From 7e1509bde89edf5aa21b467265cfc16ef7999fc8 Mon Sep 17 00:00:00 2001 From: Evan Sims Date: Fri, 15 Sep 2023 02:51:18 -0500 Subject: [PATCH 1/5] test: Migrate CI to GitHub Actions [SDK-4451] --- .github/actions/build/action.yml | 24 ++++++ .github/dependabot.yml | 6 ++ .github/workflows/codeql.yml | 53 ++++++++++++ .github/workflows/publish.yml | 137 +++++++++++++++++++++++++++++++ .github/workflows/semgrep.yml | 41 +++++++-- .github/workflows/snyk.yml | 47 +++++++++++ .github/workflows/test.yml | 85 +++++++++++++++++++ 7 files changed, 385 insertions(+), 8 deletions(-) create mode 100644 .github/actions/build/action.yml create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/publish.yml create mode 100644 .github/workflows/snyk.yml create mode 100644 .github/workflows/test.yml diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml new file mode 100644 index 0000000..cb72bc2 --- /dev/null +++ b/.github/actions/build/action.yml @@ -0,0 +1,24 @@ +name: Build package +description: Build the SDK package + +inputs: + node: + description: The Node version to use + required: false + default: 18 + +runs: + using: composite + + steps: + - name: Setup Node + uses: actions/setup-node@v3 + with: + node-version: ${{ inputs.node }} + cache: npm + + - name: Install dependencies + shell: bash + run: npm ci + env: + NODE_ENV: development diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..6778b04 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: 'github-actions' + directory: '/' + schedule: + interval: 'daily' diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..f47f679 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,53 @@ +name: CodeQL + +on: + merge_group: + pull_request: + types: + - opened + - synchronize + push: + branches: + - master + schedule: + - cron: '37 10 * * 2' + +permissions: + actions: read + contents: read + security-events: write + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.ref != 'refs/heads/master' }} + +jobs: + analyze: + name: Check for Vulnerabilities + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + language: [javascript] + + steps: + - if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group' + run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection. + + - name: Checkout + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v2 + with: + languages: ${{ matrix.language }} + queries: +security-and-quality + + - name: Autobuild + uses: github/codeql-action/autobuild@v2 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v2 + with: + category: '/language:${{ matrix.language }}' diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..2f79d54 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,137 @@ +name: Publish Release + +on: + workflow_dispatch: + inputs: + branch: + description: The branch to release from + required: true + default: master + version: + description: The version being published. This should be a valid semver version, such as `1.0.0`. + required: true + default: '' + type: string + dry-run: + type: boolean + description: Perform a publishing dry run. This will not publish the release, but will validate the release and log the commands that would be run. + default: false + +permissions: + contents: read + id-token: write # For publishing to NPM with provenance. Allows developers to run `npm audit signatures` and verify release signature of SDK. @see https://github.blog/2023-04-19-introducing-npm-package-provenance/ + packages: write # For cross-publishing to GitHub Packages registry. + +env: + NODE_VERSION: 18 + NODE_ENV: development + +jobs: + configure: + name: Validate input parameters + runs-on: ubuntu-latest + + outputs: + vtag: ${{ steps.vtag.outputs.vtag }} # The fully constructed release tag to use for publishing + dry-run: ${{ steps.dry-run.outputs.dry-run }} # The dry-run flag to use for publishing, if applicable + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + fetch-depth: 0 + ref: ${{ github.event.inputs.branch }} + + # Configure for dry-run, if applicable. @see https://docs.npmjs.com/cli/v9/commands/npm-publish#dry-run + - id: dry-run + if: ${{ github.event.inputs.dry-run == 'true' }} + name: Configure for `--dry-run` + run: | + echo "dry-run=--dry-run" >> $GITHUB_ENV + echo "dry-run=--dry-run" >> $GITHUB_OUTPUT + + # Build the tag string from package.json version and release suffix. Produces something like `1.0.0-beta.1` for a beta, or `1.0.0` for a stable release. + - name: Build tag + id: vtag + run: | + PACKAGE_VERSION="${{ github.event.inputs.version }}" + echo "vtag=${PACKAGE_VERSION}" >> $GITHUB_ENV + echo "vtag=${PACKAGE_VERSION}" >> $GITHUB_OUTPUT + + # Ensure tag does not already exist. + - name: Validate version + uses: actions/github-script@v6 + env: + vtag: ${{ env.vtag }} + with: + script: | + const releaseMeta = github.rest.repos.listReleases.endpoint.merge({ + owner: context.repo.owner, + repo: context.repo.repo, + }); + + const releases = await github.paginate(releaseMeta); + + for (const release of releases) { + if (release.name === process.env.vtag) { + throw new Error(`${process.env.vtag} already exists`); + } + } + + console.log(`${process.env.vtag} does not exist. Proceeding with release.`) + + publish-npm: + needs: configure + + name: Publish to NPM + runs-on: ubuntu-latest + environment: 'release' + + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + ref: ${{ github.event.inputs.branch }} + + - name: Setup Node + uses: actions/setup-node@v3 + with: + node-version: ${{ env.NODE_VERSION }} + cache: npm + + - name: Install dependencies + run: npm ci + + - name: Publish release to NPM + run: npm publish --provenance --tag ${{ needs.configure.outputs.vtag }} ${{ needs.configure.outputs.dry-run }} + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + + publish-gh: + needs: + - configure + - publish-npm # Don't publish to GitHub Packages until publishing to NPM is successfully completed + + name: Publish to GitHub Packages + runs-on: ubuntu-latest + environment: 'release' + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup Node + uses: actions/setup-node@v3 + with: + node-version: ${{ env.NODE_VERSION }} + registry-url: 'https://npm.pkg.github.com' + cache: npm + + - name: Install dependencies + run: npm ci + + - name: Publish release to GitHub Packages + run: npm publish --provenance --tag ${{ needs.configure.outputs.vtag }} ${{ needs.configure.outputs.dry-run }} + env: + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml index e0227e3..fc7d2ee 100644 --- a/.github/workflows/semgrep.yml +++ b/.github/workflows/semgrep.yml @@ -1,23 +1,48 @@ name: Semgrep on: - pull_request: {} - + merge_group: + pull_request_target: + types: + - opened + - synchronize push: - branches: ["master", "main"] - + branches: + - master schedule: - cron: '30 0 1,15 * *' +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.ref != 'refs/heads/master' }} + jobs: - semgrep: - name: Scan + authorize: + name: Authorize + environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }} runs-on: ubuntu-latest + steps: + - run: true + + run: + needs: authorize # Require approval before running on forked pull requests + + name: Check for Vulnerabilities + runs-on: ubuntu-latest + container: image: returntocorp/semgrep - if: (github.actor != 'dependabot[bot]') + steps: - - uses: actions/checkout@v3 + - if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group' + run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection. + + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha || github.ref }} - run: semgrep ci env: diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml new file mode 100644 index 0000000..4b27ea3 --- /dev/null +++ b/.github/workflows/snyk.yml @@ -0,0 +1,47 @@ +name: Snyk + +on: + merge_group: + workflow_dispatch: + pull_request_target: + types: + - opened + - synchronize + push: + branches: + - master + schedule: + - cron: '30 0 1,15 * *' + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: ${{ github.ref != 'refs/heads/master' }} + +jobs: + authorize: + name: Authorize + environment: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name != github.repository && 'external' || 'internal' }} + runs-on: ubuntu-latest + steps: + - run: true + + check: + needs: authorize + + name: Check for Vulnerabilities + runs-on: ubuntu-latest + + steps: + - if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group' + run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection. + + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha || github.ref }} + + - uses: snyk/actions/php@b98d498629f1c368650224d6d212bf7dfa89e4bf # pin@0.4.0 + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 0000000..a1d5b2d --- /dev/null +++ b/.github/workflows/test.yml @@ -0,0 +1,85 @@ +name: Build and Test + +on: + merge_group: + workflow_dispatch: + pull_request: + branches: + - master + push: + branches: + - master + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.ref != 'refs/heads/master' }} + +env: + NODE_VERSION: 18 + CACHE_KEY: "${{ github.ref }}-${{ github.run_id }}-${{ github.run_attempt }}" + +jobs: + build: + name: Build Package + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - uses: ./.github/actions/build + with: + node: ${{ env.NODE_VERSION }} + + - name: Save build artifacts + uses: actions/cache/save@v3 + with: + path: . + key: ${{ env.CACHE_KEY }} + + unit: + needs: build # Require build to complete before running tests + + name: Run Unit Tests + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-node@v3 + with: + node-version: ${{ env.NODE_VERSION }} + cache: npm + + - uses: actions/cache/restore@v3 + with: + path: . + key: ${{ env.CACHE_KEY }} + + - run: npm run test:ci + + - uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # pin@3.1.4 + + lint: + needs: build # Require build to complete before running tests + + name: Lint Code + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - uses: actions/setup-node@v3 + with: + node-version: ${{ env.NODE_VERSION }} + cache: npm + + - uses: actions/cache/restore@v3 + with: + path: . + key: ${{ env.CACHE_KEY }} + + - run: npm run lint From df8d976e56dfc7e822da7946f8e0354bf37fba85 Mon Sep 17 00:00:00 2001 From: Evan Sims Date: Mon, 18 Sep 2023 13:54:11 -0500 Subject: [PATCH 2/5] Create matrix.json --- .github/workflows/matrix.json | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .github/workflows/matrix.json diff --git a/.github/workflows/matrix.json b/.github/workflows/matrix.json new file mode 100644 index 0000000..428ca21 --- /dev/null +++ b/.github/workflows/matrix.json @@ -0,0 +1,7 @@ +{ + "include": [ + { "node": "18" }, + { "node": "16" }, + { "node": "14" } + ] +} From 24a1e38920ccf890368f1b14ddd2c23a973e9a8e Mon Sep 17 00:00:00 2001 From: Evan Sims Date: Mon, 18 Sep 2023 13:54:13 -0500 Subject: [PATCH 3/5] Update publish.yml --- .github/workflows/publish.yml | 32 ++------------------------------ 1 file changed, 2 insertions(+), 30 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2f79d54..9dee451 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -10,7 +10,7 @@ on: version: description: The version being published. This should be a valid semver version, such as `1.0.0`. required: true - default: '' + default: "" type: string dry-run: type: boolean @@ -85,7 +85,7 @@ jobs: name: Publish to NPM runs-on: ubuntu-latest - environment: 'release' + environment: "release" steps: - name: Checkout code @@ -107,31 +107,3 @@ jobs: run: npm publish --provenance --tag ${{ needs.configure.outputs.vtag }} ${{ needs.configure.outputs.dry-run }} env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - - publish-gh: - needs: - - configure - - publish-npm # Don't publish to GitHub Packages until publishing to NPM is successfully completed - - name: Publish to GitHub Packages - runs-on: ubuntu-latest - environment: 'release' - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node - uses: actions/setup-node@v3 - with: - node-version: ${{ env.NODE_VERSION }} - registry-url: 'https://npm.pkg.github.com' - cache: npm - - - name: Install dependencies - run: npm ci - - - name: Publish release to GitHub Packages - run: npm publish --provenance --tag ${{ needs.configure.outputs.vtag }} ${{ needs.configure.outputs.dry-run }} - env: - NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From b9fbbac2d9ec90ff0a40fc1a57180efe9dbd088b Mon Sep 17 00:00:00 2001 From: Evan Sims Date: Mon, 18 Sep 2023 13:54:14 -0500 Subject: [PATCH 4/5] Update test.yml --- .github/workflows/test.yml | 42 ++++++++++++++++++++++++++++++-------- 1 file changed, 33 insertions(+), 9 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a1d5b2d..5ef9d62 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,50 +18,74 @@ concurrency: cancel-in-progress: ${{ github.ref != 'refs/heads/master' }} env: - NODE_VERSION: 18 CACHE_KEY: "${{ github.ref }}-${{ github.run_id }}-${{ github.run_attempt }}" jobs: + configure: + name: Configure Build Matrix + runs-on: ubuntu-latest + + outputs: + matrix: ${{ steps.set-matrix.outputs.matrix }} + + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.sha || github.ref }} + + - id: set-matrix + run: echo "matrix=$(jq -c . < ./.github/workflows/matrix.json)" >> $GITHUB_OUTPUT + build: + needs: configure + name: Build Package runs-on: ubuntu-latest + strategy: + matrix: ${{ fromJson(needs.configure.outputs.matrix) }} + steps: - name: Checkout code uses: actions/checkout@v4 - uses: ./.github/actions/build with: - node: ${{ env.NODE_VERSION }} + node: ${{ matrix.node }} - name: Save build artifacts uses: actions/cache/save@v3 with: path: . - key: ${{ env.CACHE_KEY }} + key: ${{ matrix.node }}-${{ env.CACHE_KEY }} unit: - needs: build # Require build to complete before running tests + needs: [configure, build] # Require build to complete before running tests name: Run Unit Tests runs-on: ubuntu-latest + strategy: + matrix: ${{ fromJson(needs.configure.outputs.matrix) }} + steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v3 with: - node-version: ${{ env.NODE_VERSION }} + node-version: ${{ matrix.node }} cache: npm - uses: actions/cache/restore@v3 with: path: . - key: ${{ env.CACHE_KEY }} + key: ${{ matrix.node }}-${{ env.CACHE_KEY }} - run: npm run test:ci - - uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # pin@3.1.4 + # only upload coverage on one node version + - if: matrix.node == 18 + uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # pin@3.1.4 lint: needs: build # Require build to complete before running tests @@ -74,12 +98,12 @@ jobs: - uses: actions/setup-node@v3 with: - node-version: ${{ env.NODE_VERSION }} + node-version: ${{ matrix.node }} cache: npm - uses: actions/cache/restore@v3 with: path: . - key: ${{ env.CACHE_KEY }} + key: ${{ matrix.node }}-${{ env.CACHE_KEY }} - run: npm run lint From f1241b7dfc81f139102ff24bafec2eea602e4d3c Mon Sep 17 00:00:00 2001 From: Evan Sims Date: Mon, 18 Sep 2023 13:56:01 -0500 Subject: [PATCH 5/5] Fix linting step --- .github/workflows/test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 5ef9d62..8c57dc4 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -98,12 +98,12 @@ jobs: - uses: actions/setup-node@v3 with: - node-version: ${{ matrix.node }} + node-version: 18 cache: npm - uses: actions/cache/restore@v3 with: path: . - key: ${{ matrix.node }}-${{ env.CACHE_KEY }} + key: 18-${{ env.CACHE_KEY }} - run: npm run lint