chore(deps): lock file maintenance (#538) #1194
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| issue_comment: | |
| types: [created, deleted] | |
| push: | |
| branches: | |
| - main | |
| concurrency: | |
| group: release-${{ github.ref_name }} | |
| cancel-in-progress: false | |
| permissions: {} | |
| env: | |
| ARCHGATE_TELEMETRY: "0" | |
| # Opt into Node.js 24 for all actions — TrigenSoftware/simple-release-action | |
| # still declares `using: node20` and GitHub will force Node 24 on June 16, 2026. | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| jobs: | |
| check: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| name: Context check | |
| permissions: | |
| contents: read | |
| outputs: | |
| continue: ${{ steps.check.outputs.continue }} | |
| workflow: ${{ steps.check.outputs.workflow }} | |
| steps: | |
| - name: Generate token | |
| id: generate_token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.GH_APP_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} | |
| # Scope the app token — without these the token inherits every | |
| # permission the app installation has (zizmor: github-app). Requested | |
| # scopes MUST be a subset of the installation's grants (archgatebot: | |
| # contents + pull-requests only) or token creation fails with 422. | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| token: ${{ steps.generate_token.outputs.token }} | |
| # The check workflow only reads context — no git push happens here. | |
| persist-credentials: false | |
| - uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4 | |
| with: | |
| auto-install: true | |
| cache: true | |
| cache-base: main | |
| cache-version: ${{ env.ImageOS }} | |
| - name: Restore Bun Package Cache | |
| id: restore-bun-cache | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: /home/runner/.bun/install/cache | |
| key: bun-packages-${{ runner.os }}-v1-${{ hashFiles('bun.lock') }} | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Context check | |
| id: check | |
| uses: TrigenSoftware/simple-release-action@1d376657d9af2a93f280e071b7327d3203719e24 # v2.0.8 | |
| with: | |
| workflow: check | |
| github-token: ${{ steps.generate_token.outputs.token }} | |
| branch: release | |
| pull-request: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| name: Pull request | |
| permissions: | |
| contents: read | |
| needs: check | |
| if: needs.check.outputs.workflow == 'pull-request' | |
| steps: | |
| # Use a GitHub App installation token (not GITHUB_TOKEN) so the push to the | |
| # release branch triggers downstream `pull_request` events on the release PR. | |
| # GITHUB_TOKEN-authored pushes are intentionally muted by GitHub to prevent | |
| # workflow recursion — that mute is what causes release PRs to land without | |
| # the required `Validate Code` / `Lint, Test & Check` / `DCO Sign-off Check` | |
| # status checks attached to the PR ref. With an App token, the synchronize | |
| # event fires naturally and code-pull-request.yml + dco.yml run against | |
| # refs/pull/N/head, producing checks that branch protection accepts. | |
| - name: Generate token | |
| id: generate_token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.GH_APP_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} | |
| # Scope the app token — without these the token inherits every | |
| # permission the app installation has (zizmor: github-app). Requested | |
| # scopes MUST be a subset of the installation's grants (archgatebot: | |
| # contents + pull-requests only) or token creation fails with 422. | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - name: Checkout code | |
| # Credentials must persist: simple-release-action pushes the release | |
| # branch via git using the checkout-persisted app token. | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] | |
| with: | |
| token: ${{ steps.generate_token.outputs.token }} | |
| - uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4 | |
| with: | |
| auto-install: true | |
| cache: true | |
| cache-base: main | |
| cache-version: ${{ env.ImageOS }} | |
| - name: Restore Bun Package Cache | |
| id: restore-bun-cache | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: /home/runner/.bun/install/cache | |
| key: bun-packages-${{ runner.os }}-v1-${{ hashFiles('bun.lock') }} | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Install DCO sign-off hook | |
| run: | | |
| mkdir -p .git/hooks | |
| cat > .git/hooks/prepare-commit-msg << 'HOOK' | |
| #!/bin/sh | |
| # Append DCO Signed-off-by trailer to release commits | |
| if ! grep -qi "^Signed-off-by:" "$1"; then | |
| name=$(git config user.name) | |
| email=$(git config user.email) | |
| echo "" >> "$1" | |
| echo "Signed-off-by: $name <$email>" >> "$1" | |
| fi | |
| HOOK | |
| chmod +x .git/hooks/prepare-commit-msg | |
| - name: Create or update pull request | |
| uses: TrigenSoftware/simple-release-action@1d376657d9af2a93f280e071b7327d3203719e24 # v2.0.8 | |
| with: | |
| workflow: pull-request | |
| github-token: ${{ steps.generate_token.outputs.token }} | |
| branch: release | |
| release: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| name: Release | |
| permissions: | |
| contents: write | |
| id-token: write | |
| needs: check | |
| if: needs.check.outputs.workflow == 'release' | |
| steps: | |
| - name: Generate token | |
| id: generate_token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.GH_APP_APP_ID }} | |
| private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} | |
| # Scope the app token — without these the token inherits every | |
| # permission the app installation has (zizmor: github-app). Requested | |
| # scopes MUST be a subset of the installation's grants (archgatebot: | |
| # contents + pull-requests only) or token creation fails with 422. | |
| permission-contents: write | |
| permission-pull-requests: write | |
| - name: Checkout code | |
| # Credentials must persist: simple-release-action pushes the release | |
| # tag via git using the checkout-persisted app token. | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 # zizmor: ignore[artipacked] | |
| with: | |
| token: ${{ steps.generate_token.outputs.token }} | |
| - uses: moonrepo/setup-toolchain@261c62cb5b0f580c7be7c8cd0f023a2e96756095 # v0.6.4 | |
| with: | |
| auto-install: true | |
| cache: true | |
| cache-base: main | |
| cache-version: ${{ env.ImageOS }} | |
| - name: Restore Bun Package Cache | |
| id: restore-bun-cache | |
| uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: /home/runner/.bun/install/cache | |
| key: bun-packages-${{ runner.os }}-v1-${{ hashFiles('bun.lock') }} | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Validate | |
| id: validate | |
| run: bun run validate | |
| - name: Release | |
| uses: TrigenSoftware/simple-release-action@1d376657d9af2a93f280e071b7327d3203719e24 # v2.0.8 | |
| with: | |
| workflow: release | |
| github-token: ${{ steps.generate_token.outputs.token }} | |
| branch: release | |
| env: | |
| NPM_CONFIG_PROVENANCE: "true" | |
| - name: Annotate release in PostHog | |
| if: success() | |
| continue-on-error: true | |
| env: | |
| # Both values are GitHub repo secrets (Settings > Secrets and variables > Actions | |
| # > Secrets), not repo variables — do NOT switch POSTHOG_PROJECT_ID to `vars.*`. | |
| # It was previously read via `vars.POSTHOG_PROJECT_ID` while only ever being | |
| # configured as a secret, so this step silently no-opped (exit 0) on every | |
| # release for weeks without failing the build. See git history for details. | |
| POSTHOG_PERSONAL_API_KEY: ${{ secrets.POSTHOG_PERSONAL_API_KEY }} | |
| POSTHOG_PROJECT_ID: ${{ secrets.POSTHOG_PROJECT_ID }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${POSTHOG_PERSONAL_API_KEY:-}" ] || [ -z "${POSTHOG_PROJECT_ID:-}" ]; then | |
| echo "::warning::Skipping PostHog annotation — POSTHOG_PERSONAL_API_KEY or POSTHOG_PROJECT_ID not configured" | |
| exit 0 | |
| fi | |
| version=$(jq -r .version package.json) | |
| curl -fsS -X POST "https://eu.posthog.com/api/projects/${POSTHOG_PROJECT_ID}/annotations/" \ | |
| -H "Authorization: Bearer ${POSTHOG_PERSONAL_API_KEY}" \ | |
| -H "Content-Type: application/json" \ | |
| -d "{ | |
| \"content\": \"v${version}\", | |
| \"date_marker\": \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\", | |
| \"scope\": \"project\", | |
| \"creation_type\": \"GIT\" | |
| }" | |
| echo "::notice::PostHog annotation created for v${version}" | |
| - name: Save Bun Cache | |
| uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| if: steps.validate.outcome == 'success' && steps.restore-bun-cache.outputs.cache-hit != 'true' | |
| with: | |
| path: /home/runner/.bun/install/cache | |
| key: ${{ steps.restore-bun-cache.outputs.cache-primary-key }} |