nodejs.yml

# For details of what checks are run for PRs please refer below
# docs: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions

name: Node CI

on:
  push:
    branches: [ 'main', 'master', 'next' ]
    tags: [ 'v*' ]
  pull_request:
  workflow_dispatch:
  schedule:
    # schedule daily tests, since dependencies are not intended to be locked
    # this means: at 23:42 every day
    - cron: '42 23 * * *'

concurrency:
  group: '${{ github.workflow }}-${{ github.ref }}'
  cancel-in-progress: true

permissions: {}

env:
  NODE_ACTIVE_LTS: '22'  # https://nodejs.org/en/about/releases/
  DIST_DIR: dist
  REPORTS_DIR: "CI_reports"
  TESTS_REPORTS_ARTIFACT: tests-reports
  CNPM_TEST_UPDATE_SNAPSHOTS: ''  # set to a string that nodeJS would not evaluate to TRUE - which can only be an empty string

jobs:
  build:
    name: build
    runs-on: 'ubuntu-latest'
    timeout-minutes: 10
    steps:
      - name: Checkout
        # see https://github.com/actions/checkout
        uses: actions/checkout@v4
      - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
        # see https://github.com/actions/setup-node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_ACTIVE_LTS }}
          # cache: 'npm'
      - name: setup subject
        run: npm i --ignore-scripts --loglevel=silly
      - name: build
        run: npm run build-dev
      - name: artifact build result
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.DIST_DIR }}
          path: ${{ env.DIST_DIR }}
          if-no-files-found: error

  test-standard:
    name: test standard
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        # see https://github.com/actions/checkout
        uses: actions/checkout@v4
      - name: Setup Node.js ${{ env.NODE_ACTIVE_LTS }}
        # see https://github.com/actions/setup-node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_ACTIVE_LTS }}
          # cache: "npm"
          # cache-dependency-path: "**/package-lock.json"
      - name: setup project
        run: |
          npm install --ignore-scripts --loglevel=silly
      - name: setup tools
        run: |
          echo "::group::install code-style deps"
          npm run -- dev-setup:code-style --ignore-scripts --loglevel=silly
          echo "::endgroup::"
      - name: make reports dir
        run: mkdir -p "$REPORTS_DIR"
      - name: test
        run: >
          npm run -- test:standard
          --format json
          --output-file "$PWD/$REPORTS_DIR/eslint.json"
      - name: Annotate Code
        if: ${{ failure() || success() }}
        # see https://github.com/DerLev/eslint-annotations
        uses: DerLev/eslint-annotations@v2
        with:
          eslint-report: ${{ env.REPORTS_DIR }}/eslint.json
      - name: artifact eslint result
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@v4
        if: ${{ failure() }}
        with:
          name: ${{ env.STANDARD_REPORTS_ARTIFACT }}
          path: ${{ env.REPORTS_DIR }}
          if-no-files-found: error

  test-jest:
    needs: [ 'build' ]
    name: jest (node${{ matrix.node-version }} ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        node-version:
          ## action based on https://github.com/actions/node-versions/releases
          ## see also: https://nodejs.org/en/about/releases/
          - '24'      # Current
          - '22'      # active LTS
          - '20'
          - '20.18.0' # lowest supported
        os:
          - ubuntu-latest
          - windows-latest
          - macos-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        # see https://github.com/actions/checkout
        uses: actions/checkout@v4
      - name: Setup Node.js ${{ matrix.node-version }}
        # see https://github.com/actions/setup-node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          # cache: 'npm'
      - name: npm version
        run: npm --version
      - name: setup subject
        shell: bash
        run: |
          set -ex
          dev_requirements='c8 jest jest-junit imurmurhash fast-glob'
          npm i --ignore-scripts --omit=peer --omit=dev --only=prod --production --loglevel=silly
          ## rebuild deps for which scripts were ignored, or partially installed - since "ignore-scripts" was used
          npm rebuild --loglevel=silly libxmljs2 || npm uninstall --no-save libxmljs2 || true
          ## install the needed dev-deps
          npm i --ignore-scripts --loglevel=silly --no-save $dev_requirements
      - name: fetch build artifact
        # see https://github.com/actions/download-artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.DIST_DIR }}
          path: ${{ env.DIST_DIR }}
      - name: setup-tests
        run: npm run setup-tests
      - name: test
        run: npm run test:jest
        env:
          JEST_JUNIT_OUTPUT_DIR: '${{ env.REPORTS_DIR }}/node${{ matrix.node-version }}_${{ matrix.os }}'
      - name: artifact test logs
        if: ${{ failure() }}
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@v4
        with:
          name: logs-jest_node${{ matrix.node-version }}_${{ matrix.os }}
          path: tests/_log
          if-no-files-found: error
      - name: collect coverage
        if: ${{ failure() || success() }}
        run: >
          node -- node_modules/c8/bin/c8.js
          report
          --reporter clover
          --reports-dir '${{ env.REPORTS_DIR }}/node${{ matrix.node-version }}_${{ matrix.os }}/coverage'
      - name: artifact test reports
        if: ${{ ! cancelled() }}
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@v4
        with:
          name: '${{ env.TESTS_REPORTS_ARTIFACT }}_node${{ matrix.node-version }}_${{ matrix.os }}'
          path: ${{ env.REPORTS_DIR }}

  dogfooding:
    needs: [ 'build' ]
    name: dogfooding npm ${{ matrix.npm-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - npm-version: 'latest'
          - npm-version: '^11'
            ## "node": "^20.17.0 || >=22.9.0"
            node-version: '^22.9'
          - npm-version: '^10'
            ## "node": "^18.17.0 || >=20.5.0"
            node-version: '^20.18'
          - npm-version: '^9'
            ## "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
            node-version: '^20.18'
    env:
      npm_config_engine_strict: true
    timeout-minutes: 10
    steps:
      - name: Checkout
        # see https://github.com/actions/checkout
        uses: actions/checkout@v4
      - run: mkdir -p ${{ env.REPORTS_DIR }}
      - name: Setup Node.js ${{ matrix.node-version }}
        # see https://github.com/actions/setup-node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version || env.NODE_ACTIVE_LTS }}
          # cache: 'npm'
      - name: setup npm ${{ matrix.npm-version }}
        run: |
          npm i -g npm@${{ matrix.npm-version }}
          npm --version
      - name: setup subject
        shell: bash
        run: |
          set -ex
          if [[ '${{ matrix.npm-version }}' = '^9' ]]
          then
            # npm9 is bugged, - it does not properly check dependencies' engine requirements to select sufficient candidates... lets do this manually
            npm i --no-save --ignore-scripts --loglevel=silly npm-run-all2@^7
          fi
          npm i --ignore-scripts --omit=dev --only=prod --production --loglevel=silly
          ## rebuild deps for which scripts were ignored, or partially installed - since "ignore-scripts" was used
          npm rebuild --loglevel=silly libxmljs2 || npm uninstall --no-save libxmljs2 || true
      - name: fetch build artifact
        # see https://github.com/actions/download-artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ env.DIST_DIR }}
          path: ${{ env.DIST_DIR }}
      - name: dogfooding
        run: >
          node -- bin/cyclonedx-npm-cli.js
          -vvv
          --ignore-npm-errors
          --omit=dev
          --validate
          --output-file=${{ env.REPORTS_DIR }}/bom.json
      - name: artifact test reports
        if: ${{ failure() }}
        # see https://github.com/actions/upload-artifact
        uses: actions/upload-artifact@v4
        with:
          name: dogfooding-direct_npm${{ matrix.npm-version }}
          path: ${{ env.REPORTS_DIR }}
          if-no-files-found: error

  report-coverage:
    name: Publish test coverage
    needs:
      - test-jest
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: fetch test artifacts
        # see https://github.com/actions/download-artifact
        uses: actions/download-artifact@v4
        with:
          pattern: '${{ env.TESTS_REPORTS_ARTIFACT }}_*'
          merge-multiple: true
          path: ${{ env.REPORTS_DIR }}
      - name: Run codacy-coverage-reporter
        env:
          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
        ## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
        if: ${{ env.CODACY_PROJECT_TOKEN != '' }}
        # see https://github.com/codacy/codacy-coverage-reporter-action
        uses: codacy/codacy-coverage-reporter-action@v1
        with:
          project-token: ${{ env.CODACY_PROJECT_TOKEN }}
          coverage-reports: ${{ env.REPORTS_DIR }}/*/coverage/*