Skip to content

Commit dce8d34

Browse files
xunleiixunleii
committed
🧑‍💻: Add GitHub Actions workflows for improved linting and testing
- Added a new workflow for linting all files on merge and pull request events. - Introduced a testing workflow that runs Jest tests on specified paths during pull requests. - Enhanced the build workflow to ensure proper setup and artifact management. Signed-off-by: Alexandre Nicolaie <[email protected]>
1 parent fbf4dd4 commit dce8d34

11 files changed

+447
-2
lines changed

‎.github/workflows/merge_group,pull_request.all.lint.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: 🚨 Lint Everything
3+
4+
on:
5+
merge_group: {}
6+
pull_request: {}
7+
8+
concurrency:
9+
group: ${{ github.action }}-${{ github.event.pull_request.id }}
10+
cancel-in-progress: true
11+
12+
permissions: {}
13+
14+
jobs:
15+
trunk:
16+
name: ✅ Validate code quality
17+
permissions:
18+
contents: read
19+
checks: write
20+
runs-on: ubuntu-latest
21+
steps:
22+
- name: ⬇️ Checkout repository
23+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
24+
- name: ⚡️ Run `trunk check`
25+
uses: trunk-io/trunk-action@4d5ecc89b2691705fd08c747c78652d2fc806a94 # v1.1.19

‎.github/workflows/merge_group,pull_request.all.tests.yaml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
name: 🧪 Run Tests
3+
4+
on:
5+
merge_group: {}
6+
pull_request:
7+
paths:
8+
- src/
9+
- package.json
10+
- pnpm-lock.yaml
11+
12+
concurrency:
13+
group: ${{ github.action }}-${{ github.event.pull_request.id }}
14+
cancel-in-progress: true
15+
16+
permissions: {}
17+
18+
jobs:
19+
tests:
20+
name: ✅ Run Jest Tests
21+
runs-on: ubuntu-latest
22+
permissions:
23+
contents: read
24+
checks: write
25+
steps:
26+
- name: ⬇️ Checkout repository
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
29+
- name: 🏗️ Setup Node.js
30+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
31+
with:
32+
node-version: 20
33+
34+
- name: 📦 Install PNPM
35+
run: npm install -g pnpm
36+
37+
- name: 📦 Install dependencies
38+
run: pnpm install
39+
40+
- name: 🧪 Run tests
41+
run: pnpm test
42+
43+
- name: 📊 Upload test results
44+
uses: dorny/test-reporter@6e6a65b7a0bd2c9197df7d0ae36ac5cee784230c # v2.0.0
45+
if: always()
46+
with:
47+
name: Jest Test Results
48+
path: junit.xml
49+
reporter: jest-junit
50+
fail-on-error: true

‎.github/workflows/push,pull_request.build.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
name: 🏗️ Build Extension
3+
4+
on:
5+
push:
6+
branches: [main]
7+
paths:
8+
- src/
9+
- package.json
10+
- pnpm-lock.yaml
11+
pull_request:
12+
paths:
13+
- src/
14+
- package.json
15+
- pnpm-lock.yaml
16+
17+
permissions: {}
18+
19+
jobs:
20+
build:
21+
name: 🏗️ Build ArgoCD extension
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
steps:
26+
- name: ⬇️ Checkout repository
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
29+
- name: 🏗️ Setup Node.js
30+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
31+
with:
32+
node-version: 20
33+
34+
- name: 📦 Install PNPM
35+
run: npm install -g pnpm
36+
37+
- name: 📦 Install dependencies
38+
run: pnpm install
39+
40+
- name: 🔨 Build the extension
41+
run: pnpm build:prod
42+
43+
- name: 📂 Upload build artifacts
44+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
45+
with:
46+
name: extension-build
47+
path: dist/
48+
if-no-files-found: error
49+
retention-days: 7

‎.github/workflows/push.release.yaml

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
name: 🚀 Release Extension
3+
4+
on:
5+
push:
6+
branches: [main]
7+
paths:
8+
- package.json
9+
10+
permissions:
11+
contents: write
12+
discussions: write
13+
14+
jobs:
15+
check-version:
16+
name: 🔍 Check version change
17+
runs-on: ubuntu-latest
18+
outputs:
19+
should_release: ${{ steps.check.outputs.should_release }}
20+
version: ${{ steps.check.outputs.version }}
21+
permissions:
22+
contents: read
23+
steps:
24+
- name: ⬇️ Checkout repository
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
with:
27+
fetch-depth: 2
28+
29+
- name: 🔍 Check for version change
30+
id: check
31+
run: |
32+
# Get current version
33+
CURRENT_VERSION=$(node -p "require('./package.json').version")
34+
echo "Current version: $CURRENT_VERSION"
35+
36+
# Get previous version from the previous commit
37+
git checkout HEAD~1
38+
if [ -f "package.json" ]; then
39+
PREVIOUS_VERSION=$(node -p "try { require('./package.json').version } catch { 'none' }")
40+
else
41+
PREVIOUS_VERSION="none"
42+
fi
43+
git checkout -
44+
echo "Previous version: $PREVIOUS_VERSION"
45+
46+
# Check if version has changed
47+
if [ "$CURRENT_VERSION" != "$PREVIOUS_VERSION" ]; then
48+
echo "Version has changed from $PREVIOUS_VERSION to $CURRENT_VERSION"
49+
echo "should_release=true" >> $GITHUB_OUTPUT
50+
echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
51+
else
52+
echo "Version has not changed ($CURRENT_VERSION)"
53+
echo "should_release=false" >> $GITHUB_OUTPUT
54+
echo "version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
55+
fi
56+
57+
build:
58+
name: 📦 Build and Release
59+
needs: check-version
60+
if: needs.check-version.outputs.should_release == 'true'
61+
runs-on: ubuntu-latest
62+
steps:
63+
- name: ⬇️ Checkout repository
64+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
65+
66+
- name: 🏗️ Setup Node.js
67+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
68+
with:
69+
node-version: 20
70+
71+
- name: 📦 Install PNPM
72+
run: npm install -g pnpm
73+
74+
- name: 📦 Install dependencies
75+
run: pnpm install
76+
77+
- name: 🔨 Build the extension
78+
run: pnpm build:prod && pnpm build:enpack
79+
80+
- name: 📄 Create checksums
81+
run: |
82+
SHA256_FILE="extension_checksums.txt"
83+
sha256sum ./dist/extension.tar > ${SHA256_FILE}
84+
echo "Created checksum file: ${SHA256_FILE}"
85+
cat ${SHA256_FILE}
86+
87+
- name: 🚀 Create GitHub Release
88+
run: |
89+
VERSION="v${{ needs.check-version.outputs.version }}"
90+
gh release create ${VERSION} --draft --generate-notes ./dist/extension.tar ./extension_checksums.txt
91+
env:
92+
GH_TOKEN: ${{ github.token }}

‎.github/workflows/push.trunk-cache.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
name: ♻️ Refresh Trunk cache
3+
4+
on:
5+
push:
6+
branches: [main]
7+
paths: [.trunk/trunk.yaml]
8+
9+
permissions: {}
10+
11+
jobs:
12+
trunk-cache:
13+
name: ♻️ Refresh Trunk cache
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
actions: write
18+
19+
steps:
20+
- name: ⬇️ Checkout repository
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
- name: 📦️ Populate cache with Trunk
23+
uses: trunk-io/trunk-action@4d5ecc89b2691705fd08c747c78652d2fc806a94 # v1.1.19
24+
with:
25+
check-mode: populate_cache_only

‎.github/workflows/security.dependencies.yaml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
name: 🔒️ Security checks (Dependencies)
3+
4+
on:
5+
push:
6+
branches: [main]
7+
paths: [package.json, pnpm-lock.yaml]
8+
pull_request:
9+
paths: [package.json, pnpm-lock.yaml]
10+
schedule:
11+
- cron: 0 0 * * 1 # Run every Monday at midnight
12+
workflow_dispatch: {}
13+
14+
permissions: {}
15+
16+
jobs:
17+
security_audit:
18+
name: 🔍 Dependency security audit
19+
runs-on: ubuntu-latest
20+
permissions:
21+
contents: read
22+
security-events: write
23+
steps:
24+
- name: ⬇️ Checkout repository
25+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
26+
27+
- name: 🏗️ Setup Node.js
28+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
29+
with:
30+
node-version: 20
31+
32+
- name: 📦 Install PNPM
33+
run: npm install -g pnpm
34+
35+
- name: 🔒 Install dependencies
36+
run: pnpm install
37+
38+
- name: 🛡️ Run security audit
39+
run: pnpm audit --json | pnpx npm-audit-sarif /dev/stdin > pnpm-audit.sarif || true
40+
41+
- name: 📊 Upload audit results to GitHub Code Scanning
42+
uses: github/codeql-action/upload-sarif@018ac1a585e52f775ee7460e25bd00c4d516240e # v2.21.2
43+
with:
44+
sarif_file: pnpm-audit.sarif
45+
category: pnpm-audit

‎.github/workflows/security.workflows.yaml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
name: 🔒️ Security hardening (Github Actions workflows)
3+
4+
on:
5+
merge_group: {}
6+
pull_request:
7+
types: [opened, synchronize]
8+
paths: [.github/workflows/**]
9+
10+
permissions: {}
11+
12+
jobs:
13+
ci_harden_security:
14+
name: 🔒️ Github Action security hardening
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
steps:
19+
- name: ⬇️ Checkout repository
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
22+
- name: 📄 Lint Github Actions
23+
run: |
24+
curl -O https://raw.githubusercontent.com/rhysd/actionlint/4f6274a8e0f4f4d2057aa9ae07660f61aa29c5f3/.github/actionlint-matcher.json
25+
26+
echo "::add-matcher::actionlint-matcher.json"
27+
bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/4f6274a8e0f4f4d2057aa9ae07660f61aa29c5f3/scripts/download-actionlint.bash)
28+
./actionlint -color
29+
30+
- name: ✅ Ensure SHA pinned actions
31+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@4830be28ce81da52ec70d65c552a7403821d98d4 # v3.0.23

0 commit comments

Comments
 (0)