Skip to content

Commit 326cdb2

Browse files
RumenDamyanovRumenDamyanov
committed
Add GitHub workflows for CI, CodeQL, Dependabot and NPM publishing
1 parent 6e6b4ca commit 326cdb2

File tree

4 files changed

+340
-0
lines changed

4 files changed

+340
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "npm"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
day: "monday"
8+
time: "09:00"
9+
timezone: "Europe/Sofia"
10+
assignees:
11+
- "RumenDamyanov"
12+
reviewers:
13+
- "RumenDamyanov"
14+
commit-message:
15+
prefix: "chore"
16+
prefix-development: "chore"
17+
include: "scope"
18+
labels:
19+
- "dependencies"
20+
- "automated"
21+
open-pull-requests-limit: 5
22+
pull-request-branch-name:
23+
separator: "/"
24+
ignore:
25+
# Ignore major version updates for stable dependencies
26+
- dependency-name: "typescript"
27+
update-types: ["version-update:semver-major"]
28+
- dependency-name: "eslint"
29+
update-types: ["version-update:semver-major"]
30+
groups:
31+
typescript-ecosystem:
32+
patterns:
33+
- "typescript"
34+
- "@typescript-eslint/*"
35+
- "ts-jest"
36+
testing-framework:
37+
patterns:
38+
- "jest"
39+
- "@types/jest"
40+
- "ts-jest"
41+
linting-tools:
42+
patterns:
43+
- "eslint"
44+
- "eslint-*"
45+
- "prettier"
46+
build-tools:
47+
patterns:
48+
- "@types/node"
49+
- "typescript"
50+
51+
- package-ecosystem: "github-actions"
52+
directory: "/"
53+
schedule:
54+
interval: "weekly"
55+
day: "monday"
56+
time: "10:00"
57+
timezone: "Europe/Sofia"
58+
assignees:
59+
- "RumenDamyanov"
60+
reviewers:
61+
- "RumenDamyanov"
62+
commit-message:
63+
prefix: "ci"
64+
include: "scope"
65+
labels:
66+
- "github-actions"
67+
- "automated"
68+
open-pull-requests-limit: 3

‎.github/workflows/ci.yml‎

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [master, develop]
6+
pull_request:
7+
branches: [master, develop]
8+
9+
jobs:
10+
lint:
11+
name: Lint
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout code
16+
uses: actions/checkout@v4
17+
18+
- name: Setup Node.js
19+
uses: actions/setup-node@v4
20+
with:
21+
node-version: '20'
22+
cache: 'npm'
23+
24+
- name: Install dependencies
25+
run: npm ci
26+
27+
- name: Run ESLint
28+
run: npm run lint
29+
30+
- name: Check formatting
31+
run: npm run format:check
32+
33+
- name: Type checking
34+
run: npm run typecheck
35+
36+
test:
37+
name: Test
38+
runs-on: ${{ matrix.os }}
39+
40+
strategy:
41+
matrix:
42+
os: [ubuntu-latest, windows-latest, macos-latest]
43+
node-version: [18, 20, 22]
44+
45+
steps:
46+
- name: Checkout code
47+
uses: actions/checkout@v4
48+
49+
- name: Setup Node.js ${{ matrix.node-version }}
50+
uses: actions/setup-node@v4
51+
with:
52+
node-version: ${{ matrix.node-version }}
53+
cache: 'npm'
54+
55+
- name: Install dependencies
56+
run: npm ci
57+
58+
- name: Run tests with coverage
59+
run: npm run test:coverage
60+
61+
- name: Upload coverage reports to Codecov
62+
if: matrix.os == 'ubuntu-latest' && matrix.node-version == '20'
63+
uses: codecov/codecov-action@v4
64+
with:
65+
token: ${{ secrets.CODECOV_TOKEN }}
66+
files: ./coverage/lcov.info
67+
directory: ./coverage
68+
flags: unittests
69+
name: codecov-umbrella
70+
fail_ci_if_error: false
71+
verbose: true
72+
73+
- name: Upload coverage artifacts
74+
if: matrix.os == 'ubuntu-latest' && matrix.node-version == '20'
75+
uses: actions/upload-artifact@v4
76+
with:
77+
name: coverage-report
78+
path: coverage/
79+
retention-days: 7
80+
81+
- name: Coverage Summary
82+
if: matrix.os == 'ubuntu-latest' && matrix.node-version == '20'
83+
uses: irongut/CodeCoverageSummary@v1.3.0
84+
with:
85+
filename: coverage/cobertura-coverage.xml
86+
badge: true
87+
fail_below_min: true
88+
format: markdown
89+
hide_branch_rate: false
90+
hide_complexity: true
91+
indicators: true
92+
output: both
93+
thresholds: '60 80'
94+
95+
- name: Add Coverage PR Comment
96+
if: matrix.os == 'ubuntu-latest' && matrix.node-version == '20' && github.event_name == 'pull_request'
97+
uses: marocchino/sticky-pull-request-comment@v2
98+
with:
99+
recreate: true
100+
path: code-coverage-results.md
101+
102+
build:
103+
name: Build
104+
runs-on: ubuntu-latest
105+
needs: [lint, test]
106+
107+
steps:
108+
- name: Checkout code
109+
uses: actions/checkout@v4
110+
111+
- name: Setup Node.js
112+
uses: actions/setup-node@v4
113+
with:
114+
node-version: '20'
115+
cache: 'npm'
116+
117+
- name: Install dependencies
118+
run: npm ci
119+
120+
- name: Build package
121+
run: npm run build
122+
123+
- name: Check build output
124+
run: |
125+
ls -la dist/
126+
[ -f dist/index.js ] || exit 1
127+
[ -f dist/index.d.ts ] || exit 1
128+
129+
- name: Upload build artifacts
130+
uses: actions/upload-artifact@v4
131+
with:
132+
name: build-artifacts
133+
path: dist/
134+
retention-days: 7
135+
136+
security:
137+
name: Security Audit
138+
runs-on: ubuntu-latest
139+
140+
steps:
141+
- name: Checkout code
142+
uses: actions/checkout@v4
143+
144+
- name: Setup Node.js
145+
uses: actions/setup-node@v4
146+
with:
147+
node-version: '20'
148+
cache: 'npm'
149+
150+
- name: Install dependencies
151+
run: npm ci
152+
153+
- name: Run security audit
154+
run: npm audit --audit-level=moderate
155+
156+
- name: Check for known vulnerabilities
157+
run: npm audit --parseable | wc -l | xargs test 0 -eq

‎.github/workflows/codeql.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: CodeQL Security Analysis
2+
3+
on:
4+
push:
5+
branches: [master, develop]
6+
pull_request:
7+
branches: [master, develop]
8+
schedule:
9+
- cron: '0 0 * * 1' # Run every Monday at midnight UTC
10+
11+
jobs:
12+
analyze:
13+
name: Analyze Code
14+
runs-on: ubuntu-latest
15+
16+
permissions:
17+
actions: read
18+
contents: read
19+
security-events: write
20+
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
language: ['javascript']
25+
26+
steps:
27+
- name: Checkout code
28+
uses: actions/checkout@v4
29+
30+
- name: Initialize CodeQL
31+
uses: github/codeql-action/init@v2
32+
with:
33+
languages: ${{ matrix.language }}
34+
queries: security-extended,security-and-quality
35+
36+
- name: Setup Node.js
37+
uses: actions/setup-node@v4
38+
with:
39+
node-version: '20'
40+
cache: 'npm'
41+
42+
- name: Install dependencies
43+
run: npm ci
44+
45+
- name: Build project
46+
run: npm run build
47+
48+
- name: Perform CodeQL Analysis
49+
uses: github/codeql-action/analyze@v2
50+
with:
51+
category: "/language:${{matrix.language}}"

‎.github/workflows/publish.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Publish to NPM
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
jobs:
8+
publish:
9+
name: Publish Package
10+
runs-on: ubuntu-latest
11+
12+
permissions:
13+
contents: read
14+
id-token: write
15+
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@v4
19+
20+
- name: Setup Node.js
21+
uses: actions/setup-node@v4
22+
with:
23+
node-version: '20'
24+
cache: 'npm'
25+
registry-url: 'https://registry.npmjs.org'
26+
27+
- name: Install dependencies
28+
run: npm ci
29+
30+
- name: Run full CI pipeline
31+
run: |
32+
npm run lint
33+
npm run typecheck
34+
npm test
35+
npm run build
36+
37+
- name: Verify package can be packed
38+
run: npm pack --dry-run
39+
40+
- name: Publish to NPM
41+
run: npm publish --provenance --access public
42+
env:
43+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
44+
45+
- name: Create GitHub Release Assets
46+
run: |
47+
npm pack
48+
mv *.tgz package.tgz
49+
50+
- name: Upload Release Asset
51+
uses: actions/upload-release-asset@v1
52+
env:
53+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
54+
with:
55+
upload_url: ${{ github.event.release.upload_url }}
56+
asset_path: ./package.tgz
57+
asset_name: ${{ github.event.repository.name }}-${{ github.event.release.tag_name }}.tgz
58+
asset_content_type: application/gzip
59+
60+
- name: Update Package Version Badge
61+
run: |
62+
echo "Package published successfully!"
63+
echo "Version: ${{ github.event.release.tag_name }}"
64+
echo "Package: @rumenx/sandbox-npm-package"

0 commit comments

Comments
 (0)