chore: audit update #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI / Release | |
| on: | |
| workflow_dispatch: | |
| push: | |
| paths-ignore: | |
| - .github/** | |
| - '!.github/workflows/release.yaml' | |
| - '**/*.md' | |
| branches: | |
| - '([0-9])?(.{+([0-9]),x}).x' | |
| - main | |
| - next | |
| - next-major | |
| - alpha | |
| - beta | |
| - 'feat/*' | |
| - 'fix/*' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-release-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| NODE_VERSION: 24 | |
| jobs: | |
| release: | |
| name: CI / Release | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| id-token: write | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0 | |
| with: | |
| egress-policy: audit | |
| - name: Git checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup PNPM | |
| uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0 | |
| - name: Use Node.js ${{ env.NODE_VERSION }} | |
| uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0 | |
| with: | |
| registry-url: https://registry.npmjs.org | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: pnpm | |
| - name: Install packages | |
| run: pnpm install --frozen-lockfile | |
| - name: Verify installed prod dependency attestations | |
| run: node --run audit | |
| - name: Setup Turbo cache | |
| uses: dtinth/setup-github-actions-caching-for-turbo@cc723b4600e40a6b8815b65701d8614b91e2669e # v1.3.0 | |
| - name: Clean build outputs | |
| run: node --run clean | |
| - name: Build packages | |
| run: node --run build | |
| - name: Cache ESLint results | |
| uses: actions/cache@v4 | |
| with: | |
| path: .eslintcache | |
| key: | |
| eslint-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', | |
| 'eslint.config.js') }} | |
| - name: Lint JS and TS | |
| run: node --run lint:es | |
| - name: Lint CSS | |
| run: node --run lint:style | |
| - name: Check formatting | |
| run: node --run format | |
| - name: Tests - units | |
| run: node --run test:unit | |
| - name: Tests - types | |
| run: node --run test:types | |
| - name: Cache Playwright browsers | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.cache/ms-playwright | |
| key: playwright-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }} | |
| - name: Install Playwright browsers | |
| run: pnpm exec playwright install --with-deps chromium | |
| - name: Tests - E2E | |
| run: node --run test:e2e | |
| - name: Git user configuration | |
| if: github.ref == 'refs/heads/main' || github.ref == 'refs/heads/next' | |
| run: | | |
| git config --global user.name "${{ github.actor }}" | |
| git config --global user.email "${{ github.actor }}@users.noreply.github.com" | |
| - name: Publish [main] | |
| if: github.ref == 'refs/heads/main' | |
| id: graduateRelease | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_CONFIG_PROVENANCE: 'true' | |
| run: | | |
| pnpm exec lerna publish --message 'chore: publish [main] release [skip ci]' --create-release=github --conventional-graduate --force-git-tag --yes | |
| - name: Publish [main] fallback | |
| if: | |
| ${{ always() && github.ref == 'refs/heads/main' && | |
| steps.graduateRelease.outcome == 'failure' }} | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_CONFIG_PROVENANCE: 'true' | |
| run: | | |
| echo "Graduate publish failed - attempting recovery" | |
| git stash || true | |
| echo "==> from-package: recovering partial publish" | |
| FROM_PKG_OUT=$(pnpm exec lerna publish from-package --yes 2>&1) | |
| FROM_PKG_EXIT=$? | |
| echo "$FROM_PKG_OUT" | |
| echo "==> non-graduate: publishing new or changed packages" | |
| OUTPUT=$(pnpm exec lerna publish --message 'chore: publish [main] release [skip ci]' --create-release=github --yes 2>&1) || true | |
| echo "$OUTPUT" | |
| if [ "$FROM_PKG_EXIT" -ne 0 ] && echo "$OUTPUT" | grep -q 'No changed packages to publish'; then | |
| echo "::error::Neither from-package nor conventional fallback published anything" | |
| exit 1 | |
| fi | |
| - name: Publish [next] | |
| if: github.ref == 'refs/heads/next' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_CONFIG_PROVENANCE: 'true' | |
| run: | | |
| pnpm exec lerna publish --message 'chore: publish [next] pre-release' --conventional-prerelease --pre-dist-tag=next --preid=next --yes | |
| - name: Merge back main into next | |
| if: github.ref == 'refs/heads/main' | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}' | |
| run: | | |
| git checkout next | |
| git merge main --no-ff -m 'chore: auto-merge main into next [skip ci]' | |
| git push |