From 9f2ec0dd7c7224f72de4a732973236ea8a3ef89c Mon Sep 17 00:00:00 2001 From: "Kody (bot)" <72270156+kody-bot@users.noreply.github.com> Date: Tue, 12 May 2026 12:39:18 -0600 Subject: [PATCH 1/7] ci: harden npm release workflow --- .github/workflows/release.yml | 89 +++++++++++++++++++++++++++-------- 1 file changed, 69 insertions(+), 20 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f808da7..f5828b1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,4 +1,4 @@ -name: 🚀 Publish +name: 🚀 Publish on: push: branches: @@ -10,11 +10,7 @@ concurrency: cancel-in-progress: true permissions: - actions: write - contents: write # to be able to publish a GitHub release - id-token: write # to enable use of OIDC for npm provenance - issues: write # to be able to comment on released issues - pull-requests: write # to be able to comment on released pull requests + contents: read defaults: run: @@ -22,7 +18,7 @@ defaults: jobs: test: - name: 🧪 Test + name: 🧪 Test strategy: matrix: version: [lts/-1, lts/*, latest] @@ -31,48 +27,101 @@ jobs: coverage: true runs-on: ubuntu-latest steps: - - name: ⬇️ Checkout repo + - name: ⬇️ Checkout repo uses: actions/checkout@v6 - - name: ⎔ Setup node + - name: ⎔ Setup node uses: actions/setup-node@v6 with: node-version: ${{ matrix.version }} - - name: 📥 Download deps + - name: 📥 Download deps uses: bahmutov/npm-install@v1 - - name: 🃏 Run jest + - name: 🃏 Run jest run: npm test -- --coverage=${{ matrix.coverage }} - uses: codecov/codecov-action@v6 if: ${{ matrix.coverage }} - publish: - name: ⚙️ Release + build-release-artifact: + name: 📦 Build release artifact needs: [test] runs-on: ubuntu-latest + permissions: + contents: read + if: + ${{ github.repository == 'epicweb-dev/cachified' && + contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/alpha', + github.ref) && github.event_name == 'push' }} + steps: + - name: ⬇️ Checkout repo + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + + - name: ⎔ Setup node + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + with: + node-version: lts/* + package-manager-cache: false + + - name: 📥 Install deps + run: npm install --ignore-scripts + + - name: 📦 Prepare package + run: npm run build + + - name: 📦 Upload package artifact + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + with: + name: npm-package-artifact + path: dist + if-no-files-found: error + retention-days: 1 + + publish: + name: 🚀 Release + needs: [build-release-artifact] + runs-on: ubuntu-latest permissions: contents: write # to be able to publish a GitHub release id-token: write # to enable use of OIDC for npm provenance issues: write # to be able to comment on released issues pull-requests: write # to be able to comment on released pull requests + if: + ${{ github.repository == 'epicweb-dev/cachified' && + contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/alpha', + github.ref) && github.event_name == 'push' }} steps: - name: ⬇️ Checkout repo - uses: actions/checkout@v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - name: ⎔ Setup node - uses: actions/setup-node@v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: - node-version: lts/* + node-version: 24 + registry-url: https://registry.npmjs.org + package-manager-cache: false - - name: 📥 Download deps - uses: bahmutov/npm-install@v1 + - name: 📦 Download package artifact + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + with: + name: npm-package-artifact + path: dist - - name: ⚙️ Semantic Release - uses: cycjimmy/semantic-release-action@v6.0.0 + - name: 🚀 Release + uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0 with: semantic_version: 25 + branches: | + [ + '+([0-9])?(.{+([0-9]),x}).x', + 'main', + 'next', + 'next-major', + {name: 'beta', prerelease: true}, + {name: 'alpha', prerelease: true} + ] env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_CONFIG_PROVENANCE: true + NPM_CONFIG_IGNORE_SCRIPTS: true From 3c5a6c3ae949f67bd42f1caf714f0029e2b4bf87 Mon Sep 17 00:00:00 2001 From: "Kody (bot)" <72270156+kody-bot@users.noreply.github.com> Date: Tue, 12 May 2026 12:47:35 -0600 Subject: [PATCH 2/7] ci: fix workflow utf-8 encoding --- .github/workflows/release.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5828b1..f5462be 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,4 +1,4 @@ -name: 🚀 Publish +name: 🚀 Publish on: push: branches: @@ -18,7 +18,7 @@ defaults: jobs: test: - name: 🧪 Test + name: 🧪 Test strategy: matrix: version: [lts/-1, lts/*, latest] @@ -27,18 +27,18 @@ jobs: coverage: true runs-on: ubuntu-latest steps: - - name: ⬇️ Checkout repo + - name: ⬇️ Checkout repo uses: actions/checkout@v6 - - name: ⎔ Setup node + - name: ⎔ Setup node uses: actions/setup-node@v6 with: node-version: ${{ matrix.version }} - - name: 📥 Download deps + - name: 📥 Download deps uses: bahmutov/npm-install@v1 - - name: 🃏 Run jest + - name: 🃏 Run jest run: npm test -- --coverage=${{ matrix.coverage }} - uses: codecov/codecov-action@v6 @@ -58,7 +58,7 @@ jobs: - name: ⬇️ Checkout repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: ⎔ Setup node + - name: ⎄ Setup node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: lts/* @@ -95,7 +95,7 @@ jobs: - name: ⬇️ Checkout repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: ⎔ Setup node + - name: ⎄ Setup node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 24 From f2f5b8a239efb186b1646cfeb4d2f80344b500e5 Mon Sep 17 00:00:00 2001 From: "Kody (bot)" <72270156+kody-bot@users.noreply.github.com> Date: Tue, 12 May 2026 12:50:58 -0600 Subject: [PATCH 3/7] ci: address workflow review feedback --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f5462be..2ec0f1c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -76,7 +76,7 @@ jobs: name: npm-package-artifact path: dist if-no-files-found: error - retention-days: 1 + retention-days: 7 publish: name: 🚀 Release From fa56c330befe3c148854e6b0ed8e41adedbe9e95 Mon Sep 17 00:00:00 2001 From: "Kody (bot)" <72270156+kody-bot@users.noreply.github.com> Date: Tue, 12 May 2026 12:59:30 -0600 Subject: [PATCH 4/7] ci: include next-major in release gate --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2ec0f1c..5580f98 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,7 +52,7 @@ jobs: contents: read if: ${{ github.repository == 'epicweb-dev/cachified' && - contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/alpha', + contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/next-major,refs/heads/alpha', github.ref) && github.event_name == 'push' }} steps: - name: ⬇️ Checkout repo @@ -89,7 +89,7 @@ jobs: pull-requests: write # to be able to comment on released pull requests if: ${{ github.repository == 'epicweb-dev/cachified' && - contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/alpha', + contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/next-major,refs/heads/alpha', github.ref) && github.event_name == 'push' }} steps: - name: ⬇️ Checkout repo From 0918abbe5770cd3f41a216643fe0937e0b54933d Mon Sep 17 00:00:00 2001 From: "Kody (bot)" <72270156+kody-bot@users.noreply.github.com> Date: Tue, 12 May 2026 13:08:13 -0600 Subject: [PATCH 5/7] ci: align release workflow guards --- .github/workflows/release.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5580f98..66624eb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,10 +50,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - if: - ${{ github.repository == 'epicweb-dev/cachified' && - contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/next-major,refs/heads/alpha', - github.ref) && github.event_name == 'push' }} + if: ${{ github.repository == 'epicweb-dev/cachified' && github.event_name == 'push' }} steps: - name: ⬇️ Checkout repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -87,10 +84,7 @@ jobs: id-token: write # to enable use of OIDC for npm provenance issues: write # to be able to comment on released issues pull-requests: write # to be able to comment on released pull requests - if: - ${{ github.repository == 'epicweb-dev/cachified' && - contains('refs/heads/main,refs/heads/beta,refs/heads/next,refs/heads/next-major,refs/heads/alpha', - github.ref) && github.event_name == 'push' }} + if: ${{ github.repository == 'epicweb-dev/cachified' && github.event_name == 'push' }} steps: - name: ⬇️ Checkout repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 From b0f2b485c61cdea7b521cbb93f6660856c84e67d Mon Sep 17 00:00:00 2001 From: "Kent C. Dodds" Date: Tue, 12 May 2026 17:05:00 -0600 Subject: [PATCH 6/7] Apply suggestion from @kentcdodds --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 66624eb..3b8f9ea 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -89,7 +89,7 @@ jobs: - name: ⬇️ Checkout repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: ⎄ Setup node + - name: ⎔ Setup node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 24 From 3c35e00d4176944669bb69239068f81c23bf2845 Mon Sep 17 00:00:00 2001 From: "Kent C. Dodds" Date: Tue, 12 May 2026 17:05:19 -0600 Subject: [PATCH 7/7] Apply suggestion from @kentcdodds --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3b8f9ea..68ab822 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -55,7 +55,7 @@ jobs: - name: ⬇️ Checkout repo uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: ⎄ Setup node + - name: ⎔ Setup node uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: lts/*