Skip to content

Commit f17bbe1

Browse files
SamuelSSalazarSamuelSSalazar
authored
ci: add semantic-release automation (#355)
1 parent 0fbf358 commit f17bbe1

12 files changed

Lines changed: 253 additions & 31 deletions

File tree

‎.commitlintrc.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"extends": ["@commitlint/config-conventional"]
3+
}

‎.github/workflows/commitlint.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Lint Commits
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
commitlint:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Checkout code
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
12+
with:
13+
fetch-depth: 0
14+
persist-credentials: false
15+
16+
- name: Setup Node.js
17+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
18+
with:
19+
node-version: '24'
20+
21+
- name: Install dependencies
22+
run: npm install
23+
24+
- name: Validate commit messages
25+
run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

‎.github/workflows/prepare-release.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Prepare Release
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
concurrency:
9+
group: prepare-release
10+
cancel-in-progress: true
11+
12+
permissions:
13+
contents: write
14+
pull-requests: write
15+
16+
jobs:
17+
prepare:
18+
runs-on: ubuntu-latest
19+
if: "!startsWith(github.event.head_commit.message, 'chore(release):')"
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
fetch-depth: 0
25+
persist-credentials: false
26+
27+
- name: Setup Node.js
28+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
29+
with:
30+
node-version: '24'
31+
32+
- name: Install dependencies
33+
run: npm install
34+
35+
- name: Build
36+
run: npm run build
37+
38+
- name: Detect Next Version
39+
id: version
40+
env:
41+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
run: |
43+
# Run semantic-release with only commit analyzer to detect version
44+
NEXT_VERSION=$(npx semantic-release --dry-run --plugins @semantic-release/commit-analyzer | tee /dev/stderr | awk '/The next release version is/{print $NF}')
45+
echo "next=$NEXT_VERSION" >> $GITHUB_OUTPUT
46+
47+
- name: Update package.json
48+
if: steps.version.outputs.next != ''
49+
run: npm version "$NEXT_VERSION" --no-git-tag-version
50+
env:
51+
NEXT_VERSION: ${{ steps.version.outputs.next }}
52+
53+
- name: Update CHANGELOG.md
54+
if: steps.version.outputs.next != ''
55+
run: npx conventional-changelog-cli -p angular -i CHANGELOG.md -s
56+
57+
- name: Create Pull Request
58+
if: steps.version.outputs.next != ''
59+
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
60+
with:
61+
token: ${{ secrets.GITHUB_TOKEN }}
62+
commit-message: "chore(release): ${{ steps.version.outputs.next }}"
63+
branch: "release/v${{ steps.version.outputs.next }}"
64+
delete-branch: true
65+
title: "chore(release): ${{ steps.version.outputs.next }}"
66+
body: |
67+
This PR prepares the release of version ${{ steps.version.outputs.next }}.
68+
69+
**Changes:**
70+
- Updated version in `package.json` to ${{ steps.version.outputs.next }}
71+
- Updated `CHANGELOG.md` with release notes
72+
73+
**Next Steps:**
74+
Review and merge this PR to trigger the publish workflow.
75+
labels: release

‎.github/workflows/release.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
permissions:
9+
contents: write
10+
issues: write
11+
pull-requests: write
12+
id-token: write
13+
14+
jobs:
15+
release:
16+
runs-on: ubuntu-latest
17+
if: startsWith(github.event.head_commit.message, 'chore(release):')
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
fetch-depth: 0
24+
persist-credentials: false
25+
26+
- name: Setup Node.js
27+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
28+
with:
29+
node-version: '24'
30+
31+
- name: Install dependencies
32+
run: npm install
33+
34+
- name: Build
35+
run: npm run build
36+
37+
- name: Set up Python
38+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
39+
with:
40+
python-version: "3.10"
41+
42+
- name: Install Python dependencies
43+
shell: bash
44+
run: pip install boto3>=1.34.159 requests>=2.32.3 rl-deploy>=2.2.3.0 pip-system-certs>=4.0
45+
46+
- name: Configure AWS credentials
47+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
48+
with:
49+
role-to-assume: ${{ secrets.PRODSEC_TOOLS_ARN }}
50+
aws-region: us-east-1
51+
mask-aws-account-id: true
52+
53+
- name: Install rl-wrapper
54+
env:
55+
WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
56+
run: pip install "rl-wrapper>=1.0.0" --index-url $WRAPPER_INDEX_URL
57+
58+
- name: Release
59+
env:
60+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
61+
NPM_CONFIG_PROVENANCE: true
62+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
63+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
64+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
65+
PYTHONUNBUFFERED: 1
66+
run: npx semantic-release

‎.github/workflows/sca-scan.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Snyk Scan
2+
3+
on:
4+
push:
5+
branches: ["master"]
6+
7+
jobs:
8+
snyk-cli:
9+
uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@5246a8b59100e3eea284ce4f2e2a51b51e237380
10+
secrets: inherit

‎.github/workflows/semgrep.yml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎.github/workflows/test.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Test
2+
3+
on:
4+
pull_request:
5+
6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.ref }}
8+
cancel-in-progress: true
9+
10+
jobs:
11+
test:
12+
runs-on: ubuntu-latest
13+
strategy:
14+
fail-fast: false
15+
matrix:
16+
node-version: ['20', '22', '24']
17+
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21+
with:
22+
persist-credentials: false
23+
24+
- name: Setup Node.js ${{ matrix.node-version }}
25+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
26+
with:
27+
node-version: ${{ matrix.node-version }}
28+
29+
- name: Install dependencies
30+
run: npm install
31+
32+
- name: Build
33+
run: npm run build
34+
35+
- name: Lint
36+
run: npm run lint
37+
38+
- name: Test
39+
run: npm test

‎.husky/commit-msg‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
npx --no -- commitlint --edit $1

‎.releaserc.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"branches": ["master"],
3+
"plugins": [
4+
"@semantic-release/commit-analyzer",
5+
"@semantic-release/release-notes-generator",
6+
[
7+
"@semantic-release/npm",
8+
{
9+
"npmPublish": true,
10+
"pkgRoot": "."
11+
}
12+
],
13+
[
14+
"@semantic-release/exec",
15+
{
16+
"verifyReleaseCmd": "ARTIFACT=\"$(pwd)/$(npm pack --ignore-scripts | tail -1)\" && rl-wrapper --artifact \"$ARTIFACT\" --name express-jwt --version ${nextRelease.version} --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --build-env github_actions --suppress-output",
17+
"prepareCmd": "git diff --exit-code -- package.json"
18+
}
19+
],
20+
"@semantic-release/github"
21+
]
22+
}

‎.travis.yml‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

0 commit comments

Comments
 (0)