From 48e2facaa2c8b86237f6b76bfa633ee4e9ba616f Mon Sep 17 00:00:00 2001 From: Benoit TRAVERS Date: Fri, 24 Jul 2026 10:17:00 +0200 Subject: [PATCH 1/3] ci: adopt shared @btravstack reusable CI + release workflows --- .github/workflows/ci.yml | 125 ++-------------------------------- .github/workflows/release.yml | 66 ++---------------- 2 files changed, 11 insertions(+), 180 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 63396fad..2f30e20c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,97 +12,12 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: - lint: - name: Lint - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run linter - run: pnpm lint - - format: - name: Format - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Check formatting - run: pnpm format --check - - typecheck: - name: Type Check - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run type check - run: pnpm typecheck - - knip: - name: Knip - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run knip - run: pnpm exec knip --reporter github-actions - - test: - name: Tests (Node ${{ matrix.node.name }}) - runs-on: ubuntu-latest - timeout-minutes: 15 - strategy: - fail-fast: false - matrix: - node: - # "default" resolves to .node-version (24.x); 22.19.0 is the - # engines floor declared by the published packages. - - { name: "default", version: "" } - - { name: "22.19.0", version: "22.19.0" } - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - with: - node-version: ${{ matrix.node.version }} - - - name: Run tests - run: pnpm test -- --coverage --reporter=default --reporter=github-actions - - - name: Upload Coverage Report - if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: coverage-report-node-${{ matrix.node.name }} - path: ./**/coverage/ - retention-days: 30 + ci: + uses: btravstack/config/.github/workflows/ci-reusable.yml@main + with: + changeset: false + test-command: "pnpm test -- --coverage --reporter=default --reporter=github-actions" test-integration: name: Integration Tests @@ -128,39 +43,11 @@ jobs: path: ./**/coverage/ retention-days: 30 - build: - name: Build - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Build packages - run: pnpm build - - security-audit: - name: Security Audit - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run security audit - run: pnpm audit --audit-level=high - bundle-size: name: Bundle Size runs-on: ubuntu-latest timeout-minutes: 15 - needs: build + needs: ci steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bb9f602f..34826486 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,69 +1,13 @@ name: Release - on: workflow_run: workflows: ["CI"] - types: - - completed - branches: - - main - + types: [completed] + branches: [main] concurrency: ${{ github.workflow }}-${{ github.ref }} - -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: release: - name: Release - runs-on: ubuntu-latest - timeout-minutes: 30 if: ${{ github.event.workflow_run.conclusion == 'success' }} - permissions: - contents: write - pull-requests: write - id-token: write - - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - with: - # Use the PAT here too so the git remote is configured with PAT - # credentials. The bare GITHUB_TOKEN-authenticated push that - # checkout normally sets up is treated by GitHub as a bot event - # and would not fire `pull_request` workflows on the resulting - # branch — defeating the whole point of using a PAT for releases. - token: ${{ secrets.RELEASE_PAT }} - - - name: Setup - uses: ./.github/actions/setup - - # No standalone build step: the publish path (`pnpm run release`) - # already runs `pnpm build`, and the version path doesn't need one. - - name: Create Release Pull Request or Publish to npm - id: changesets - uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1 - with: - # Use `pnpm run …` so we invoke the package.json scripts. Bare - # `pnpm version` collides with pnpm's built-in `version` command and - # silently prints `process.versions` instead of running the changeset - # version script, leaving package.json files untouched and the - # release stuck. - version: pnpm run version - publish: pnpm run release - commit: "chore: release packages" - title: "chore: release packages" - env: - # Use a Personal Access Token rather than the default GITHUB_TOKEN. - # Events triggered by GITHUB_TOKEN do not start new workflow runs - # (GitHub's anti-recursion safeguard), so the "Version Packages" - # PR opened by this action would otherwise skip CI entirely. A PAT - # attributes the PR to a real user and CI fires normally. - # Required repo secret: RELEASE_PAT (classic PAT with `repo` scope, - # or a fine-grained token with Contents: read/write + Pull requests: - # read/write on this repo). - GITHUB_TOKEN: ${{ secrets.RELEASE_PAT }} - # NPM_TOKEN is intentionally absent — npm Trusted Publishing uses - # the OIDC token minted via `id-token: write` above. Each package - # must have a Trusted Publisher configured on npmjs.com pointing - # at this repo + workflow file (.github/workflows/release.yml). + uses: btravstack/config/.github/workflows/release-reusable.yml@main + secrets: + RELEASE_PAT: ${{ secrets.RELEASE_PAT }} From bc14c5fe3257005c812af72359cd9cb04f556827 Mon Sep 17 00:00:00 2001 From: Benoit TRAVERS Date: Fri, 24 Jul 2026 10:59:05 +0200 Subject: [PATCH 2/3] ci: absorb bundle-size/integration into reusable; pin @workflows-v1; fix release permissions --- .github/workflows/ci.yml | 62 +++-------------------------------- .github/workflows/release.yml | 6 +++- 2 files changed, 9 insertions(+), 59 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2f30e20c..bea11715 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,73 +1,19 @@ name: CI permissions: contents: read - on: push: branches: [main] pull_request: branches: [main] - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - jobs: ci: - uses: btravstack/config/.github/workflows/ci-reusable.yml@main + uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1 with: - changeset: false + integration-tests: true + bundle-size: true test-command: "pnpm test -- --coverage --reporter=default --reporter=github-actions" - - test-integration: - name: Integration Tests - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - with: - fetch-depth: 0 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run integration tests - run: pnpm test:integration --concurrency 3 -- --coverage --reporter=default --reporter=github-actions - - - name: Upload Integration Coverage Report - if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: integration-coverage-report - path: ./**/coverage/ - retention-days: 30 - - bundle-size: - name: Bundle Size - runs-on: ubuntu-latest - timeout-minutes: 15 - needs: ci - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Build packages - run: pnpm build - - - name: Report bundle sizes - run: | - echo "## Bundle Sizes" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "| Package | Size |" >> $GITHUB_STEP_SUMMARY - echo "|---------|------|" >> $GITHUB_STEP_SUMMARY - for dir in packages/*/dist; do - if [ -d "$dir" ]; then - package=$(dirname "$dir" | xargs basename) - size=$(du -sh "$dir" | cut -f1) - echo "| $package | $size |" >> $GITHUB_STEP_SUMMARY - fi - done + integration-command: "pnpm test:integration --concurrency 3 -- --coverage --reporter=default --reporter=github-actions" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 34826486..a57ea37b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,6 +8,10 @@ concurrency: ${{ github.workflow }}-${{ github.ref }} jobs: release: if: ${{ github.event.workflow_run.conclusion == 'success' }} - uses: btravstack/config/.github/workflows/release-reusable.yml@main + permissions: + contents: write + pull-requests: write + id-token: write + uses: btravstack/config/.github/workflows/release-reusable.yml@workflows-v1 secrets: RELEASE_PAT: ${{ secrets.RELEASE_PAT }} From 2190c25fbac244289c337807faa0d7b146281304 Mon Sep 17 00:00:00 2001 From: Benoit TRAVERS Date: Fri, 24 Jul 2026 11:37:54 +0200 Subject: [PATCH 3/3] =?UTF-8?q?ci:=20thin=20caller=20=E2=80=94=20standardi?= =?UTF-8?q?zed=20reusable=20defaults?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bea11715..4016e545 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,19 +1,19 @@ name: CI permissions: contents: read + on: push: branches: [main] pull_request: branches: [main] + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true + jobs: ci: uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1 with: integration-tests: true - bundle-size: true - test-command: "pnpm test -- --coverage --reporter=default --reporter=github-actions" - integration-command: "pnpm test:integration --concurrency 3 -- --coverage --reporter=default --reporter=github-actions"