security: Add SAST scanning to CI pipeline (#538) (#596) #102
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| version_bump: | |
| description: "Version bump type" | |
| required: true | |
| default: "patch" | |
| type: choice | |
| options: | |
| - patch | |
| - minor | |
| - major | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| concurrency: | |
| group: release | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install bun | |
| uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version: "1.x" | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - name: Check lockfiles are in sync | |
| run: | | |
| echo "Checking that package-lock.json is in sync with package.json (bun.lock is canonical)..." | |
| if [ -f package-lock.json ]; then | |
| cp package-lock.json package-lock.json.orig | |
| npm install --package-lock-only --ignore-scripts | |
| if ! diff -q package-lock.json package-lock.json.orig >/dev/null 2>&1; then | |
| echo "::error::package-lock.json is out of sync with package.json. Run 'npm install' locally after any 'bun add / bun update' and commit the updated lockfile." | |
| diff -u package-lock.json.orig package-lock.json | head -n 200 || true | |
| mv package-lock.json.orig package-lock.json | |
| exit 1 | |
| fi | |
| echo "package-lock.json is in sync." | |
| rm package-lock.json.orig | |
| fi | |
| - name: Build | |
| run: bun run build | |
| - name: Test | |
| run: bun run test | |
| - name: Configure git identity | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| - name: Release (semantic-release) | |
| if: github.event_name == 'push' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| run: npx semantic-release | |
| - name: Bump version (manual) | |
| if: github.event_name == 'workflow_dispatch' | |
| id: bump | |
| run: | | |
| NEW_VERSION=$(npm version "${{ github.event.inputs.version_bump }}" --no-git-tag-version) | |
| echo "version=${NEW_VERSION#v}" >> "$GITHUB_OUTPUT" | |
| - name: Update CHANGELOG (manual) | |
| if: github.event_name == 'workflow_dispatch' | |
| env: | |
| VERSION: ${{ steps.bump.outputs.version }} | |
| run: | | |
| node -e ' | |
| const fs = require("fs"); | |
| const version = process.env.VERSION; | |
| const date = new Date().toISOString().slice(0, 10); | |
| const path = "CHANGELOG.md"; | |
| let content = fs.existsSync(path) | |
| ? fs.readFileSync(path, "utf8") | |
| : "# Changelog\n\n## [Unreleased]\n"; | |
| const heading = "## [Unreleased]"; | |
| const entry = "## [" + version + "] - " + date + | |
| "\n\n### Changed\n- See commit history for details.\n"; | |
| content = content.includes(heading) | |
| ? content.replace(heading, heading + "\n\n" + entry) | |
| : content + "\n" + entry; | |
| fs.writeFileSync(path, content); | |
| ' | |
| - name: Extract release notes from CHANGELOG | |
| if: github.event_name == 'workflow_dispatch' | |
| env: | |
| VERSION: ${{ steps.bump.outputs.version }} | |
| run: | | |
| node -e ' | |
| const fs = require("fs"); | |
| const version = process.env.VERSION; | |
| const content = fs.readFileSync("CHANGELOG.md", "utf8"); | |
| const heading = "## [" + version + "]"; | |
| const start = content.indexOf(heading); | |
| const rest = content.slice(start); | |
| const nextHeadingIdx = rest.indexOf("\n## [", heading.length); | |
| const section = nextHeadingIdx === -1 ? rest : rest.slice(0, nextHeadingIdx); | |
| fs.writeFileSync("RELEASE_NOTES.md", section.trim() + "\n"); | |
| ' | |
| - name: Commit version bump and CHANGELOG | |
| if: github.event_name == 'workflow_dispatch' | |
| env: | |
| VERSION: ${{ steps.bump.outputs.version }} | |
| run: | | |
| git add package.json CHANGELOG.md | |
| git commit -m "chore(release): v${VERSION}" | |
| - name: Create git tag | |
| if: github.event_name == 'workflow_dispatch' | |
| env: | |
| VERSION: ${{ steps.bump.outputs.version }} | |
| run: git tag -a "v${VERSION}" -m "Release v${VERSION}" | |
| - name: Push commit and tag | |
| if: github.event_name == 'workflow_dispatch' | |
| run: git push origin HEAD --follow-tags | |
| - name: Create GitHub release | |
| if: github.event_name == 'workflow_dispatch' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VERSION: ${{ steps.bump.outputs.version }} | |
| run: | | |
| gh release create "v${VERSION}" \ | |
| --title "v${VERSION}" \ | |
| --notes-file RELEASE_NOTES.md | |
| - name: Trigger deployment | |
| if: github.event_name == 'workflow_dispatch' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VERSION: ${{ steps.bump.outputs.version }} | |
| run: | | |
| gh api repos/${{ github.repository }}/dispatches \ | |
| -f event_type=deploy \ | |
| -f "client_payload[version]=v${VERSION}" \ | |
| -f "client_payload[ref]=${{ github.sha }}" |