Skip to content

Commit be592b0

Browse files
achrinzaachrinza
committed
ci: enable pipeline publishing
Signed-off-by: Rifa Achrinza <25147899+achrinza@users.noreply.github.com>
1 parent bc36815 commit be592b0

6 files changed

Lines changed: 171 additions & 14 deletions

File tree

‎.editorconfig‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# SPDX-License-Identifier: FSFAP
2+
# SPDX-FileCopyrightText: Copyright (c) 2024 Rifa Achrinza
3+
root = true
4+
5+
[*]
6+
end_of_line = lf
7+
insert_final_newline = true
8+
charset = utf-8
9+
indent_style = space
10+
indent_size = 2
11+
max_line_length = 80

‎.github/workflows/cd.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: CD
2+
3+
on:
4+
push: {} # Remove me!
5+
workflow_dispatch:
6+
inputs:
7+
branch:
8+
description: Branch to publish a release from
9+
required: true
10+
default: main
11+
type: choice
12+
options:
13+
- main
14+
- v9.x
15+
16+
permissions: {}
17+
18+
jobs:
19+
test:
20+
name: Test
21+
uses: ./.github/workflows/ci.yaml
22+
build:
23+
name: Build
24+
permissions:
25+
id-token: write
26+
contents: read
27+
actions: read
28+
# Do not pin to hash
29+
# See: https://github.com/slsa-framework/slsa-verifier/issues/12
30+
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v2.0.0
31+
with:
32+
node-version: 22
33+
run-scripts: ci, test
34+
publish:
35+
name: Publish
36+
runs-on: ubuntu-24.04
37+
needs: [build]
38+
permissions:
39+
contents: read
40+
id-token: write
41+
steps:
42+
- name: Harden Runner
43+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
44+
with:
45+
egress-policy: audit
46+
- name: Download Tarball
47+
uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-package-download@v2.0.0
48+
with:
49+
name: ${{ needs.build.outputs.package-download-name }}
50+
path: ${{ needs.build.outputs.package-name }}
51+
sha256: ${{ needs.build.outputs.package-download-sha256 }}
52+
- name: Download Provenance
53+
uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v2.0.0
54+
with:
55+
name: ${{ needs.build.outputs.provenance-download-name }}
56+
path: attestations
57+
sha256: ${{ needs.build.outputs.provenance-download-sha256 }}
58+
- name: Publish Dry-Run
59+
env:
60+
TARBALL_PATH: ${{ needs.build.outputs.package-name }}
61+
run: npm publish --dry-run "$TARBALL_PATH"
62+
- name: Request for NPM 2FA Code
63+
uses: step-security/wait-for-secrets@5809f7d044804a5a1d43217fa8f3e855939fc9ef # v1.2.0
64+
with:
65+
secrets: |
66+
npm-otp:
67+
name: NPM Registry OTP
68+
description: NPM Registry TOTP code for `achrinza-bot` NPM account
69+
- name: Publish Package
70+
env:
71+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
72+
TARBALL_PATH: ${{ needs.build.outputs.package-name }}
73+
PROVENANCE_PATH: ./attestations/${{ needs.build.outputs.provenance-name }}
74+
run: |
75+
npm publish \
76+
--access=public \
77+
--provenance-file="$PROVENANCE_PATH" \
78+
"$TARBALL_PATH"

‎.github/workflows/ci.yaml‎

Lines changed: 30 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,20 +2,23 @@ name: CI
22

33
on:
44
push:
5-
branches: [ main ]
5+
branches: [main]
66
pull_request:
7-
branches: [ main ]
7+
branches: [main]
8+
workflow_call: {}
89

10+
permissions: {}
11+
912
jobs:
1013
test:
1114
name: Test
1215
runs-on: ${{ matrix.os }}
1316
strategy:
1417
matrix:
1518
os:
16-
- ubuntu-latest
19+
- ubuntu-24.04
1720
- macos-13
18-
- windows-latest
21+
- windows-2022
1922
node-version:
2023
- 14
2124
- 16
@@ -25,31 +28,44 @@ jobs:
2528
- 20
2629
- 21
2730
- 22
31+
- 23
2832
steps:
29-
- uses: actions/checkout@v2
33+
- name: Harden Runner
34+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
35+
with:
36+
egress-policy: audit
37+
- name: Checkout Repository
38+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3039
- name: Use Node.js ${{ matrix.node-version }}
31-
uses: actions/setup-node@v1
40+
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
3241
with:
3342
node-version: ${{ matrix.node-version }}
43+
cache: npm
3444
- name: Install Dependencies
35-
run: npm ci --ignore-scripts
45+
run: npm ci --prefer-offline --ignore-scripts
3646
- name: Run Tests
37-
run: npm test
47+
run: npm test --ignore-scripts
3848
code-lint:
3949
name: Code Lint
4050
runs-on: ubuntu-latest
4151
steps:
42-
- uses: actions/checkout@v2
43-
- name: Use Node.js 16
44-
uses: actions/setup-node@v1
52+
- name: Harden Runner
53+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
54+
with:
55+
egress-policy: audit
56+
- name: Checkout Repository
57+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
58+
- name: Use Node.js 22
59+
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
4560
with:
46-
node-version: 16 # LTS
61+
node-version: 22 # LTS
62+
cache: npm
4763
- name: Install Dependencies
48-
run: npm ci --ignore-scripts
64+
run: npm ci --prefer-offline --ignore-scripts
4965
- name: Lockfile Lint
5066
run: |
5167
npm exec \
52-
--no-install \
68+
--no \
5369
--package=lockfile-lint \
5470
-- \
5571
lockfile-lint \

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,8 @@
44
npm-debug.log
55
node-ipc.cjs
66
/coverage/
7+
8+
# Code editors
9+
\#*#
10+
.#*
11+
*~

‎RELEASE.md‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Publishing a Release
2+
3+
This project uses a manually-invoked GitHub Actions workflow to publish its packages.
4+
5+
This workflow uses:
6+
- The SLSA Node.js builder to achieve SLSA v3-level provenance
7+
- An NPM granular access token for `achrinza-bot`
8+
9+
## Publishing
10+
11+
Before continuing, enusre that you have:
12+
13+
1. A GitHub account with the `Repository Admin` role for the `achrinza/node-ipc` repository
14+
2. The username and password for the `achrinza-bot` NPM account or any account that has:
15+
1. TOTP 2FA enabled
16+
2. Write access to the `@achrinza/node-ipc` NPM package
17+
3. The TOTP generator for said account
18+
19+
### 1. Regenerating the NPM Granular Token
20+
1. Go to [New Granular Access Token](https://www.npmjs.com/settings/achrinza/tokens/granular-access-tokens/new)
21+
2. Generate a granular access token that:
22+
1. expires in 1 day
23+
2. has `Read and write` permssions for only the `@achrinza/node-ipc` package.
24+
3. Click `Generate` and copy the token
25+
4. Go to [Update Action secret NPM_TOKEN](https://github.com/achrinza/node-ipc/settings/secrets/actions/NPM_TOKEN)
26+
5. Paste the token and click `Update secret`
27+
28+
### 2. Creating a GitHub "Release"
29+
30+
1. Delete and re-fetch all Git tags
31+
This is necessary to prevent accidental tags from being pushed to the GitHub repository
32+
33+
On Linux or macOS:
34+
```sh
35+
$ git branch -l | xargs -I{} git branch -d {}
36+
$ git fetch 'refs/tags/*:refs/tags/*'
37+
```
38+
39+
2. De
40+
41+
### 3. Creating an NPM Release
42+
43+
> [!NOTE]
44+
> Ensure the Git comit and tag from the previous step has been completed
45+
46+
3. Go to [CD * workflow runs](https://github.com/achrinza/node-ipc/actions/workflows/cd.yaml)

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
"node-http-server": "^8.1.4"
3535
},
3636
"scripts": {
37+
"ci": "npm ci",
3738
"prepare": "esbuild node-ipc.js --bundle --format=cjs --target=es2018 --platform=node --outfile=node-ipc.cjs",
3839
"test": "c8 -r lcov -r html node test/CI.js && c8 report && node ./lcov.js",
3940
"coverage": "echo 'See your coverage report at http://localhost:8080' && node-http-server port=8080 root=./coverage/"

0 commit comments

Comments
 (0)