diff --git a/.commitlintrc.json b/.commitlintrc.json new file mode 100644 index 0000000..c30e5a9 --- /dev/null +++ b/.commitlintrc.json @@ -0,0 +1,3 @@ +{ + "extends": ["@commitlint/config-conventional"] +} diff --git a/.github/linters/.jscpd.json b/.github/linters/.jscpd.json index dbc1183..9ea13e8 100644 --- a/.github/linters/.jscpd.json +++ b/.github/linters/.jscpd.json @@ -1,6 +1,8 @@ { "threshold": 5, "ignore": [ + "**/actions/**/README.md", + "**/.github/workflows/continuous-integration.md", "**/node_modules/**", "**/.pnpm-store/**", "**/pnpm-workspace.yaml", diff --git a/.github/workflows/__greetings.yml b/.github/workflows/__greetings.yml index 4b83099..1f57744 100644 --- a/.github/workflows/__greetings.yml +++ b/.github/workflows/__greetings.yml @@ -10,7 +10,7 @@ permissions: {} jobs: greetings: - uses: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 permissions: contents: read issues: write diff --git a/.github/workflows/__main-ci.yml b/.github/workflows/__main-ci.yml index 27a829d..a5cd44a 100644 --- a/.github/workflows/__main-ci.yml +++ b/.github/workflows/__main-ci.yml @@ -18,10 +18,11 @@ concurrency: jobs: ci: - uses: ./.github/workflows/__shared-ci.yml + uses: $/.github/workflows/__shared-ci.yml # jscpd:ignore-start permissions: actions: read + attestations: write contents: read packages: write pull-requests: write @@ -34,7 +35,7 @@ jobs: release: needs: ci if: github.event_name != 'schedule' - uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@a0a9d185c51c10710a5987822e78feb2b5ce1932 # 0.29.0 + uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2 permissions: contents: read with: diff --git a/.github/workflows/__need-fix-to-issue.yml b/.github/workflows/__need-fix-to-issue.yml index 216c09c..df58bce 100644 --- a/.github/workflows/__need-fix-to-issue.yml +++ b/.github/workflows/__need-fix-to-issue.yml @@ -18,7 +18,7 @@ permissions: {} jobs: main: - uses: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 permissions: contents: read issues: write diff --git a/.github/workflows/__prepare-release.yml b/.github/workflows/__prepare-release.yml new file mode 100644 index 0000000..cc6013d --- /dev/null +++ b/.github/workflows/__prepare-release.yml @@ -0,0 +1,16 @@ +name: Internal - Prepare release + +on: + push: + branches: [main] + pull_request: + types: [opened, reopened, synchronize, edited] + +permissions: {} + +jobs: + release: + uses: hoverkraft-tech/ci-github-publish/.github/workflows/prepare-release.yml@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2 + permissions: + contents: read + pull-requests: write diff --git a/.github/workflows/__pull-request-ci.yml b/.github/workflows/__pull-request-ci.yml index fcc7c0c..d378eb5 100644 --- a/.github/workflows/__pull-request-ci.yml +++ b/.github/workflows/__pull-request-ci.yml @@ -14,9 +14,10 @@ concurrency: jobs: ci: - uses: ./.github/workflows/__shared-ci.yml + uses: $/.github/workflows/__shared-ci.yml permissions: actions: read + attestations: write contents: read packages: write pull-requests: write diff --git a/.github/workflows/__release.yml b/.github/workflows/__release.yml new file mode 100644 index 0000000..4f82994 --- /dev/null +++ b/.github/workflows/__release.yml @@ -0,0 +1,75 @@ +name: Internal - Release + +on: + workflow_dispatch: + # checkov:skip=CKV_GHA_7: force only bypasses the no-changes guard; source and build settings stay fixed. + inputs: + force: + description: Release even when no relevant changes are detected + type: boolean + required: false + default: false + + schedule: + - cron: "25 8 * * 1" + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + +jobs: + ci: + if: github.ref_type == 'branch' && github.ref_name == github.event.repository.default_branch + uses: $/.github/workflows/__shared-ci.yml + permissions: + actions: read + attestations: write + contents: read + packages: write + pull-requests: write + id-token: write + issues: write + security-events: write + statuses: write + + release: + name: Create and publish release + needs: ci + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: read + steps: + # Use the app token so publishing the tag triggers the main CI documentation jobs. + - id: generate-token + uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 + with: + client-id: ${{ vars.CI_BOT_APP_CLIENT_ID }} + private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] CI bot authentication is required to trigger tag workflows + permission-contents: write + permission-pull-requests: read + + - name: Plan release + id: plan-release + uses: hoverkraft-tech/ci-github-publish/actions/release/plan@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2 + with: + target-sha: ${{ github.sha }} + github-token: ${{ steps.generate-token.outputs.token }} + + - name: Create and publish release + if: (steps.plan-release.outputs.has-changes == 'true' || (github.event_name == 'workflow_dispatch' && inputs.force)) && steps.plan-release.outputs.tag != '' + uses: hoverkraft-tech/ci-github-publish/actions/release/create@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2 + env: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # zizmor: ignore[secrets-outside-env] repository secret is scoped to the release summary step + with: + tag: ${{ steps.plan-release.outputs.tag }} + target-sha: ${{ github.sha }} + publish: "true" + changelog-summary: | + { + "llmAuth": ${{ toJSON(env.OPENAI_API_KEY) }}, + "llmProvider": "openai" + } + github-token: ${{ steps.generate-token.outputs.token }} diff --git a/.github/workflows/__semantic-pull-request.yml b/.github/workflows/__semantic-pull-request.yml index 3fefe3e..30bf08e 100644 --- a/.github/workflows/__semantic-pull-request.yml +++ b/.github/workflows/__semantic-pull-request.yml @@ -12,7 +12,7 @@ permissions: {} jobs: main: - uses: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 permissions: contents: write pull-requests: write diff --git a/.github/workflows/__shared-ci.yml b/.github/workflows/__shared-ci.yml index 3167ff0..a164873 100644 --- a/.github/workflows/__shared-ci.yml +++ b/.github/workflows/__shared-ci.yml @@ -7,7 +7,7 @@ permissions: {} jobs: linter: - uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 permissions: actions: read contents: read @@ -20,42 +20,42 @@ jobs: test-action-dependencies-cache: name: Test action "dependencies-cache" needs: linter - uses: ./.github/workflows/__test-action-dependencies-cache.yml + uses: $/.github/workflows/__test-action-dependencies-cache.yml permissions: contents: read test-action-get-package-manager: name: Test action "get-package-manager" needs: linter - uses: ./.github/workflows/__test-action-get-package-manager.yml + uses: $/.github/workflows/__test-action-get-package-manager.yml permissions: contents: read test-action-has-installed-dependencies: name: Test action "has-installed-dependencies" needs: linter - uses: ./.github/workflows/__test-action-has-installed-dependencies.yml + uses: $/.github/workflows/__test-action-has-installed-dependencies.yml permissions: contents: read test-action-package: name: Test action "package" needs: linter - uses: ./.github/workflows/__test-action-package.yml + uses: $/.github/workflows/__test-action-package.yml permissions: contents: read test-action-setup-node: name: Test action "setup-node" needs: linter - uses: ./.github/workflows/__test-action-setup-node.yml + uses: $/.github/workflows/__test-action-setup-node.yml permissions: contents: read test-action-publish: name: Test action "publish" needs: linter - uses: ./.github/workflows/__test-action-publish.yml + uses: $/.github/workflows/__test-action-publish.yml permissions: actions: read contents: read @@ -63,8 +63,9 @@ jobs: test-workflow-continuous-integration: name: Test workflow "continuous-integration" needs: linter - uses: ./.github/workflows/__test-workflow-continuous-integration.yml + uses: $/.github/workflows/__test-workflow-continuous-integration.yml permissions: + attestations: write contents: read packages: write pull-requests: write diff --git a/.github/workflows/__stale.yml b/.github/workflows/__stale.yml index bd5ede0..8f31024 100644 --- a/.github/workflows/__stale.yml +++ b/.github/workflows/__stale.yml @@ -8,7 +8,7 @@ permissions: {} jobs: main: - uses: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 permissions: issues: write pull-requests: write diff --git a/.github/workflows/__test-action-dependencies-cache.yml b/.github/workflows/__test-action-dependencies-cache.yml index 0f5b267..477144b 100644 --- a/.github/workflows/__test-action-dependencies-cache.yml +++ b/.github/workflows/__test-action-dependencies-cache.yml @@ -35,7 +35,7 @@ jobs: - name: Arrange - Setup Node.js runtime id: arrange-setup-node - uses: ./actions/setup-node + uses: $/actions/setup-node with: working-directory: ${{ matrix.working-directory }} @@ -54,7 +54,7 @@ jobs: - name: Act - Run "dependencies-cache" action id: act-get-dependencies-cache - uses: ./actions/dependencies-cache + uses: $/actions/dependencies-cache with: working-directory: ${{ matrix.working-directory }} dependencies: | diff --git a/.github/workflows/__test-action-get-package-manager.yml b/.github/workflows/__test-action-get-package-manager.yml index ebca18b..63a9c61 100644 --- a/.github/workflows/__test-action-get-package-manager.yml +++ b/.github/workflows/__test-action-get-package-manager.yml @@ -49,7 +49,7 @@ jobs: - name: Act - Run "get-package-manager" action id: act-get-package-manager - uses: ./actions/get-package-manager + uses: $/actions/get-package-manager with: working-directory: ${{ matrix.working-directory }} diff --git a/.github/workflows/__test-action-has-installed-dependencies.yml b/.github/workflows/__test-action-has-installed-dependencies.yml index 670a1c5..6d2b6d8 100644 --- a/.github/workflows/__test-action-has-installed-dependencies.yml +++ b/.github/workflows/__test-action-has-installed-dependencies.yml @@ -38,7 +38,7 @@ jobs: - name: Arrange - Setup Node.js runtime id: arrange-setup-node - uses: ./actions/setup-node + uses: $/actions/setup-node with: working-directory: ${{ matrix.working-directory }} @@ -57,7 +57,7 @@ jobs: Act - Run "has-installed-dependencies" action # jscpd:ignore-end id: act-has-installed-dependencies - uses: ./actions/has-installed-dependencies + uses: $/actions/has-installed-dependencies with: working-directory: ${{ matrix.working-directory }} dependencies: | diff --git a/.github/workflows/__test-action-package.yml b/.github/workflows/__test-action-package.yml index f8b107f..d1383fa 100644 --- a/.github/workflows/__test-action-package.yml +++ b/.github/workflows/__test-action-package.yml @@ -35,7 +35,7 @@ jobs: - name: Act - Run "package" action id: act-package - uses: ./actions/package + uses: $/actions/package with: working-directory: ${{ matrix.working-directory }} artifact-name: package-tarball-${{ github.job }}-${{ matrix.artifact-suffix }}-${{ github.run_id }}-${{ github.run_attempt }} @@ -104,7 +104,7 @@ jobs: - name: Arrange - Setup Node.js runtime id: arrange-setup-node - uses: ./actions/setup-node + uses: $/actions/setup-node with: working-directory: ${{ matrix.working-directory }} @@ -119,7 +119,7 @@ jobs: - name: Assert - Download package tarball artifact by ID id: download-package-tarball - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ matrix.package-tarball-artifact-id }} path: ${{ runner.temp }} diff --git a/.github/workflows/__test-action-publish.yml b/.github/workflows/__test-action-publish.yml index 4531194..f555032 100644 --- a/.github/workflows/__test-action-publish.yml +++ b/.github/workflows/__test-action-publish.yml @@ -21,7 +21,7 @@ jobs: - id: package name: Arrange - Create package tarball - uses: ./actions/package + uses: $/actions/package with: working-directory: tests/npm @@ -43,7 +43,7 @@ jobs: persist-credentials: false - name: Act - Run "publish" action - uses: ./actions/publish + uses: $/actions/publish with: package-tarball-artifact-id: ${{ needs.package.outputs.package-tarball-artifact-id }} tag: ${{ matrix.tag }} @@ -54,7 +54,7 @@ jobs: - id: invalid-artifact name: Act - Reject multiple artifact IDs continue-on-error: true - uses: ./actions/publish + uses: $/actions/publish with: package-tarball-artifact-id: "1,2" dry-run: "true" @@ -63,7 +63,7 @@ jobs: - id: invalid-dry-run name: Act - Reject invalid dry-run input continue-on-error: true - uses: ./actions/publish + uses: $/actions/publish with: package-tarball-artifact-id: ${{ needs.package.outputs.package-tarball-artifact-id }} dry-run: "yes" diff --git a/.github/workflows/__test-action-setup-node.yml b/.github/workflows/__test-action-setup-node.yml index 3463f70..12856c8 100644 --- a/.github/workflows/__test-action-setup-node.yml +++ b/.github/workflows/__test-action-setup-node.yml @@ -38,7 +38,7 @@ jobs: - name: Act - Run "setup-node" action id: act-setup-node - uses: ./actions/setup-node + uses: $/actions/setup-node with: working-directory: ${{ matrix.working-directory }} # jscpd:ignore-end diff --git a/.github/workflows/__test-workflow-continuous-integration.yml b/.github/workflows/__test-workflow-continuous-integration.yml index 6b9c63b..82862de 100644 --- a/.github/workflows/__test-workflow-continuous-integration.yml +++ b/.github/workflows/__test-workflow-continuous-integration.yml @@ -8,7 +8,7 @@ permissions: {} jobs: act-without-container: name: Act - Run the continuous integration workflow (without container) - uses: ./.github/workflows/continuous-integration.yml + uses: $/.github/workflows/continuous-integration.yml permissions: contents: read id-token: write @@ -30,7 +30,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ needs.act-without-container.outputs.build-artifact-id }} path: "/" @@ -41,7 +41,7 @@ jobs: act-without-container-and-github-reports: # jscpd:ignore-start name: Act - Run the continuous integration workflow (without container and GitHub reports) - uses: ./.github/workflows/continuous-integration.yml + uses: $/.github/workflows/continuous-integration.yml permissions: contents: read id-token: write @@ -61,14 +61,16 @@ jobs: arrange-with-container: name: Arrange - Build container image for CI workflow permissions: + attestations: write contents: read id-token: write issues: read packages: write pull-requests: read - uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@f8255a6a37eb141fa331527f5aed9b9e1d598c77 # 0.38.0 + uses: hoverkraft-tech/ci-github-container/.github/workflows/docker-build-images.yml@5ffc3c81daacc57700a14bb91d67edbc67eedc1d # 0.39.0 with: sign: false + attest: false images: | [{ "name": "ci-npm", @@ -83,7 +85,7 @@ jobs: act-with-container: name: Act - Run the continuous integration workflow (with container) - uses: ./.github/workflows/continuous-integration.yml + uses: $/.github/workflows/continuous-integration.yml needs: arrange-with-container permissions: contents: read @@ -109,7 +111,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ needs.act-with-container.outputs.build-artifact-id }} path: ${{ runner.temp }} @@ -119,7 +121,7 @@ jobs: act-with-container-advanced: name: Act - Run the continuous integration workflow (with container and advanced options) - uses: ./.github/workflows/continuous-integration.yml + uses: $/.github/workflows/continuous-integration.yml needs: arrange-with-container permissions: contents: read @@ -159,7 +161,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ needs.act-with-container-advanced.outputs.build-artifact-id }} path: ${{ runner.temp }} diff --git a/.github/workflows/continuous-integration.md b/.github/workflows/continuous-integration.md index dc467aa..9dad4dc 100644 --- a/.github/workflows/continuous-integration.md +++ b/.github/workflows/continuous-integration.md @@ -3,7 +3,7 @@ # GitHub Reusable Workflow: Node.js Continuous Integration
- Node.js Continuous Integration + Node.js Continuous Integration
--- @@ -58,7 +58,7 @@ on: permissions: {} jobs: continuous-integration: - uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4 + uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 permissions: contents: read id-token: write @@ -335,7 +335,7 @@ For private container images, specify the username in the container input's `cre ```yaml jobs: continuous-integration: - uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@main + uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 secrets: container-password: ${{ secrets.REGISTRY_PASSWORD }} with: @@ -397,7 +397,7 @@ on: jobs: continuous-integration: - uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4 + uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 permissions: id-token: write security-events: write @@ -414,13 +414,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup NodeJS - uses: hoverkraft-tech/ci-github-nodejs/actions/setup-node@0.2.2 + uses: hoverkraft-tech/ci-github-nodejs/actions/setup-node@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 - name: Download build artifact - uses: actions/download-artifact@v2 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ needs.continuous-integration.outputs.build-artifact-id }} path: / @@ -449,7 +449,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Build Docker image run: | @@ -463,7 +463,7 @@ jobs: # Run CI checks inside the Docker container continuous-integration: needs: build-image - uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4 + uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 permissions: id-token: write security-events: write @@ -487,7 +487,7 @@ on: branches: [main] jobs: continuous-integration: - uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4 + uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 permissions: id-token: write security-events: write @@ -515,7 +515,7 @@ on: jobs: continuous-integration: - uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4 + uses: hoverkraft-tech/ci-github-nodejs/.github/workflows/continuous-integration.yml@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 permissions: id-token: write security-events: write diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml index 227fcfd..5b0c39d 100644 --- a/.github/workflows/continuous-integration.yml +++ b/.github/workflows/continuous-integration.yml @@ -293,11 +293,11 @@ jobs: security-events: write runs-on: *ci-runner steps: - - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 + - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ inputs.code-ql }} - - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2 + - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 dependency-review: name: 🛡️ Dependency Review @@ -306,7 +306,7 @@ jobs: contents: read runs-on: *ci-runner steps: - - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 setup: @@ -332,10 +332,10 @@ jobs: steps: - name: Checkout repository if: inputs.container == '' - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: ${{ inputs.container && 'false' || 'true' }} @@ -441,14 +441,9 @@ jobs: contents: read packages: read steps: - - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 if: inputs.container == '' - - id: local-workflow-actions - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - actions-path: actions - - id: preparel-lint-options uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: @@ -472,7 +467,7 @@ jobs: core.setOutput('report-file', lintOptions['report-file'] || ''); - name: Run lint - uses: ./../self-workflow/actions/lint + uses: $/actions/lint with: working-directory: ${{ needs.setup.outputs.working-directory }} container: ${{ inputs.container != '' && 'true' || 'false' }} @@ -494,17 +489,12 @@ jobs: outputs: artifact-id: ${{ steps.build.outputs.artifact-id }} steps: - - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 if: needs.setup.outputs.build-commands && inputs.container == '' - - id: local-workflow-actions - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - actions-path: actions - - id: build if: needs.setup.outputs.build-commands - uses: ./../self-workflow/actions/build + uses: $/actions/build with: container: ${{ inputs.container != '' && 'true' || 'false' }} working-directory: ${{ needs.setup.outputs.working-directory }} @@ -528,20 +518,15 @@ jobs: packages: read pull-requests: write steps: - - uses: hoverkraft-tech/ci-github-common/actions/checkout@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + - uses: hoverkraft-tech/ci-github-common/actions/checkout@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 if: inputs.container == '' - if: needs.build.outputs.artifact-id && inputs.container == '' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ needs.build.outputs.artifact-id }} path: "/" - - id: local-workflow-actions - uses: hoverkraft-tech/ci-github-common/actions/local-workflow-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - actions-path: actions - - id: prepare-test-options uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 env: @@ -569,7 +554,7 @@ jobs: core.setOutput('command', testOptions.command || 'test:ci'); - name: Run tests - uses: ./../self-workflow/actions/test + uses: $/actions/test with: working-directory: ${{ needs.setup.outputs.working-directory }} container: ${{ inputs.container != '' && 'true' || 'false' }} diff --git a/.github/workflows/release.md b/.github/workflows/release.md index 08cc6f2..d72b324 100644 --- a/.github/workflows/release.md +++ b/.github/workflows/release.md @@ -10,7 +10,7 @@ use [Commit the version before building](#commit-the-version-before-building). ## Set up -1. Configure [release labels and version rules](https://github.com/hoverkraft-tech/ci-github-publish/blob/0.29.0/.github/workflows/prepare-release.md). +1. Configure [release labels and version rules](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/.github/workflows/prepare-release.md). These determine the version and release notes. 2. Check the package's `package.json`: set `name`, `files`, and `repository.url`, and ensure `private` is not `true`. 3. Configure [npm trusted publishing](../../actions/publish/README.md#npm-trusted-publishing) for your repository and workflow filename, `release.yml`. @@ -18,7 +18,7 @@ use [Commit the version before building](#commit-the-version-before-building). For a new npm package, publish its first version before configuring the trusted publisher. 4. Save the workflow below as `.github/workflows/release.yml` in your project. Before running it: - Replace every `` with the **same `ci-github-nodejs` commit containing `actions/publish`**. - The `ci-github-publish` actions are already pinned to `0.29.0`. + The `ci-github-publish` actions are already pinned to `1.0.2`. - Set the `build`, `lint:ci`, and `test:ci` script names and the `dist/` output path to match your project. See [CI options](continuous-integration.md) if you need a different setup. @@ -58,7 +58,7 @@ jobs: steps: - name: Plan release id: plan - uses: hoverkraft-tech/ci-github-publish/actions/release/plan@a0a9d185c51c10710a5987822e78feb2b5ce1932 # 0.29.0 + uses: hoverkraft-tech/ci-github-publish/actions/release/plan@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2 - id: version uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 @@ -117,7 +117,7 @@ jobs: # Wrap the raw .tgz in a ZIP artifact for release/create. - id: release-assets - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-assets path: ${{ steps.package.outputs.package-tarball-path }} @@ -131,7 +131,7 @@ jobs: tag: latest - name: Create GitHub release - uses: hoverkraft-tech/ci-github-publish/actions/release/create@a0a9d185c51c10710a5987822e78feb2b5ce1932 # 0.29.0 + uses: hoverkraft-tech/ci-github-publish/actions/release/create@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2 with: tag: ${{ needs.plan.outputs.tag }} target-sha: ${{ github.sha }} @@ -144,6 +144,51 @@ and creates the tarball. [Publish](../../actions/publish/README.md) publishes th The package version is changed locally; it is not committed. GitHub's source archive therefore keeps the version from the source commit. If `package.json` already contains the planned version, omit the Package action's `version` input. +## Generate the changelog + +`release/create` generates the GitHub release notes with Release Drafter from the merged pull requests since the previous matching release. +No separate changelog command is needed for the workflow above. `release/plan` calculates the version without creating a release. + +Use the [prepare-release workflow](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/.github/workflows/prepare-release.md) +to label pull requests from their Conventional Commit titles. Its default rules select a major version for breaking changes, +a minor version for features, and a patch version for other changes. Check the labels before merging. +To customize categories, version rules, or the release-note template, add `.github/release-config.yml`. +For monorepos, use the same `working-directory` and `include-paths` values in `release/plan` and `release/create`; +an existing repository configuration takes precedence over those generated defaults. + +### Add an AI summary + +Store the provider credential as the `OPENAI_API_KEY` Actions secret, then add these entries to the **Create GitHub release** step. +Merge `changelog-summary` into its existing `with` mapping: + +```yaml +env: + OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} +with: + changelog-summary: | + { + "llmAuth": ${{ toJSON(env.OPENAI_API_KEY) }}, + "llmProvider": "openai" + } +``` + +The action drafts the changelog, generates a release summary and breaking-change section, and prepends them to the full changelog before publishing. +The summary also uses GitHub evidence, so keep `contents: write` and `pull-requests: read` on the release job. +Use `toJSON` to encode the credential safely. Omit `changelog-summary` to publish the generated notes without an AI summary. +See [summarizer inputs](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/actions/release/summarize-changelog/README.md) +for `llmModel`, `llmConfig`, and custom summary templates. + +To review the notes before publication, set `publish: "false"`, review the draft, then publish it with `release/update`. +If summary generation fails, the action does not publish the GitHub release. The npm package may already be published; +follow [Recover a failed release](#recover-a-failed-release) instead of rerunning npm publication. + +### Keep a changelog in the repository + +Release notes are stored in the GitHub release body; these actions do not write or commit `CHANGELOG.md`. +If the source archive or npm tarball must contain it, generate and review the changelog on the release branch, +commit it with the version update, and build from that merged commit as described in [Commit the version before building](#commit-the-version-before-building). +Keep the planned tag fixed through preparation and publication. + ## Run a release In **Actions → Release → Run workflow**, select the default branch. The workflow also runs every Monday at 08:25 UTC. @@ -175,7 +220,7 @@ and skip it when that version is already released. The Package action performs its own checkout of the workflow's source ref. Checking out the merged commit in an earlier step does not change that ref: start the packaging workflow at the merged commit. -See the [release preparation example](https://github.com/hoverkraft-tech/ci-github-publish/blob/0.29.0/.github/workflows/release.md#example-3-validate-source-update-files-create-release-artifacts-and-release) +See the [release preparation example](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/.github/workflows/release.md#example-3-validate-source-update-files-create-release-artifacts-and-release) for automating the pull request and merge. ## Other setups @@ -189,7 +234,7 @@ for automating the pull request and merge. For Package, set `working-directory` to the dependency installation root and `package-directory` to the package's relative path. Convert prefixed Git tags such as `my-package/v1.2.3` to npm versions, and use a separate concurrency group and artifact name per package. - **Drafts and signing:** create a draft with `publish: "false"`, then use `release/update` to attach assets and publish after npm publication succeeds. - See the [draft release example](https://github.com/hoverkraft-tech/ci-github-publish/blob/0.29.0/.github/workflows/release.md#example-2-validate-source-create-release-artifacts-and-release). + See the [draft release example](https://github.com/hoverkraft-tech/ci-github-publish/blob/1.0.2/.github/workflows/release.md#example-2-validate-source-create-release-artifacts-and-release). Use `release/delete` with `draft-only: "true"` to clean up a temporary draft on failure **only if the npm package has not been published**. ## Recover a failed release diff --git a/Dockerfile b/Dockerfile index 7fc7d9b..2cf267f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ -FROM ghcr.io/hoverkraft-tech/docker-base-images/super-linter:0.4.3 +FROM ghcr.io/hoverkraft-tech/docker-base-images/super-linter:2.0.0 HEALTHCHECK --interval=5m --timeout=10s --start-period=30s --retries=3 CMD ["/bin/sh","-c","test -d /github/home"] ARG UID=1000 ARG GID=1000 -USER ${UID}:${GID} \ No newline at end of file +USER ${UID}:${GID} diff --git a/README.md b/README.md index 2b72b23..007f1a3 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,10 @@ This repository centralizes the Hoverkraft toolkit for building, testing, and sh - Composite actions that detect project tooling, manage dependencies, and bootstrap runtimes. - Reusable workflows that apply those actions to deliver consistent CI pipelines across repositories. +## Prerequisites + +Use these actions and workflows on GitHub.com with GitHub-hosted runners or self-hosted runners version 2.336.0 or newer. Internal action composition uses GitHub's native `$/` references, which are unavailable on GitHub Enterprise Server. + ## Actions ### CI Actions diff --git a/actions/build/action.yml b/actions/build/action.yml index e5e7326..8c6c339 100644 --- a/actions/build/action.yml +++ b/actions/build/action.yml @@ -67,19 +67,15 @@ runs: using: "composite" steps: # jscpd:ignore-start - - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - source-path: ${{ github.action_path }}/.. - - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: ${{ inputs.container && 'false' || 'true' }} - id: setup-node if: inputs.container != 'true' - uses: ./../self-actions/setup-node + uses: $/actions/setup-node with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} dependencies-cache: | @@ -91,7 +87,7 @@ runs: - id: get-package-manager if: inputs.container == 'true' - uses: ./../self-actions/get-package-manager + uses: $/actions/get-package-manager with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} # jscpd:ignore-end @@ -165,7 +161,7 @@ runs: - id: build-artifact-id if: inputs.build-artifact != '' - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ fromJSON(inputs.build-artifact).name }} path: ${{ fromJSON(inputs.build-artifact).paths }} diff --git a/actions/codecov/action.yml b/actions/codecov/action.yml index 87f3464..7dbda82 100644 --- a/actions/codecov/action.yml +++ b/actions/codecov/action.yml @@ -32,7 +32,7 @@ runs: steps: # jscpd:ignore-start - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: "false" diff --git a/actions/dependencies-cache/action.yml b/actions/dependencies-cache/action.yml index 88f5f6d..4b325e1 100644 --- a/actions/dependencies-cache/action.yml +++ b/actions/dependencies-cache/action.yml @@ -33,26 +33,22 @@ runs: using: "composite" steps: # jscpd:ignore-start - - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - source-path: ${{ github.action_path }}/.. - - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: "false" - id: has-installed-dependencies if: inputs.dependencies != '' - uses: ./../self-actions/has-installed-dependencies + uses: $/actions/has-installed-dependencies with: dependencies: ${{ inputs.dependencies }} working-directory: ${{ steps.working-directory.outputs.absolute-path }} - id: get-package-manager if: inputs.package-manager == '' - uses: ./../self-actions/get-package-manager + uses: $/actions/get-package-manager with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} # jscpd:ignore-end diff --git a/actions/get-package-manager/action.yml b/actions/get-package-manager/action.yml index c86aea3..a0aa3ea 100644 --- a/actions/get-package-manager/action.yml +++ b/actions/get-package-manager/action.yml @@ -31,7 +31,7 @@ runs: using: "composite" steps: - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: "false" diff --git a/actions/has-installed-dependencies/action.yml b/actions/has-installed-dependencies/action.yml index 01d83e9..9b4d77e 100644 --- a/actions/has-installed-dependencies/action.yml +++ b/actions/has-installed-dependencies/action.yml @@ -25,19 +25,15 @@ runs: using: "composite" steps: # jscpd:ignore-start - - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - source-path: ${{ github.action_path }}/.. - - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: "false" - id: get-package-manager if: inputs.package-manager == '' - uses: ./../self-actions/get-package-manager + uses: $/actions/get-package-manager with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} # jscpd:ignore-end diff --git a/actions/lint/action.yml b/actions/lint/action.yml index db6ce60..27e28fe 100644 --- a/actions/lint/action.yml +++ b/actions/lint/action.yml @@ -46,19 +46,15 @@ runs: using: "composite" steps: # jscpd:ignore-start - - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - source-path: ${{ github.action_path }}/.. - - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: ${{ inputs.container && 'false' || 'true' }} - id: setup-node if: inputs.container != 'true' - uses: ./../self-actions/setup-node + uses: $/actions/setup-node with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} dependencies-cache: | @@ -67,7 +63,7 @@ runs: - id: get-package-manager if: inputs.container == 'true' - uses: ./../self-actions/get-package-manager + uses: $/actions/get-package-manager with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} # jscpd:ignore-end @@ -109,7 +105,7 @@ runs: - name: 📊 Parse lint reports if: always() - uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} report-paths: ${{ inputs.report-file || 'auto:lint' }} diff --git a/actions/package/README.md b/actions/package/README.md index 32923a9..2f987e3 100644 --- a/actions/package/README.md +++ b/actions/package/README.md @@ -3,7 +3,7 @@ # ![Icon](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIyNCIgaGVpZ2h0PSIyNCIgdmlld0JveD0iMCAwIDI0IDI0IiBmaWxsPSJub25lIiBzdHJva2U9ImN1cnJlbnRDb2xvciIgc3Ryb2tlLXdpZHRoPSIyIiBzdHJva2UtbGluZWNhcD0icm91bmQiIHN0cm9rZS1saW5lam9pbj0icm91bmQiIGNsYXNzPSJmZWF0aGVyIGZlYXRoZXItcGFja2FnZSIgY29sb3I9ImJsdWUiPjxsaW5lIHgxPSIxNi41IiB5MT0iOS40IiB4Mj0iNy41IiB5Mj0iNC4yMSI+PC9saW5lPjxwYXRoIGQ9Ik0yMSAxNlY4YTIgMiAwIDAgMC0xLTEuNzNsLTctNGEyIDIgMCAwIDAtMiAwbC03IDRBMiAyIDAgMCAwIDMgOHY4YTIgMiAwIDAgMCAxIDEuNzNsNyA0YTIgMiAwIDAgMCAyIDBsNy00QTIgMiAwIDAgMCAyMSAxNnoiPjwvcGF0aD48cG9seWxpbmUgcG9pbnRzPSIzLjI3IDYuOTYgMTIgMTIuMDEgMjAuNzMgNi45NiI+PC9wb2x5bGluZT48bGluZSB4MT0iMTIiIHkxPSIyMi4wOCIgeDI9IjEyIiB5Mj0iMTIiPjwvbGluZT48L3N2Zz4=) GitHub Action: Package
- Package + Package
--- @@ -34,7 +34,7 @@ Action to create and upload an npm package tarball from a Node.js project ## Usage ```yaml -- uses: hoverkraft-tech/ci-github-nodejs/actions/package@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4 +- uses: hoverkraft-tech/ci-github-nodejs/actions/package@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 with: # Working directory where dependencies are installed for packaging. # Can be absolute or relative to the repository root. @@ -114,14 +114,14 @@ jobs: package-tarball-artifact-id: ${{ steps.package.outputs.package-tarball-artifact-id }} steps: - id: package - uses: hoverkraft-tech/ci-github-nodejs/actions/package@df348077afa4e79725151d50606e9dc63f86dcb6 # 0.24.4 + uses: hoverkraft-tech/ci-github-nodejs/actions/package@81a4bca8445b7b273455ff26a9a5c3c31c86b2a1 # 0.25.0 consume: needs: package runs-on: ubuntu-latest steps: - name: Download package tarball by artifact ID - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ needs.package.outputs.package-tarball-artifact-id }} skip-decompress: true diff --git a/actions/package/action.yml b/actions/package/action.yml index 4eeb10e..f009de6 100644 --- a/actions/package/action.yml +++ b/actions/package/action.yml @@ -57,26 +57,22 @@ runs: with: persist-credentials: false - - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - source-path: ${{ github.action_path }}/.. - # jscpd:ignore-start - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: "false" - id: setup-node - uses: ./../self-actions/setup-node + uses: $/actions/setup-node with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} # jscpd:ignore-end - name: Download build artifacts if: inputs.build-artifact-id != '' - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ inputs.build-artifact-id }} path: ${{ inputs.build-artifact-path }} @@ -196,7 +192,7 @@ runs: - name: Upload package tarball id: upload-package-tarball - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: ${{ steps.resolve-artifact-name.outputs.artifact-name }} path: ${{ steps.package.outputs.package-tarball-path }} diff --git a/actions/publish/action.yml b/actions/publish/action.yml index 06434e8..41ba68d 100644 --- a/actions/publish/action.yml +++ b/actions/publish/action.yml @@ -78,14 +78,14 @@ runs: core.setOutput('download-path', fs.mkdtempSync(path.join(process.env.RUNNER_TEMP, 'package-publish-'))); - name: Setup Node.js - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: registry-url: ${{ inputs.registry-url }} node-version: "lts/*" - name: Download package tarball id: download-package-tarball - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: artifact-ids: ${{ inputs.package-tarball-artifact-id }} path: ${{ steps.validate.outputs.download-path }} diff --git a/actions/setup-node/action.yml b/actions/setup-node/action.yml index c20e0eb..f239613 100644 --- a/actions/setup-node/action.yml +++ b/actions/setup-node/action.yml @@ -31,12 +31,8 @@ runs: using: "composite" steps: # jscpd:ignore-start - - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - source-path: ${{ github.action_path }}/.. - - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: "false" @@ -44,7 +40,7 @@ runs: - id: get-package-manager if: inputs.package-manager == '' - uses: ./../self-actions/get-package-manager + uses: $/actions/get-package-manager with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} @@ -129,7 +125,7 @@ runs: package_json_file: ${{ steps.working-directory.outputs.workspace-relative-path }}/package.json run_install: false - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version-file: ${{ steps.get-node-version-file.outputs.node-version-file }} cache: ${{ steps.get-package-manager.outputs.cache-dependency-path != '' && steps.get-package-manager.outputs.package-manager || '' }} @@ -154,7 +150,7 @@ runs: await exec.exec(command, args, { cwd: workingDirectory }); - if: inputs.dependencies-cache != '' - uses: ./../self-actions/dependencies-cache + uses: $/actions/dependencies-cache with: dependencies: ${{ inputs.dependencies-cache }} working-directory: ${{ steps.working-directory.outputs.absolute-path }} diff --git a/actions/test/action.yml b/actions/test/action.yml index dd7483c..688d584 100644 --- a/actions/test/action.yml +++ b/actions/test/action.yml @@ -72,13 +72,9 @@ inputs: runs: using: "composite" steps: - - uses: hoverkraft-tech/ci-github-common/actions/local-actions@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 - with: - source-path: ${{ github.action_path }}/.. - # jscpd:ignore-start - id: working-directory - uses: hoverkraft-tech/ci-github-common/actions/working-directory@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/working-directory@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ inputs.working-directory }} enforce-path-in-workspace: ${{ inputs.container && 'false' || 'true' }} @@ -86,7 +82,7 @@ runs: - id: setup-node if: inputs.container != 'true' - uses: ./../self-actions/setup-node + uses: $/actions/setup-node with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} dependencies-cache: | @@ -96,7 +92,7 @@ runs: - id: get-package-manager if: inputs.container == 'true' - uses: ./../self-actions/get-package-manager + uses: $/actions/get-package-manager with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} @@ -138,7 +134,7 @@ runs: - name: 📊 Parse coverage reports if: always() && inputs.coverage == 'github' id: parse-coverage-reports - uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/parse-ci-reports@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} report-name: "Coverage Results" @@ -148,13 +144,13 @@ runs: - name: 📊 Add coverage PR comment if: always() && inputs.coverage == 'github' && github.event_name == 'pull_request' && steps.parse-coverage-reports.outputs.markdown - uses: hoverkraft-tech/ci-github-common/actions/create-or-update-comment@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 + uses: hoverkraft-tech/ci-github-common/actions/create-or-update-comment@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1 with: title: "Code Coverage Report" body: ${{ steps.parse-coverage-reports.outputs.markdown }} - name: 📊 Upload coverage to Codecov if: always() && inputs.coverage == 'codecov' - uses: ./../self-actions/codecov + uses: $/actions/codecov with: working-directory: ${{ steps.working-directory.outputs.absolute-path }} diff --git a/tests/npm/Dockerfile b/tests/npm/Dockerfile index 62856ec..88cff12 100644 --- a/tests/npm/Dockerfile +++ b/tests/npm/Dockerfile @@ -1,6 +1,6 @@ FROM node:24.14-bookworm-slim AS base -USER node +USER 1000:1000 WORKDIR /usr/src/app FROM base AS build @@ -19,6 +19,6 @@ FROM base AS ci COPY --chown=node:node --from=build /usr/src/app/ /usr/src/app/ -HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 CMD node -v >/dev/null 2>&1 || exit 1 +HEALTHCHECK --interval=30s --timeout=5s --start-period=5s --retries=3 CMD ["node", "--version"] -CMD [ "tail", "-f", "/dev/null" ] \ No newline at end of file +CMD [ "tail", "-f", "/dev/null" ]