Skip to content

Commit c0cf2b1

Browse files
mridangmridang
committed
chore: add GitHub workflow files from zitadel-node
1 parent f8ff585 commit c0cf2b1

File tree

10 files changed

+502
-0
lines changed

10 files changed

+502
-0
lines changed

‎.github/workflows/commitlint.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Commits
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
required: true
8+
type: string
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
lint-commits:
15+
permissions:
16+
contents: read
17+
pull-requests: read
18+
runs-on: ubuntu-latest
19+
name: Validate Commits
20+
21+
steps:
22+
- name: Harden runner
23+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout code
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
ref: ${{ inputs.ref }}
31+
fetch-depth: 0
32+
33+
- name: Inspect Commits
34+
uses: mridang/action-commit-lint@v1
35+
with:
36+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/depcheck.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Dependency Review
2+
3+
on:
4+
push:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
dependency-review:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Harden Runner
14+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
15+
with:
16+
egress-policy: audit
17+
18+
- name: Checkout code
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
21+
- name: Review Dependencies
22+
uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1

‎.github/workflows/docker.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Docker
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
required: true
8+
type: string
9+
image-name:
10+
type: string
11+
default: 'temp'
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
Build-Container:
18+
runs-on: ubuntu-latest
19+
name: Build Container
20+
21+
steps:
22+
- name: Harden runner
23+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout code
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
ref: ${{ inputs.ref }}
31+
32+
- name: Set up Docker Buildx
33+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
34+
35+
- name: Build Docker image
36+
uses: docker/build-push-action@1dc73863535b631f98b2378be8619f83b136f4a0 # v6.17.0
37+
with:
38+
context: .
39+
file: ./Dockerfile
40+
push: false
41+
tags: ${{ inputs.image-name }}:${{ github.sha }}
42+
load: true
43+
cache-from: type=gha
44+
cache-to: type=gha,mode=max

‎.github/workflows/integration.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: Compatibility
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
library_ref:
7+
required: true
8+
type: string
9+
sanity_ref:
10+
required: true
11+
type: string
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
check-compatibility:
18+
name: With Node ${{ matrix.node-version }}
19+
runs-on: ubuntu-latest
20+
strategy:
21+
matrix:
22+
node-version: ['20', '21', '23', '24']
23+
fail-fast: false
24+
25+
steps:
26+
- name: Harden runner
27+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
28+
with:
29+
egress-policy: audit
30+
31+
- name: Checkout code
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
with:
34+
ref: ${{ inputs.library_ref }}
35+
path: project/library
36+
37+
- name: Checkout sanity stub
38+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
39+
with:
40+
ref: ${{ inputs.sanity_ref }}
41+
path: project/sanity
42+
43+
- name: Setup Node
44+
uses: actions/setup-node@v4
45+
with:
46+
node-version: ${{ matrix.node-version }}
47+
48+
- name: Build Library
49+
working-directory: project/library
50+
run: |
51+
npm ci
52+
npm run build
53+
54+
- name: Check Installability
55+
working-directory: project/sanity
56+
run: npm install ../library

‎.github/workflows/linting.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Linting
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
required: true
8+
type: string
9+
commit_changes:
10+
required: false
11+
type: boolean
12+
default: false
13+
14+
defaults:
15+
run:
16+
working-directory: ./
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
lint-format:
23+
permissions:
24+
contents: write
25+
runs-on: ubuntu-latest
26+
name: Reformat Code
27+
28+
steps:
29+
- name: Harden runner
30+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
31+
with:
32+
egress-policy: audit
33+
34+
- name: Checkout code
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
36+
with:
37+
ref: ${{ inputs.ref }}
38+
39+
- name: Setup Node
40+
uses: actions/setup-node@v4
41+
with:
42+
cache: 'npm'
43+
node-version-file: '.nvmrc'
44+
45+
- name: Install Dependencies
46+
run: npm ci --no-progress
47+
48+
- name: Run Formatter
49+
run: npm run format
50+
51+
- name: Commit Changes
52+
if: ${{ inputs.commit_changes == true }}
53+
uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
54+
with:
55+
commit_message: 'style: Apply automated code formatting [skip ci]'
56+
commit_options: '--no-verify'
57+
repository: .
58+
commit_user_name: github-actions[bot]
59+
commit_user_email: github-actions[bot]@users.noreply.github.com
60+
commit_author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

‎.github/workflows/pipeline.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Pipeline
2+
3+
on:
4+
push:
5+
6+
permissions:
7+
contents: write
8+
actions: read
9+
checks: write
10+
pull-requests: write
11+
12+
jobs:
13+
lint-commits:
14+
name: Run Commitlint Checks
15+
if: github.event_name == 'pull_request'
16+
uses: ./.github/workflows/commitlint.yml
17+
with:
18+
ref: ${{ github.event.pull_request.head.sha }}
19+
secrets: inherit
20+
21+
code-style:
22+
name: Run Linter Formatter
23+
uses: ./.github/workflows/linting.yml
24+
with:
25+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
26+
commit_changes: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
27+
secrets: inherit
28+
29+
compat-check:
30+
name: Run Compatibility Checks
31+
uses: ./.github/workflows/integration.yml
32+
with:
33+
library_ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
34+
sanity_ref: sanity
35+
secrets: inherit
36+
37+
type-check:
38+
name: Run Type Checks
39+
uses: ./.github/workflows/typecheck.yml
40+
with:
41+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
42+
secrets: inherit
43+
44+
run-tests:
45+
name: Run Test Suite
46+
uses: ./.github/workflows/test.yml
47+
with:
48+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
49+
secrets: inherit
50+
51+
code-inspection:
52+
name: Run Qodana Inspections
53+
needs: run-tests
54+
if: ${{ always() }}
55+
uses: ./.github/workflows/qodana.yml
56+
with:
57+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
58+
secrets: inherit
59+
60+
build-docker:
61+
name: Build Docker Container
62+
needs: run-tests
63+
uses: ./.github/workflows/docker.yml
64+
with:
65+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
66+
secrets: inherit
67+
68+
check-deps:
69+
name: Run Dependency Checks
70+
uses: ./.github/workflows/unused.yml
71+
with:
72+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
73+
secrets: inherit
74+
75+
all-passed:
76+
name: Check Build Status
77+
runs-on: ubuntu-latest
78+
needs:
79+
- lint-commits
80+
- code-style
81+
- compat-check
82+
- type-check
83+
- run-tests
84+
- code-inspection
85+
- build-docker
86+
- check-deps
87+
steps:
88+
- name: Harden runner
89+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
90+
with:
91+
egress-policy: audit
92+
93+
- name: Report Success
94+
run: echo "All required checks passed successfully."

‎.github/workflows/scorecard.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Scorecard Analysis
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
scorecard_analysis:
13+
name: Scorecard Analysis
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
security-events: write
18+
id-token: write
19+
20+
steps:
21+
- name: Harden runner
22+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
23+
with:
24+
egress-policy: audit
25+
26+
- name: Checkout Repository
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
with:
29+
persist-credentials: false
30+
31+
- name: Run Checks
32+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
33+
with:
34+
results_file: results.sarif
35+
results_format: sarif
36+
publish_results: true
37+
38+
- name: Upload Results
39+
uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
40+
with:
41+
sarif_file: results.sarif

0 commit comments

Comments
 (0)