refactor: decode .odb bytes through documents.js's decodeOdbPackage #35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| commitlint: | |
| name: Commitlint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: wagoid/commitlint-github-action@v6 | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm lint | |
| typecheck: | |
| name: Typecheck | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm typecheck | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| code-quality: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm test:coverage | |
| - name: Upload coverage report | |
| # GitHub Code Quality requires the org on Team/Enterprise Cloud (ExaDev is currently Free), so this no-ops until the org upgrades -- fail-on-error: false keeps that from blocking release, which depends on this job succeeding. | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| uses: actions/upload-code-coverage@v1 | |
| with: | |
| file: coverage/cobertura-coverage.xml | |
| language: typescript | |
| label: unit | |
| fail-on-error: false | |
| test-smoke: | |
| name: Smoke test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm test:smoke | |
| release: | |
| name: Release | |
| needs: [commitlint, lint, typecheck, test, test-smoke] | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: write # to push the release commit/tag and create the GitHub Release | |
| issues: write # to comment on released issues | |
| pull-requests: write # to comment on released pull requests | |
| id-token: write # OIDC identity for npm trusted publishing (no NPM_TOKEN) | |
| outputs: | |
| published: ${{ steps.before.outputs.version != steps.after.outputs.version }} | |
| version: ${{ steps.after.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| # semantic-release analyses the full commit history since the last release. | |
| fetch-depth: 0 | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| # registry-url is deliberately absent. Setting it makes setup-node write an .npmrc containing an _authToken line, and that line wins over the OIDC token exchange -- so the setting that looks like it configures the registry is exactly the one that would stop trusted publishing working. | |
| - run: pnpm install --frozen-lockfile | |
| - name: Read pre-release version | |
| id: before | |
| run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT" | |
| - name: Upgrade npm for OIDC trusted publishing (needs npm CLI >=11.5.1) | |
| run: npm install -g npm@latest | |
| - name: Release | |
| # HUSKY=0 so the commit-msg hook never fires against the automated release commit. | |
| run: HUSKY=0 pnpm exec semantic-release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Blanked, not omitted -- an inherited NPM_TOKEN/NODE_AUTH_TOKEN from a workflow-level env block, reusable workflow, or composite action would otherwise be used in preference to the OIDC exchange. | |
| NPM_TOKEN: '' | |
| NODE_AUTH_TOKEN: '' | |
| - name: Read post-release version | |
| id: after | |
| run: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT" | |
| publish-aliases: | |
| name: Publish aliases (${{ matrix.name }}) | |
| needs: release | |
| if: needs.release.outputs.published == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| id-token: write # OIDC identity for npm trusted publishing. | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - { name: doculi, registry: 'https://registry.npmjs.org' } | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: main # the release commit semantic-release just pushed | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| # registry-url is deliberately absent -- see release job's own comment for why. | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| - name: Rewrite package name for this alias | |
| # Only the top-level "name" field changes -- "bin" keeps both document-cli and doculi entries regardless, so installing either published name yields both commands. | |
| run: npm pkg set name="${{ matrix.name }}" | |
| - run: pnpm publish --access public --no-git-checks | |
| env: | |
| NODE_AUTH_TOKEN: '' # Blanked, not omitted -- see release job's own comment for why. | |
| attest: | |
| name: Attest SBOM and build provenance | |
| needs: release | |
| if: needs.release.outputs.published == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| ref: main # the release commit semantic-release just pushed | |
| - uses: pnpm/action-setup@v6 | |
| - uses: actions/setup-node@v7 | |
| with: | |
| node-version: '22' | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| # Pack into a directory of its own, separate from dist/ (tsdown's raw build output). The attestation subject has to be the artefact that actually ships -- attesting dist/ itself would mix in files that never leave the repo, producing digests that match nothing a consumer can download. | |
| - run: pnpm pack --pack-destination release-artifact | |
| - run: pnpm sbom --sbom-format spdx --prod > release-artifact/sbom.spdx.json | |
| - name: Attest SBOM | |
| uses: actions/attest@v4 | |
| with: | |
| subject-path: release-artifact/*.tgz | |
| sbom-path: release-artifact/sbom.spdx.json | |
| - name: Attest build provenance | |
| uses: actions/attest@v4 | |
| with: | |
| subject-path: release-artifact/*.tgz |