Skip to content

Commit 6348314

Browse files
SamuelSSalazarSamuelSSalazar
authored
ci: add semantic-release automation (#119)
1 parent 6354350 commit 6348314

File tree

13 files changed

+13935
-1526
lines changed

13 files changed

+13935
-1526
lines changed

‎.commitlintrc.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"extends": ["@commitlint/config-conventional"]
3+
}

‎.github/workflows/commitlint.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Lint Commits
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
commitlint:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Checkout code
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
12+
with:
13+
fetch-depth: 0
14+
persist-credentials: false
15+
16+
- name: Setup Node.js
17+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
18+
with:
19+
node-version: '24'
20+
21+
- name: Install dependencies
22+
run: npm ci
23+
24+
- name: Validate commit messages
25+
run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

‎.github/workflows/prepare-release.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Prepare Release
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
concurrency:
9+
group: prepare-release
10+
cancel-in-progress: true
11+
12+
permissions:
13+
contents: write
14+
pull-requests: write
15+
16+
jobs:
17+
prepare:
18+
runs-on: ubuntu-latest
19+
if: "!startsWith(github.event.head_commit.message, 'chore(release):')"
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
ref: master
25+
fetch-depth: 0
26+
persist-credentials: false
27+
28+
- name: Setup Node.js
29+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
30+
with:
31+
node-version: '24'
32+
33+
- name: Install dependencies
34+
run: npm ci
35+
36+
- name: Detect Next Version
37+
id: version
38+
env:
39+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40+
run: |
41+
# Run semantic-release with only commit analyzer to detect version
42+
NEXT_VERSION=$(npx semantic-release --dry-run --plugins @semantic-release/commit-analyzer | tee /dev/stderr | awk '/The next release version is/{print $NF}')
43+
echo "next=$NEXT_VERSION" >> $GITHUB_OUTPUT
44+
45+
- name: Update package.json
46+
if: steps.version.outputs.next != ''
47+
run: npm version "$NEXT_VERSION" --no-git-tag-version
48+
env:
49+
NEXT_VERSION: ${{ steps.version.outputs.next }}
50+
51+
- name: Create Pull Request
52+
if: steps.version.outputs.next != ''
53+
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
54+
with:
55+
token: ${{ secrets.GITHUB_TOKEN }}
56+
commit-message: "chore(release): ${{ steps.version.outputs.next }}"
57+
branch: "release/v${{ steps.version.outputs.next }}"
58+
delete-branch: true
59+
title: "chore(release): ${{ steps.version.outputs.next }}"
60+
body: |
61+
This PR prepares the release of version ${{ steps.version.outputs.next }}.
62+
63+
**Changes:**
64+
- Updated version in `package.json` to ${{ steps.version.outputs.next }}
65+
- Updated version in `package-lock.json` to ${{ steps.version.outputs.next }}
66+
67+
**Next Steps:**
68+
Review and merge this PR to trigger the publish workflow.
69+
labels: release

‎.github/workflows/release.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
permissions:
9+
contents: write
10+
issues: write
11+
pull-requests: write
12+
id-token: write
13+
14+
jobs:
15+
release:
16+
runs-on: ubuntu-latest
17+
if: startsWith(github.event.head_commit.message, 'chore(release):')
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
fetch-depth: 0
24+
persist-credentials: false
25+
26+
- name: Setup Node.js
27+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
28+
with:
29+
node-version: '24'
30+
31+
- name: Install dependencies
32+
run: npm ci
33+
34+
- name: Set up Python
35+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
36+
with:
37+
python-version: "3.10"
38+
39+
- name: Install Python dependencies
40+
shell: bash
41+
run: pip install boto3>=1.34.159 requests>=2.32.3 rl-deploy>=2.2.3.0 pip-system-certs>=4.0
42+
43+
- name: Configure AWS credentials
44+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
45+
with:
46+
role-to-assume: ${{ secrets.PRODSEC_TOOLS_ARN }}
47+
aws-region: us-east-1
48+
mask-aws-account-id: true
49+
50+
- name: Install rl-wrapper
51+
env:
52+
WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
53+
run: pip install "rl-wrapper>=1.0.0" --index-url $WRAPPER_INDEX_URL
54+
55+
- name: Release
56+
env:
57+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
NPM_CONFIG_PROVENANCE: true
59+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
60+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
61+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
62+
PYTHONUNBUFFERED: 1
63+
run: npx semantic-release

‎.github/workflows/sca-scan.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Snyk Scan
2+
3+
on:
4+
push:
5+
branches: ["master"]
6+
7+
jobs:
8+
snyk-cli:
9+
uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@5246a8b59100e3eea284ce4f2e2a51b51e237380
10+
secrets: inherit

‎.github/workflows/semgrep.yml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎.github/workflows/test.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,17 @@ jobs:
2323
runs-on: ubuntu-latest
2424
strategy:
2525
matrix:
26-
node: [ 12, 14, 16 ]
26+
node: [22, 24]
2727
name: Node ${{ matrix.node }} Test
2828
steps:
2929
- name: Checkout code
30-
uses: actions/checkout@v4
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3131
with:
3232
ref: ${{ github.event.pull_request.head.sha || github.ref }}
33+
persist-credentials: false
3334

3435
- name: Setup Node
35-
uses: actions/setup-node@v4
36+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
3637
with:
3738
node-version: ${{ matrix.node }}
3839
cache: 'npm'

‎.husky/commit-msg‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
npx --no -- commitlint --edit $1

‎.releaserc.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"branches": ["master"],
3+
"plugins": [
4+
"@semantic-release/commit-analyzer",
5+
"@semantic-release/release-notes-generator",
6+
[
7+
"@semantic-release/npm",
8+
{
9+
"npmPublish": true,
10+
"pkgRoot": "."
11+
}
12+
],
13+
[
14+
"@semantic-release/exec",
15+
{
16+
"verifyReleaseCmd": "ARTIFACT=\"$(pwd)/$(npm pack --ignore-scripts | tail -1)\" && rl-wrapper --artifact \"$ARTIFACT\" --name node-xml-encryption --version ${nextRelease.version} --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --build-env github_actions --suppress-output",
17+
"prepareCmd": "git diff --exit-code"
18+
}
19+
],
20+
"@semantic-release/github"
21+
]
22+
}

‎.travis.yml‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

0 commit comments

Comments
 (0)