Skip to content

Commit 4471baa

Browse files
mridangmridang
authored
chore: add GitHub workflow files from zitadel-node
2 parents 69221e5 + be9a5dc commit 4471baa

File tree

16 files changed

+7227
-2741
lines changed

16 files changed

+7227
-2741
lines changed

‎.github/workflows/commitlint.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Commits
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
required: true
8+
type: string
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
lint-commits:
15+
permissions:
16+
contents: read
17+
pull-requests: read
18+
runs-on: ubuntu-latest
19+
name: Validate Commits
20+
21+
steps:
22+
- name: Harden runner
23+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout code
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
ref: ${{ inputs.ref }}
31+
fetch-depth: 0
32+
33+
- name: Inspect Commits
34+
uses: mridang/action-commit-lint@v1
35+
with:
36+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/depcheck.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Dependency Review
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
dependency-review:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Harden Runner
14+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
15+
with:
16+
egress-policy: audit
17+
18+
- name: Checkout code
19+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
21+
- name: Review Dependencies
22+
uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1

‎.github/workflows/linting.yml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Linting
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
required: true
8+
type: string
9+
commit_changes:
10+
required: false
11+
type: boolean
12+
default: false
13+
14+
defaults:
15+
run:
16+
working-directory: ./
17+
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
lint-format:
23+
permissions:
24+
contents: write
25+
runs-on: ubuntu-latest
26+
name: Reformat Code
27+
28+
steps:
29+
- name: Harden runner
30+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
31+
with:
32+
egress-policy: audit
33+
34+
- name: Checkout code
35+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
36+
with:
37+
ref: ${{ inputs.ref }}
38+
39+
- name: Setup Node
40+
uses: actions/setup-node@v4
41+
with:
42+
cache: 'npm'
43+
node-version-file: '.nvmrc'
44+
45+
- name: Install Dependencies
46+
run: npm ci --no-progress
47+
48+
- name: Run Formatter
49+
run: npm run format
50+
51+
- name: Commit Changes
52+
if: ${{ inputs.commit_changes == true }}
53+
uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
54+
with:
55+
commit_message: 'style: Apply automated code formatting [skip ci]'
56+
commit_options: '--no-verify'
57+
repository: .
58+
commit_user_name: github-actions[bot]
59+
commit_user_email: github-actions[bot]@users.noreply.github.com
60+
commit_author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

‎.github/workflows/pipeline.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Pipeline
2+
3+
on:
4+
push:
5+
6+
permissions:
7+
contents: write
8+
actions: read
9+
checks: write
10+
pull-requests: write
11+
12+
jobs:
13+
lint-commits:
14+
name: Run Commitlint Checks
15+
if: github.event_name == 'pull_request'
16+
uses: ./.github/workflows/commitlint.yml
17+
with:
18+
ref: ${{ github.event.pull_request.head.sha }}
19+
secrets: inherit
20+
21+
code-style:
22+
name: Run Linter Formatter
23+
uses: ./.github/workflows/linting.yml
24+
with:
25+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
26+
commit_changes: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
27+
secrets: inherit
28+
29+
type-check:
30+
name: Run Type Checks
31+
uses: ./.github/workflows/typecheck.yml
32+
with:
33+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
34+
secrets: inherit
35+
36+
run-tests:
37+
name: Run Test Suite
38+
uses: ./.github/workflows/test.yml
39+
with:
40+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
41+
secrets: inherit
42+
43+
check-deps:
44+
name: Run Dependency Checks
45+
uses: ./.github/workflows/unused.yml
46+
with:
47+
ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.ref }}
48+
secrets: inherit
49+
50+
all-passed:
51+
name: Check Build Status
52+
runs-on: ubuntu-latest
53+
needs:
54+
- lint-commits
55+
- code-style
56+
- type-check
57+
- run-tests
58+
- check-deps
59+
steps:
60+
- name: Harden runner
61+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
62+
with:
63+
egress-policy: audit
64+
65+
- name: Report Success
66+
run: echo "All required checks passed successfully."

‎.github/workflows/scorecard.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Scorecard Analysis
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
scorecard_analysis:
13+
name: Scorecard Analysis
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
security-events: write
18+
id-token: write
19+
20+
steps:
21+
- name: Harden runner
22+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
23+
with:
24+
egress-policy: audit
25+
26+
- name: Checkout Repository
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
with:
29+
persist-credentials: false
30+
31+
- name: Run Checks
32+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
33+
with:
34+
results_file: results.sarif
35+
results_format: sarif
36+
publish_results: true
37+
38+
- name: Upload Results
39+
uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
40+
with:
41+
sarif_file: results.sarif

‎.github/workflows/test.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Testing
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
required: true
8+
type: string
9+
10+
defaults:
11+
run:
12+
working-directory: ./
13+
14+
jobs:
15+
app-testing:
16+
runs-on: ubuntu-latest
17+
name: Run Tests
18+
19+
steps:
20+
- name: Harden runner
21+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
22+
with:
23+
egress-policy: audit
24+
25+
- name: Checkout code
26+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
27+
with:
28+
ref: ${{ inputs.ref }}
29+
30+
- name: Setup Node
31+
uses: actions/setup-node@v4
32+
with:
33+
cache: 'npm'
34+
node-version-file: '.nvmrc'
35+
36+
- name: Install Dependencies
37+
run: npm ci --no-progress
38+
39+
- name: Run Tests
40+
run: npm run test
41+
42+
- name: Generate coverage report
43+
uses: mridang/action-test-reporter@v1
44+
if: always()
45+
with:
46+
github-token: ${{ secrets.GITHUB_TOKEN }}
47+
coverage-file: 'build/coverage/clover.xml'
48+
49+
- name: Upload Results
50+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
51+
if: always()
52+
with:
53+
name: test-results
54+
path: build/reports/**/*.xml
55+
56+
- name: Generate Report
57+
if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) }}
58+
uses: dorny/test-reporter@6e6a65b7a0bd2c9197df7d0ae36ac5cee784230c # v2.0.0
59+
with:
60+
name: Tests
61+
path: build/reports/**/*.xml
62+
reporter: java-junit
63+
fail-on-error: 'false'
64+
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/typecheck.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Typecheck
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
required: true
8+
type: string
9+
10+
defaults:
11+
run:
12+
working-directory: ./
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
tsc-check:
19+
runs-on: ubuntu-latest
20+
name: Inspect Code
21+
22+
steps:
23+
- name: Harden runner
24+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
25+
with:
26+
egress-policy: audit
27+
28+
- name: Checkout code
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
30+
with:
31+
ref: ${{ inputs.ref }}
32+
33+
- name: Setup Node
34+
uses: actions/setup-node@v4
35+
with:
36+
cache: 'npm'
37+
node-version-file: '.nvmrc'
38+
39+
- name: Install Dependencies
40+
run: npm ci --no-progress
41+
42+
- name: Run Typecheck
43+
run: npm run prepack

‎.github/workflows/unused.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Dependencies
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
required: true
8+
type: string
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
lint-dependencies:
15+
permissions:
16+
contents: read
17+
pull-requests: read
18+
runs-on: ubuntu-latest
19+
name: Lint Dependencies
20+
21+
steps:
22+
- name: Harden runner
23+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
24+
with:
25+
egress-policy: audit
26+
27+
- name: Checkout code
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
ref: ${{ inputs.ref }}
31+
32+
- name: Setup Node
33+
uses: actions/setup-node@v4
34+
with:
35+
cache: 'npm'
36+
node-version-file: '.nvmrc'
37+
38+
- name: Install Dependencies
39+
run: npm ci --no-progress
40+
41+
- name: Inspect Dependencies
42+
uses: mridang/action-dependency-insight@v1

0 commit comments

Comments
 (0)