276
source-packages: './source-packs/*.tgz'
7377
pack-size-threshold: -1
74-
size-threshold: -1
75-
duplicate-threshold: 3
78+
duplicate-threshold: 2

‎.github/workflows/release.yml‎

Lines changed: 71 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,32 +4,92 @@ on:
44
release:
55
types: [created]
66

7-
permissions:
8-
id-token: write # Required for OIDC
9-
contents: write # Required for pushing version bump commit
7+
permissions: {}
108

119
jobs:
12-
publish-npm:
10+
test:
1311
runs-on: ubuntu-latest
12+
permissions: {}
1413
steps:
1514
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
15+
with:
16+
persist-credentials: false
1617
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
1718
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
1819
with:
1920
node-version: 24
20-
cache: pnpm
21-
- run: pnpm install --frozen-lockfile --ignore-scripts
21+
package-manager-cache: false
22+
- run: pnpm install --frozen-lockfile
2223
- run: pnpm test
24+
25+
build:
26+
needs: test
27+
runs-on: ubuntu-latest
28+
permissions: {}
29+
steps:
30+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
31+
with:
32+
persist-credentials: false
33+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
34+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
35+
with:
36+
node-version: 24
37+
package-manager-cache: false
38+
- run: pnpm install --frozen-lockfile
2339
- run: pnpm run build
24-
- name: Bump version from release tag
25-
env:
26-
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
27-
run: |
40+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
41+
with:
42+
name: dist
43+
path: dist/
44+
45+
bump-version:
46+
needs: build
47+
runs-on: ubuntu-latest
48+
permissions:
49+
contents: write
50+
steps:
51+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
52+
with:
53+
persist-credentials: true
54+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
55+
- run: |
2856
VERSION=${GITHUB_REF_NAME#v}
2957
pnpm version $VERSION --no-git-tag-version
58+
- name: Commit and push version bump
59+
env:
60+
DEFAULT_BRANCH: main
61+
run: |
3062
git config user.name "github-actions[bot]"
3163
git config user.email "github-actions[bot]@users.noreply.github.com"
3264
git add package.json pnpm-lock.yaml
33-
git commit -m "chore: bump version to $VERSION"
65+
git commit -m "chore: bump version to ${GITHUB_REF_NAME#v}"
3466
git push origin HEAD:$DEFAULT_BRANCH
67+
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
68+
with:
69+
name: package-json
70+
path: package.json
71+
72+
publish:
73+
needs: bump-version
74+
runs-on: ubuntu-latest
75+
permissions:
76+
id-token: write # Required for OIDC provenance
77+
steps:
78+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
79+
with:
80+
persist-credentials: false
81+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
82+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
83+
with:
84+
node-version: 24
85+
package-manager-cache: false
86+
registry-url: 'https://registry.npmjs.org'
87+
- run: pnpm install --frozen-lockfile
88+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
89+
with:
90+
name: dist
91+
path: dist/
92+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
93+
with:
94+
name: package-json
3595
- run: pnpm publish --no-git-checks

‎.github/workflows/test.yml‎

Lines changed: 57 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Node.js CI
1+
name: Tests
22

33
on:
44
push:
@@ -10,67 +10,86 @@ permissions:
1010
contents: read
1111

1212
jobs:
13-
lint:
14-
name: Lint JS
15-
runs-on: ubuntu-latest
16-
steps:
17-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
18-
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
19-
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
20-
with:
21-
node-version: 22
22-
cache: pnpm
23-
- run: pnpm install --frozen-lockfile --ignore-scripts
24-
- run: pnpm run lint
25-
2613
test:
2714
name: Unit tests
2815
runs-on: ubuntu-latest
2916
steps:
30-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
17+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
18+
with:
19+
persist-credentials: false
3120
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
32-
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
21+
- name: Use Node.js
22+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
3323
with:
34-
node-version: 22
35-
cache: pnpm
36-
- run: pnpm install --frozen-lockfile --ignore-scripts
24+
cache: 'pnpm'
25+
node-version: 24
26+
- run: pnpm install --frozen-lockfile
3727
- run: pnpm test
3828

39-
code-coverage:
40-
name: Code coverage
29+
check:
30+
name: Check types
4131
runs-on: ubuntu-latest
4232
steps:
43-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
33+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
34+
with:
35+
persist-credentials: false
4436
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
45-
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
37+
- name: Use Node.js
38+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
4639
with:
47-
node-version: 22
48-
cache: pnpm
49-
- run: pnpm install --frozen-lockfile --ignore-scripts
50-
- run: pnpm test
40+
cache: 'pnpm'
41+
node-version: 24
42+
- run: pnpm install --frozen-lockfile
43+
- run: pnpm run check
5144

5245
build:
5346
name: Build
5447
runs-on: ubuntu-latest
5548
steps:
56-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
49+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
50+
with:
51+
persist-credentials: false
5752
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
58-
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
53+
- name: Use Node.js
54+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
5955
with:
60-
node-version: 22
61-
cache: pnpm
62-
- run: pnpm install --frozen-lockfile --ignore-scripts
56+
cache: 'pnpm'
57+
node-version: 24
58+
- run: pnpm install --frozen-lockfile
6359
- run: pnpm run build
6460

61+
lint:
62+
name: Lint
63+
runs-on: ubuntu-latest
64+
steps:
65+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
66+
with:
67+
persist-credentials: false
68+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
69+
- name: Use Node.js
70+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
71+
with:
72+
cache: 'pnpm'
73+
node-version: 24
74+
- run: pnpm install --frozen-lockfile
75+
- run: pnpm run lint
76+
77+
npm-audit:
78+
name: Audit packages
79+
runs-on: ubuntu-latest
80+
steps:
81+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
82+
with:
83+
persist-credentials: false
84+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
85+
- run: pnpm audit --audit-level=high
86+
6587
knip:
6688
name: Lint unused code
6789
runs-on: ubuntu-latest
6890
steps:
69-
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
70-
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
71-
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
91+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
7292
with:
73-
node-version: 22
74-
cache: pnpm
75-
- run: pnpm install --frozen-lockfile --ignore-scripts
93+
persist-credentials: false
94+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
7695
- run: pnpm run knip

‎package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,6 @@
6161
},
6262
"scripts": {
6363
"lint": "oxlint --config .oxlintrc.json; oxfmt --check",
64-
"lint-package": "publint",
6564
"test": "vitest --coverage",
6665
"check": "tsc --noEmit",
6766
"build": "tsdown",
@@ -73,12 +72,13 @@
7372
"devDependencies": {
7473
"@projectwallace/preset-oxlint": "^0.0.11",
7574
"@vitest/coverage-v8": "^4.1.10",
76-
"knip": "^6.29.0",
75+
"knip": "^6.31.0",
7776
"oxfmt": "^0.61.0",
7877
"oxlint": "^1.75.0",
7978
"publint": "^0.3.22",
8079
"tsdown": "^0.22.14",
8180
"typescript": "^7.0.2",
81+
"vite": "^8.2.0",
8282
"vitest": "^4.1.10"
8383
},
8484
"engines": {

0 commit comments

Comments
 (0)