diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 63396fad..4016e545 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,175 +12,8 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: - lint: - name: Lint - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run linter - run: pnpm lint - - format: - name: Format - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Check formatting - run: pnpm format --check - - typecheck: - name: Type Check - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run type check - run: pnpm typecheck - - knip: - name: Knip - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run knip - run: pnpm exec knip --reporter github-actions - - test: - name: Tests (Node ${{ matrix.node.name }}) - runs-on: ubuntu-latest - timeout-minutes: 15 - strategy: - fail-fast: false - matrix: - node: - # "default" resolves to .node-version (24.x); 22.19.0 is the - # engines floor declared by the published packages. - - { name: "default", version: "" } - - { name: "22.19.0", version: "22.19.0" } - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - with: - node-version: ${{ matrix.node.version }} - - - name: Run tests - run: pnpm test -- --coverage --reporter=default --reporter=github-actions - - - name: Upload Coverage Report - if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: coverage-report-node-${{ matrix.node.name }} - path: ./**/coverage/ - retention-days: 30 - - test-integration: - name: Integration Tests - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - with: - fetch-depth: 0 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run integration tests - run: pnpm test:integration --concurrency 3 -- --coverage --reporter=default --reporter=github-actions - - - name: Upload Integration Coverage Report - if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: integration-coverage-report - path: ./**/coverage/ - retention-days: 30 - - build: - name: Build - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Build packages - run: pnpm build - - security-audit: - name: Security Audit - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run security audit - run: pnpm audit --audit-level=high - - bundle-size: - name: Bundle Size - runs-on: ubuntu-latest - timeout-minutes: 15 - needs: build - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Build packages - run: pnpm build - - - name: Report bundle sizes - run: | - echo "## Bundle Sizes" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "| Package | Size |" >> $GITHUB_STEP_SUMMARY - echo "|---------|------|" >> $GITHUB_STEP_SUMMARY - for dir in packages/*/dist; do - if [ -d "$dir" ]; then - package=$(dirname "$dir" | xargs basename) - size=$(du -sh "$dir" | cut -f1) - echo "| $package | $size |" >> $GITHUB_STEP_SUMMARY - fi - done + ci: + uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1 + with: + integration-tests: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bb9f602f..a57ea37b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,69 +1,17 @@ name: Release - on: workflow_run: workflows: ["CI"] - types: - - completed - branches: - - main - + types: [completed] + branches: [main] concurrency: ${{ github.workflow }}-${{ github.ref }} - -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: release: - name: Release - runs-on: ubuntu-latest - timeout-minutes: 30 if: ${{ github.event.workflow_run.conclusion == 'success' }} permissions: contents: write pull-requests: write id-token: write - - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - with: - # Use the PAT here too so the git remote is configured with PAT - # credentials. The bare GITHUB_TOKEN-authenticated push that - # checkout normally sets up is treated by GitHub as a bot event - # and would not fire `pull_request` workflows on the resulting - # branch — defeating the whole point of using a PAT for releases. - token: ${{ secrets.RELEASE_PAT }} - - - name: Setup - uses: ./.github/actions/setup - - # No standalone build step: the publish path (`pnpm run release`) - # already runs `pnpm build`, and the version path doesn't need one. - - name: Create Release Pull Request or Publish to npm - id: changesets - uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1 - with: - # Use `pnpm run …` so we invoke the package.json scripts. Bare - # `pnpm version` collides with pnpm's built-in `version` command and - # silently prints `process.versions` instead of running the changeset - # version script, leaving package.json files untouched and the - # release stuck. - version: pnpm run version - publish: pnpm run release - commit: "chore: release packages" - title: "chore: release packages" - env: - # Use a Personal Access Token rather than the default GITHUB_TOKEN. - # Events triggered by GITHUB_TOKEN do not start new workflow runs - # (GitHub's anti-recursion safeguard), so the "Version Packages" - # PR opened by this action would otherwise skip CI entirely. A PAT - # attributes the PR to a real user and CI fires normally. - # Required repo secret: RELEASE_PAT (classic PAT with `repo` scope, - # or a fine-grained token with Contents: read/write + Pull requests: - # read/write on this repo). - GITHUB_TOKEN: ${{ secrets.RELEASE_PAT }} - # NPM_TOKEN is intentionally absent — npm Trusted Publishing uses - # the OIDC token minted via `id-token: write` above. Each package - # must have a Trusted Publisher configured on npmjs.com pointing - # at this repo + workflow file (.github/workflows/release.yml). + uses: btravstack/config/.github/workflows/release-reusable.yml@workflows-v1 + secrets: + RELEASE_PAT: ${{ secrets.RELEASE_PAT }}