feat(ci)!: upgrade actions and automate releases

.commitlintrc.json

@@ -0,0 +1,3 @@
+{
+  "extends": ["@commitlint/config-conventional"]
+}

.github/linters/.jscpd.json

@@ -1,6 +1,8 @@
 {
   "threshold": 5,
   "ignore": [
+    "**/actions/**/README.md",
+    "**/.github/workflows/continuous-integration.md",
     "**/node_modules/**",
     "**/.pnpm-store/**",
     "**/pnpm-workspace.yaml",

.github/workflows/__greetings.yml

@@ -10,7 +10,7 @@ permissions: {}
 
 jobs:
   greetings:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/greetings.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       contents: read
       issues: write

.github/workflows/__main-ci.yml

@@ -18,10 +18,11 @@ concurrency:
 
 jobs:
   ci:
-    uses: ./.github/workflows/__shared-ci.yml
+    uses: $/.github/workflows/__shared-ci.yml
     # jscpd:ignore-start
     permissions:
       actions: read
+      attestations: write
       contents: read
       packages: write
       pull-requests: write
@@ -34,7 +35,7 @@ jobs:
   release:
     needs: ci
     if: github.event_name != 'schedule'
-    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@a0a9d185c51c10710a5987822e78feb2b5ce1932 # 0.29.0
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/release-actions.yml@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
     permissions:
       contents: read
     with:

.github/workflows/__need-fix-to-issue.yml

@@ -18,7 +18,7 @@ permissions: {}
 
 jobs:
   main:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/need-fix-to-issue.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       contents: read
       issues: write

.github/workflows/__prepare-release.yml

@@ -0,0 +1,16 @@
+name: Internal - Prepare release
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, synchronize, edited]
+
+permissions: {}
+
+jobs:
+  release:
+    uses: hoverkraft-tech/ci-github-publish/.github/workflows/prepare-release.yml@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
+    permissions:
+      contents: read
+      pull-requests: write

.github/workflows/__pull-request-ci.yml

@@ -14,9 +14,10 @@ concurrency:
 
 jobs:
   ci:
-    uses: ./.github/workflows/__shared-ci.yml
+    uses: $/.github/workflows/__shared-ci.yml
     permissions:
       actions: read
+      attestations: write
       contents: read
       packages: write
       pull-requests: write

.github/workflows/__release.yml

@@ -0,0 +1,75 @@
+name: Internal - Release
+
+on:
+  workflow_dispatch:
+    # checkov:skip=CKV_GHA_7: force only bypasses the no-changes guard; source and build settings stay fixed.
+    inputs:
+      force:
+        description: Release even when no relevant changes are detected
+        type: boolean
+        required: false
+        default: false
+
+  schedule:
+    - cron: "25 8 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  ci:
+    if: github.ref_type == 'branch' && github.ref_name == github.event.repository.default_branch
+    uses: $/.github/workflows/__shared-ci.yml
+    permissions:
+      actions: read
+      attestations: write
+      contents: read
+      packages: write
+      pull-requests: write
+      id-token: write
+      issues: write
+      security-events: write
+      statuses: write
+
+  release:
+    name: Create and publish release
+    needs: ci
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # Use the app token so publishing the tag triggers the main CI documentation jobs.
+      - id: generate-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.CI_BOT_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }} # zizmor: ignore[secrets-outside-env] CI bot authentication is required to trigger tag workflows
+          permission-contents: write
+          permission-pull-requests: read
+
+      - name: Plan release
+        id: plan-release
+        uses: hoverkraft-tech/ci-github-publish/actions/release/plan@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
+        with:
+          target-sha: ${{ github.sha }}
+          github-token: ${{ steps.generate-token.outputs.token }}
+
+      - name: Create and publish release
+        if: (steps.plan-release.outputs.has-changes == 'true' || (github.event_name == 'workflow_dispatch' && inputs.force)) && steps.plan-release.outputs.tag != ''
+        uses: hoverkraft-tech/ci-github-publish/actions/release/create@4d906685a32df3cfab9139296d49dd914a86bafd # 1.0.2
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }} # zizmor: ignore[secrets-outside-env] repository secret is scoped to the release summary step
+        with:
+          tag: ${{ steps.plan-release.outputs.tag }}
+          target-sha: ${{ github.sha }}
+          publish: "true"
+          changelog-summary: |
+            {
+              "llmAuth": ${{ toJSON(env.OPENAI_API_KEY) }},
+              "llmProvider": "openai"
+            }
+          github-token: ${{ steps.generate-token.outputs.token }}

.github/workflows/__semantic-pull-request.yml

@@ -12,7 +12,7 @@ permissions: {}
 
 jobs:
   main:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/semantic-pull-request.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       contents: write
       pull-requests: write

.github/workflows/__shared-ci.yml

@@ -7,7 +7,7 @@ permissions: {}
 
 jobs:
   linter:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/linter.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       actions: read
       contents: read
@@ -20,51 +20,52 @@ jobs:
   test-action-dependencies-cache:
     name: Test action "dependencies-cache"
     needs: linter
-    uses: ./.github/workflows/__test-action-dependencies-cache.yml
+    uses: $/.github/workflows/__test-action-dependencies-cache.yml
     permissions:
       contents: read
 
   test-action-get-package-manager:
     name: Test action "get-package-manager"
     needs: linter
-    uses: ./.github/workflows/__test-action-get-package-manager.yml
+    uses: $/.github/workflows/__test-action-get-package-manager.yml
     permissions:
       contents: read
 
   test-action-has-installed-dependencies:
     name: Test action "has-installed-dependencies"
     needs: linter
-    uses: ./.github/workflows/__test-action-has-installed-dependencies.yml
+    uses: $/.github/workflows/__test-action-has-installed-dependencies.yml
     permissions:
       contents: read
 
   test-action-package:
     name: Test action "package"
     needs: linter
-    uses: ./.github/workflows/__test-action-package.yml
+    uses: $/.github/workflows/__test-action-package.yml
     permissions:
       contents: read
 
   test-action-setup-node:
     name: Test action "setup-node"
     needs: linter
-    uses: ./.github/workflows/__test-action-setup-node.yml
+    uses: $/.github/workflows/__test-action-setup-node.yml
     permissions:
       contents: read
 
   test-action-publish:
     name: Test action "publish"
     needs: linter
-    uses: ./.github/workflows/__test-action-publish.yml
+    uses: $/.github/workflows/__test-action-publish.yml
     permissions:
       actions: read
       contents: read
 
   test-workflow-continuous-integration:
     name: Test workflow "continuous-integration"
     needs: linter
-    uses: ./.github/workflows/__test-workflow-continuous-integration.yml
+    uses: $/.github/workflows/__test-workflow-continuous-integration.yml
     permissions:
+      attestations: write
       contents: read
       packages: write
       pull-requests: write

.github/workflows/__stale.yml

@@ -8,7 +8,7 @@ permissions: {}
 
 jobs:
   main:
-    uses: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0
+    uses: hoverkraft-tech/ci-github-common/.github/workflows/stale.yml@44f6108cef0e9884ea7735f3d62932c2310745d4 # 0.39.1
     permissions:
       issues: write
       pull-requests: write

.github/workflows/__test-action-dependencies-cache.yml

@@ -35,7 +35,7 @@ jobs:
 
       - name: Arrange - Setup Node.js runtime
         id: arrange-setup-node
-        uses: ./actions/setup-node
+        uses: $/actions/setup-node
         with:
           working-directory: ${{ matrix.working-directory }}
 
@@ -54,7 +54,7 @@ jobs:
 
       - name: Act - Run "dependencies-cache" action
         id: act-get-dependencies-cache
-        uses: ./actions/dependencies-cache
+        uses: $/actions/dependencies-cache
         with:
           working-directory: ${{ matrix.working-directory }}
           dependencies: |

.github/workflows/__test-action-get-package-manager.yml

@@ -49,7 +49,7 @@ jobs:
 
       - name: Act - Run "get-package-manager" action
         id: act-get-package-manager
-        uses: ./actions/get-package-manager
+        uses: $/actions/get-package-manager
         with:
           working-directory: ${{ matrix.working-directory }}
 

.github/workflows/__test-action-has-installed-dependencies.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Arrange - Setup Node.js runtime
         id: arrange-setup-node
-        uses: ./actions/setup-node
+        uses: $/actions/setup-node
         with:
           working-directory: ${{ matrix.working-directory }}
 
@@ -57,7 +57,7 @@ jobs:
           Act - Run "has-installed-dependencies" action
           # jscpd:ignore-end
         id: act-has-installed-dependencies
-        uses: ./actions/has-installed-dependencies
+        uses: $/actions/has-installed-dependencies
         with:
           working-directory: ${{ matrix.working-directory }}
           dependencies: |

.github/workflows/__test-action-package.yml

@@ -35,7 +35,7 @@ jobs:
 
       - name: Act - Run "package" action
         id: act-package
-        uses: ./actions/package
+        uses: $/actions/package
         with:
           working-directory: ${{ matrix.working-directory }}
           artifact-name: package-tarball-${{ github.job }}-${{ matrix.artifact-suffix }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -104,7 +104,7 @@ jobs:
 
       - name: Arrange - Setup Node.js runtime
         id: arrange-setup-node
-        uses: ./actions/setup-node
+        uses: $/actions/setup-node
         with:
           working-directory: ${{ matrix.working-directory }}
 
@@ -119,7 +119,7 @@ jobs:
 
       - name: Assert - Download package tarball artifact by ID
         id: download-package-tarball
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           artifact-ids: ${{ matrix.package-tarball-artifact-id }}
           path: ${{ runner.temp }}

.github/workflows/__test-action-publish.yml

@@ -21,7 +21,7 @@ jobs:
 
       - id: package
         name: Arrange - Create package tarball
-        uses: ./actions/package
+        uses: $/actions/package
         with:
           working-directory: tests/npm
 
@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Act - Run "publish" action
-        uses: ./actions/publish
+        uses: $/actions/publish
         with:
           package-tarball-artifact-id: ${{ needs.package.outputs.package-tarball-artifact-id }}
           tag: ${{ matrix.tag }}
@@ -54,7 +54,7 @@ jobs:
       - id: invalid-artifact
         name: Act - Reject multiple artifact IDs
         continue-on-error: true
-        uses: ./actions/publish
+        uses: $/actions/publish
         with:
           package-tarball-artifact-id: "1,2"
           dry-run: "true"
@@ -63,7 +63,7 @@ jobs:
       - id: invalid-dry-run
         name: Act - Reject invalid dry-run input
         continue-on-error: true
-        uses: ./actions/publish
+        uses: $/actions/publish
         with:
           package-tarball-artifact-id: ${{ needs.package.outputs.package-tarball-artifact-id }}
           dry-run: "yes"

.github/workflows/__test-action-setup-node.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Act - Run "setup-node" action
         id: act-setup-node
-        uses: ./actions/setup-node
+        uses: $/actions/setup-node
         with:
           working-directory: ${{ matrix.working-directory }}
       # jscpd:ignore-end