Add CI and a manual release workflow, plus a changelog #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Weekly, so a CVE disclosed in a dependency surfaces without anyone pushing. | |
| schedule: | |
| - cron: '0 6 * * 1' | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # 20 is the floor declared in package.json engines; 22 is current LTS. | |
| node: [20, 22] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| cache: npm | |
| - run: npm ci | |
| - name: Typecheck | |
| run: npx tsc -p tsconfig.json --noEmit | |
| - name: Test | |
| run: npm test | |
| - name: Verify the published tarball contains what it should | |
| if: matrix.node == 22 | |
| run: | | |
| npm pack --dry-run --json > pack.json | |
| node -e " | |
| const files = require('./pack.json')[0].files.map(f => f.path); | |
| const needed = ['dist/cli.js', 'README.md', 'LICENSE']; | |
| const missing = needed.filter(n => !files.includes(n)); | |
| if (missing.length) { | |
| console.error('missing from tarball:', missing.join(', ')); | |
| process.exit(1); | |
| } | |
| // Nothing from the working tree that is not meant to ship. | |
| const leaked = files.filter(f => /^(src|test|\.github|docs)\//.test(f)); | |
| if (leaked.length) { | |
| console.error('unexpected files in tarball:', leaked.join(', ')); | |
| process.exit(1); | |
| } | |
| console.log(files.length + ' files, all expected'); | |
| " | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| # Runtime dependencies only: a dev-only advisory should not block a release, | |
| # but anything reaching a user's machine should. | |
| - name: Audit production dependencies | |
| run: npm audit --omit=dev --audit-level=moderate |