Skip to content

Commit 8f4ea03

Browse files
bartvenemanbartveneman
authored
chore: move to pnpm; pin gh-actions; lock permissions; upgrade to nod… (#130)
* chore: move to pnpm; pin gh-actions; lock permissions; upgrade to node24; add publishConfig * upgrade gh actions versions * fix up scripts * fix commands * fix commands
1 parent a201523 commit 8f4ea03

8 files changed

Lines changed: 3158 additions & 5145 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,23 +3,23 @@
33

44
version: 2
55
updates:
6-
- package-ecosystem: 'npm'
6+
- package-ecosystem: 'npm' # pnpm is detected automatically via pnpm-lock.yaml
77
directory: '/'
88
schedule:
9-
interval: 'weekly'
9+
interval: 'monthly'
1010
groups:
11-
vite:
11+
projectwallace:
1212
patterns:
13-
- 'vitest'
14-
- '@vitest/*'
15-
oxc:
13+
- '@projectwallace/*'
14+
npm-all:
1615
patterns:
17-
- 'oxlint'
18-
- 'oxfmt'
16+
- '*'
17+
exclude-patterns:
18+
- '@projectwallace/*'
1919
- package-ecosystem: 'github-actions'
2020
directory: '/'
2121
schedule:
22-
interval: 'weekly'
22+
interval: 'monthly'
2323
groups:
2424
github-actions:
2525
patterns:

‎.github/workflows/release.yml‎

Lines changed: 19 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,30 +5,35 @@ on:
55
types: [created]
66

77
permissions:
8-
id-token: write # Required for OIDC
8+
id-token: write # Required for OIDC provenance attestations
99
contents: write # Required to push version bump commit
1010

1111
jobs:
1212
publish-npm:
1313
runs-on: ubuntu-latest
1414
steps:
15-
- uses: actions/checkout@v6
16-
- uses: actions/setup-node@v6
15+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
16+
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
17+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
1718
with:
1819
node-version: 24
19-
- run: npm ci --ignore-scripts --no-audit --no-fund
20-
- run: npx playwright install chromium --only-shell
21-
- run: npm test -- --forbid-only
22-
- run: npm run build
20+
registry-url: https://registry.npmjs.org
21+
- run: pnpm install --frozen-lockfile
22+
- run: pnpm exec playwright install chromium --only-shell
23+
- run: pnpm test --forbid-only
24+
- run: pnpm run build
2325
- name: Bump version in package.json
24-
run: |
25-
VERSION="${{ github.event.release.tag_name }}"
26-
npm version "${VERSION#v}" --no-git-tag-version
26+
env:
27+
TAG_NAME: ${{ github.event.release.tag_name }}
28+
run: pnpm version "${TAG_NAME#v}" --no-git-tag-version
2729
- name: Commit and push version bump
30+
env:
31+
TAG_NAME: ${{ github.event.release.tag_name }}
32+
DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
2833
run: |
2934
git config user.name "github-actions[bot]"
3035
git config user.email "github-actions[bot]@users.noreply.github.com"
31-
git add package.json package-lock.json
32-
git commit -m "chore: bump version to ${{ github.event.release.tag_name }}"
33-
git push origin HEAD:main
34-
- run: npm publish --access public
36+
git add package.json pnpm-lock.yaml
37+
git commit -m "chore: bump version to ${TAG_NAME}"
38+
git push origin HEAD:${DEFAULT_BRANCH}
39+
- run: pnpm publish --no-git-checks

‎.github/workflows/test.yml‎

Lines changed: 58 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,3 @@
1-
# This workflow will do a clean install of node dependencies, build the source code and run tests across different versions of node
2-
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-nodejs-with-github-actions
3-
41
name: Test
52

63
on:
@@ -9,89 +6,108 @@ on:
96
pull_request:
107
branches: [main]
118

9+
permissions:
10+
contents: read
11+
1212
jobs:
1313
test:
1414
name: Unit tests
1515
runs-on: ubuntu-latest
1616
steps:
17-
- uses: actions/checkout@v6
17+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
18+
with:
19+
persist-credentials: false
20+
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
1821
- name: Use Node.js
19-
uses: actions/setup-node@v6
22+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
2023
with:
21-
cache: 'npm'
22-
node-version: 22
23-
- name: Install dependencies
24-
run: npm ci --ignore-scripts --no-audit --no-fund
24+
node-version: 24
25+
cache: pnpm
26+
- run: pnpm install --frozen-lockfile
2527
- name: Install Playwright Browsers
26-
run: npx playwright install chromium --only-shell
27-
- run: npm test -- --forbid-only
28+
run: pnpm exec playwright install chromium --only-shell
29+
- run: pnpm test --forbid-only
2830
- name: Upload coverage reports to Codecov
29-
uses: codecov/codecov-action@v6
31+
uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5
3032
with:
3133
token: ${{ secrets.CODECOV_TOKEN }}
3234

3335
check-ts:
3436
name: Check types
3537
runs-on: ubuntu-latest
3638
steps:
37-
- uses: actions/checkout@v6
39+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
40+
with:
41+
persist-credentials: false
42+
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
3843
- name: Use Node.js
39-
uses: actions/setup-node@v6
44+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
4045
with:
41-
cache: 'npm'
42-
node-version: 22
43-
- run: npm ci --ignore-scripts --no-audit --no-fund
44-
- run: npm run check
46+
node-version: 24
47+
cache: pnpm
48+
- run: pnpm install --frozen-lockfile
49+
- run: pnpm run check
4550

4651
lint-code:
4752
name: Lint code (oxlint)
4853
runs-on: ubuntu-latest
4954
steps:
50-
- uses: actions/checkout@v6
55+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
56+
with:
57+
persist-credentials: false
58+
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
5159
- name: Use Node.js
52-
uses: actions/setup-node@v6
60+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
5361
with:
54-
cache: 'npm'
55-
node-version: 22
56-
- run: npm ci --ignore-scripts --no-audit --no-fund
57-
- run: npm run lint
62+
node-version: 24
63+
cache: pnpm
64+
- run: pnpm install --frozen-lockfile
65+
- run: pnpm run lint
5866

5967
declutter-code:
6068
name: Declutter code (Knip)
6169
runs-on: ubuntu-latest
6270
steps:
63-
- uses: actions/checkout@v6
71+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
72+
with:
73+
persist-credentials: false
74+
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
6475
- name: Use Node.js
65-
uses: actions/setup-node@v6
76+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
6677
with:
67-
cache: 'npm'
68-
node-version: 22
69-
- run: npm ci --ignore-scripts --no-audit --no-fund
70-
- run: npm run knip
78+
node-version: 24
79+
cache: pnpm
80+
- run: pnpm install --frozen-lockfile
81+
- run: pnpm run knip
7182

7283
bundle-analysis:
7384
name: Report bundle analysis (codecov)
7485
runs-on: ubuntu-latest
7586
steps:
76-
- uses: actions/checkout@v6
77-
- uses: actions/setup-node@v6
87+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
88+
with:
89+
persist-credentials: false
90+
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
91+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
7892
with:
79-
cache: 'npm'
80-
node-version: 22
81-
- run: npm ci --ignore-scripts --no-audit --no-fund
82-
- run: npm run build
93+
node-version: 24
94+
cache: pnpm
95+
- run: pnpm install --frozen-lockfile
96+
- run: pnpm run build
8397
env:
8498
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
8599

86-
npm-audit:
100+
audit:
87101
name: Audit packages
88102
runs-on: ubuntu-latest
89103
steps:
90104
- name: Checkout code
91-
uses: actions/checkout@v6
105+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
106+
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
92107
- name: Use Node.js
93-
uses: actions/setup-node@v6
108+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
94109
with:
95-
cache: 'npm'
96-
node-version: 22
97-
- run: npm audit --audit-level=high
110+
node-version: 24
111+
cache: pnpm
112+
- run: pnpm install --frozen-lockfile
113+
- run: pnpm audit --audit-level=high

‎.npmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# Security settings are configured in pnpm-workspace.yaml

0 commit comments

Comments
 (0)