Skip to content

Commit df31744

Browse files
SamuelSSalazarSamuelSSalazar
committed
ci: add semantic-release automation
1 parent 7158002 commit df31744

File tree

13 files changed

+243
-56
lines changed

13 files changed

+243
-56
lines changed

‎.commitlintrc.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"extends": ["@commitlint/config-conventional"]
3+
}

‎.github/workflows/ci.yml‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

‎.github/workflows/commitlint.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Lint Commits
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
commitlint:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Checkout code
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
12+
with:
13+
fetch-depth: 0
14+
persist-credentials: false
15+
16+
- name: Setup Node.js
17+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
18+
with:
19+
node-version: '24'
20+
21+
- name: Install dependencies
22+
run: npm install
23+
24+
- name: Validate commit messages
25+
run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose

‎.github/workflows/prepare-release.yml‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
name: Prepare Release
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
concurrency:
9+
group: prepare-release
10+
cancel-in-progress: true
11+
12+
permissions:
13+
contents: write
14+
pull-requests: write
15+
16+
jobs:
17+
prepare:
18+
runs-on: ubuntu-latest
19+
if: "!startsWith(github.event.head_commit.message, 'chore(release):')"
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
fetch-depth: 0
25+
persist-credentials: false
26+
27+
- name: Setup Node.js
28+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
29+
with:
30+
node-version: '24'
31+
32+
- name: Install dependencies
33+
run: npm install
34+
35+
- name: Detect Next Version
36+
id: version
37+
env:
38+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
39+
run: |
40+
# Run semantic-release with only commit analyzer to detect version
41+
NEXT_VERSION=$(npx semantic-release --dry-run --plugins @semantic-release/commit-analyzer | tee /dev/stderr | awk '/The next release version is/{print $NF}')
42+
echo "next=$NEXT_VERSION" >> $GITHUB_OUTPUT
43+
44+
- name: Update package.json
45+
if: steps.version.outputs.next != ''
46+
run: npm version "$NEXT_VERSION" --no-git-tag-version
47+
env:
48+
NEXT_VERSION: ${{ steps.version.outputs.next }}
49+
50+
- name: Update CHANGELOG.md
51+
if: steps.version.outputs.next != ''
52+
run: npx conventional-changelog-cli -p angular -i CHANGELOG.md -s
53+
54+
- name: Create Pull Request
55+
if: steps.version.outputs.next != ''
56+
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
57+
with:
58+
token: ${{ secrets.GITHUB_TOKEN }}
59+
commit-message: "chore(release): ${{ steps.version.outputs.next }}"
60+
branch: "release/v${{ steps.version.outputs.next }}"
61+
delete-branch: true
62+
title: "chore(release): ${{ steps.version.outputs.next }}"
63+
body: |
64+
This PR prepares the release of version ${{ steps.version.outputs.next }}.
65+
66+
**Changes:**
67+
- Updated version in `package.json` to ${{ steps.version.outputs.next }}
68+
- Updated `CHANGELOG.md` with release notes
69+
70+
**Next Steps:**
71+
Review and merge this PR to trigger the publish workflow.
72+
labels: release

‎.github/workflows/release.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
8+
permissions:
9+
contents: write
10+
issues: write
11+
pull-requests: write
12+
id-token: write
13+
14+
jobs:
15+
release:
16+
runs-on: ubuntu-latest
17+
if: startsWith(github.event.head_commit.message, 'chore(release):')
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
fetch-depth: 0
24+
persist-credentials: false
25+
26+
- name: Setup Node.js
27+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
28+
with:
29+
node-version: '24'
30+
31+
- name: Install dependencies
32+
run: npm install
33+
34+
- name: Set up Python
35+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
36+
with:
37+
python-version: "3.10"
38+
39+
- name: Install Python dependencies
40+
shell: bash
41+
run: pip install boto3>=1.34.159 requests>=2.32.3 rl-deploy>=2.2.3.0 pip-system-certs>=4.0
42+
43+
- name: Configure AWS credentials
44+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
45+
with:
46+
role-to-assume: ${{ secrets.PRODSEC_TOOLS_ARN }}
47+
aws-region: us-east-1
48+
mask-aws-account-id: true
49+
50+
- name: Install rl-wrapper
51+
env:
52+
WRAPPER_INDEX_URL: "https://${{ secrets.PRODSEC_TOOLS_USER }}:${{ secrets.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
53+
run: pip install "rl-wrapper>=1.0.0" --index-url $WRAPPER_INDEX_URL
54+
55+
- name: Release
56+
env:
57+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
58+
NPM_CONFIG_PROVENANCE: true
59+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
60+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
61+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
62+
PYTHONUNBUFFERED: 1
63+
run: npx semantic-release

‎.github/workflows/sca-scan.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Snyk Scan
2+
3+
on:
4+
push:
5+
branches: ["master"]
6+
7+
jobs:
8+
snyk-cli:
9+
uses: auth0/devsecops-tooling/.github/workflows/sca-scan.yml@5246a8b59100e3eea284ce4f2e2a51b51e237380
10+
secrets: inherit

‎.github/workflows/semgrep.yml‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎.github/workflows/test.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Test
2+
3+
on:
4+
pull_request:
5+
6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.ref }}
8+
cancel-in-progress: true
9+
10+
jobs:
11+
test:
12+
runs-on: ubuntu-latest
13+
strategy:
14+
fail-fast: false
15+
matrix:
16+
node-version: ['20', '22', '24']
17+
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21+
with:
22+
persist-credentials: false
23+
24+
- name: Setup Node
25+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
26+
with:
27+
node-version: ${{ matrix.node-version }}
28+
29+
- name: Install dependencies
30+
run: npm install
31+
32+
- name: Run tests
33+
run: npm test

‎.husky/commit-msg‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
npx --no -- commitlint --edit "$1"

‎.releaserc.json‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
"branches": ["master"],
3+
"plugins": [
4+
"@semantic-release/commit-analyzer",
5+
"@semantic-release/release-notes-generator",
6+
[
7+
"@semantic-release/npm",
8+
{
9+
"npmPublish": true,
10+
"pkgRoot": "."
11+
}
12+
],
13+
[
14+
"@semantic-release/exec",
15+
{
16+
"verifyReleaseCmd": "ARTIFACT=\"$(pwd)/$(npm pack --ignore-scripts | tail -1)\" && rl-wrapper --artifact \"$ARTIFACT\" --name samlp --version ${nextRelease.version} --repository $GITHUB_REPOSITORY --commit $GITHUB_SHA --build-env github_actions --suppress-output",
17+
"prepareCmd": "git diff --exit-code"
18+
}
19+
],
20+
"@semantic-release/github"
21+
]
22+
}

0 commit comments

Comments
 (0)