Harden dependency refresh and CI supply chain #622
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: [push, pull_request] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| version: | |
| name: Determine build version | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.version.outputs.version }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup .NET SDK for MinVer | |
| uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0 | |
| with: | |
| dotnet-version: "10.0.x" | |
| - name: Build Version | |
| id: version | |
| shell: bash | |
| run: | | |
| branch=${GITHUB_REF##*/}. | |
| if [[ "$branch" = "main." ]]; then | |
| branch="" | |
| elif [[ "$branch" = "master." ]]; then | |
| branch="" | |
| elif [[ "${GITHUB_REF}" = refs/tags* ]]; then | |
| branch="" | |
| elif [[ "${GITHUB_REF}" = refs/pull* ]]; then | |
| branch="" | |
| fi | |
| dotnet tool install --global minver-cli --version 7.0.0 | |
| version=$(minver --tag-prefix v --default-pre-release-identifiers "preview.${branch}0" --minimum-major-minor 3.0) | |
| if [ -n "$branch" ]; then | |
| branch_name="${branch%.}" | |
| if [[ "$version" != *"$branch_name"* ]]; then | |
| version=$(echo "$version" | sed -E "s/\.([0-9]+)$/.${branch}\1/") | |
| fi | |
| fi | |
| echo "version=$version" >> "$GITHUB_OUTPUT" | |
| echo "Version: $version" | |
| echo "### Version: $version" >> "$GITHUB_STEP_SUMMARY" | |
| build: | |
| needs: version | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: | |
| - ubuntu-latest | |
| - macos-latest | |
| - windows-latest | |
| node_version: | |
| - 24 | |
| name: Node ${{ matrix.node_version }} on ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Node.js environment | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: ${{ matrix.node_version }} | |
| registry-url: "https://registry.npmjs.org" | |
| cache: npm | |
| cache-dependency-path: package-lock.json | |
| - name: Apply Build Version | |
| env: | |
| BUILD_VERSION: ${{ needs.version.outputs.version }} | |
| run: node scripts/set-build-version.mjs | |
| - name: Install Dependencies | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Lint | |
| run: npm run lint | |
| - name: Run Tests | |
| run: npm test | |
| publish-release: | |
| name: Publish npm release | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: [version, build] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write # Required for npm trusted publishing. | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Node.js environment | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| registry-url: "https://registry.npmjs.org" | |
| cache: npm | |
| cache-dependency-path: package-lock.json | |
| - name: Apply Build Version | |
| env: | |
| BUILD_VERSION: ${{ needs.version.outputs.version }} | |
| run: node scripts/set-build-version.mjs | |
| - name: Install Dependencies | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Publish Release Packages | |
| run: npm publish --workspaces --access public | |
| publish-github: | |
| name: Publish GitHub CI packages | |
| if: github.event_name == 'push' && startsWith(github.ref, 'refs/heads/') && contains(needs.version.outputs.version, '-') | |
| needs: [version, build] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write # Required to publish with GITHUB_TOKEN. | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Node.js environment | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| registry-url: "https://registry.npmjs.org" | |
| cache: npm | |
| cache-dependency-path: package-lock.json | |
| - name: Apply Build Version | |
| env: | |
| BUILD_VERSION: ${{ needs.version.outputs.version }} | |
| run: node scripts/set-build-version.mjs | |
| - name: Install Dependencies | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Setup GitHub Packages registry | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| registry-url: "https://npm.pkg.github.com" | |
| scope: "@exceptionless" | |
| - name: Push GitHub CI Packages | |
| shell: bash | |
| run: | # zizmor: ignore[use-trusted-publishing] GitHub Packages uses GITHUB_TOKEN. | |
| TAG_BRANCH="${GITHUB_REF##*/}" | |
| npm publish --workspaces --access public --tag "ci-${TAG_BRANCH}" | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |