Skip to content

Commit b543533

Browse files
SamuelSSalazarSamuelSSalazar
committed
ci: add semantic-release automation
1 parent 2db36ae commit b543533

File tree

10 files changed

+214
-25
lines changed

10 files changed

+214
-25
lines changed

‎.commitlintrc.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"extends": ["@commitlint/config-conventional"]
3+
}

‎.github/workflows/commitlint.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Lint Commits
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
commitlint:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Checkout code
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
12+
with:
13+
fetch-depth: 0
14+
persist-credentials: false
15+
16+
- name: Setup Node.js
17+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
18+
with:
19+
node-version: '24'
20+
21+
- name: Install dependencies
22+
run: npm install
23+
24+
- name: Validate commit messages
25+
run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

‎.github/workflows/prepare-release.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: Prepare Release
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
concurrency:
9+
group: prepare-release
10+
cancel-in-progress: true
11+
12+
permissions:
13+
contents: write
14+
pull-requests: write
15+
16+
jobs:
17+
prepare:
18+
runs-on: ubuntu-latest
19+
if: "!startsWith(github.event.head_commit.message, 'chore(release):')"
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
fetch-depth: 0
25+
persist-credentials: false
26+
27+
- name: Setup Node.js
28+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
29+
with:
30+
node-version: '24'
31+
32+
- name: Install dependencies
33+
run: npm install
34+
35+
- name: Detect Next Version
36+
id: version
37+
env:
38+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
39+
run: |
40+
NEXT_VERSION=$(npx semantic-release --dry-run --plugins @semantic-release/commit-analyzer | tee /dev/stderr | awk '/The next release version is/{print $NF}')
41+
echo "next=$NEXT_VERSION" >> $GITHUB_OUTPUT
42+
43+
- name: Update package.json
44+
if: steps.version.outputs.next != ''
45+
run: npm version "$NEXT_VERSION" --no-git-tag-version
46+
env:
47+
NEXT_VERSION: ${{ steps.version.outputs.next }}
48+
49+
- name: Update CHANGELOG.md
50+
if: steps.version.outputs.next != ''
51+
run: npx conventional-changelog-cli -p angular -i CHANGELOG.md -s
52+
53+
- name: Create Pull Request
54+
if: steps.version.outputs.next != ''
55+
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
56+
with:
57+
token: ${{ secrets.GITHUB_TOKEN }}
58+
commit-message: "chore(release): ${{ steps.version.outputs.next }}"
59+
branch: "release/v${{ steps.version.outputs.next }}"
60+
delete-branch: true
61+
title: "chore(release): ${{ steps.version.outputs.next }}"
62+
body: |
63+
This PR prepares the release of version ${{ steps.version.outputs.next }}.
64+
65+
**Changes:**
66+
- Updated version in `package.json` to ${{ steps.version.outputs.next }}
67+
- Updated `CHANGELOG.md` with release notes
68+
69+
**Next Steps:**
70+
Review and merge this PR to trigger the publish workflow.
71+
labels: release

‎.github/workflows/release.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
permissions:
9+
contents: write
10+
issues: write
11+
pull-requests: write
12+
id-token: write
13+
14+
jobs:
15+
release:
16+
runs-on: ubuntu-latest
17+
if: startsWith(github.event.head_commit.message, 'chore(release):')
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
fetch-depth: 0
24+
persist-credentials: false
25+
26+
- name: Setup Node.js
27+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
28+
with:
29+
node-version: '24'
30+
31+
- name: Install dependencies
32+
run: npm install
33+
34+
- name: Set up Python
35+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
36+
with:
37+
python-version: "3.10"
38+
39+
- name: Install Python dependencies
40+
shell: bash
41+
run: pip install boto3>=1.34.159 requests>=2.32.3 rl-deploy>=2.2.3.0 pip-system-certs>=4.0
42+
43+
- name: Configure AWS credentials
44+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
45+
with:
46+
role-to-assume: ${{ secrets.PRODSEC_TOOLS_ARN }}
47+
aws-region: us-east-1
48+
mask-aws-account-id: true
49+
50+
- name: Install rl-wrapper
51+
env:
52+
WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
53+
run: pip install "rl-wrapper>=1.0.0" --index-url $WRAPPER_INDEX_URL
54+
55+
- name: Release
56+
env:
57+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
NPM_CONFIG_PROVENANCE: true
59+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
60+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
61+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
62+
PYTHONUNBUFFERED: 1
63+
run: npx semantic-release

‎.github/workflows/sca-scan.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Snyk Scan
2+
3+
on:
4+
push:
5+
branches: ["master"]
6+
7+
jobs:
8+
snyk-cli:
9+
uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@5246a8b59100e3eea284ce4f2e2a51b51e237380
10+
secrets: inherit

‎.github/workflows/semgrep.yml‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎.github/workflows/test.yml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
name: Test
22

33
on:
4-
push:
5-
branches: [master]
64
pull_request:
7-
branches: [master]
5+
6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.ref }}
8+
cancel-in-progress: true
89

910
permissions:
1011
contents: read
@@ -14,16 +15,19 @@ jobs:
1415
strategy:
1516
fail-fast: false
1617
matrix:
17-
node: [14, 16, 18, 20, 22, 24]
18+
node: [16, 18, 20, 22, 24]
1819

1920
name: Test (Node ${{ matrix.node }})
2021
runs-on: ubuntu-latest
2122

2223
steps:
2324
- name: Checkout code
24-
uses: actions/checkout@v6
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26+
with:
27+
persist-credentials: false
28+
2529
- name: Setup Node
26-
uses: actions/setup-node@v6
30+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
2731
with:
2832
node-version: ${{ matrix.node }}
2933

‎.husky/commit-msg‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
npx --no -- commitlint --edit ${1}

‎.releaserc.json‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"branches": [
3+
"master"
4+
],
5+
"plugins": [
6+
"@semantic-release/commit-analyzer",
7+
"@semantic-release/release-notes-generator",
8+
[
9+
"@semantic-release/npm",
10+
{
11+
"npmPublish": true,
12+
"pkgRoot": "."
13+
}
14+
],
15+
[
16+
"@semantic-release/exec",
17+
{
18+
"verifyReleaseCmd": "ARTIFACT=\"$(pwd)/$(npm pack --ignore-scripts | tail -1)\" && rl-wrapper --artifact \"$ARTIFACT\" --name jsonwebtoken --version ${nextRelease.version} --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --build-env github_actions --suppress-output",
19+
"prepareCmd": "git diff --exit-code"
20+
}
21+
],
22+
"@semantic-release/github"
23+
]
24+
}

‎package.json‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@
2121
"scripts": {
2222
"lint": "eslint .",
2323
"coverage": "nyc mocha --use_strict",
24-
"test": "mocha"
24+
"test": "mocha",
25+
"prepare": "husky"
2526
},
2627
"repository": {
2728
"type": "git",
@@ -48,13 +49,18 @@
4849
"semver": "^7.5.4"
4950
},
5051
"devDependencies": {
52+
"@commitlint/cli": "^20.3.1",
53+
"@commitlint/config-conventional": "^20.3.1",
54+
"@semantic-release/exec": "^7.0.3",
5155
"atob": "^2.1.2",
5256
"chai": "^4.1.2",
5357
"conventional-changelog": "~1.1.0",
5458
"eslint": "^4.19.1",
59+
"husky": "^9.1.7",
5560
"mocha": "^5.2.0",
5661
"nsp": "^2.6.2",
5762
"nyc": "^11.9.0",
63+
"semantic-release": "^25.0.2",
5864
"sinon": "^6.0.0"
5965
},
6066
"engines": {

0 commit comments

Comments
 (0)