Skip to content

Commit 45c202d

Browse files
farfromrefugfarfromrefug
committed
Merge remote-tracking branch 'nativescript/main'
# Conflicts: # .github/workflows/npm_release_cli.yml # CHANGELOG.md # package-lock.json # package.json
2 parents 1094172 + 7d540b6 commit 45c202d

34 files changed

Lines changed: 1275 additions & 1235 deletions

‎.github/workflows/codeql-advanced.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ jobs:
6060
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
6161
steps:
6262
- name: Checkout repository
63-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
63+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
6464

6565
# Add any setup steps before running the `github/codeql-action/init` action.
6666
# This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -70,7 +70,7 @@ jobs:
7070

7171
# Initializes the CodeQL tools for scanning.
7272
- name: Initialize CodeQL
73-
uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
73+
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
7474
with:
7575
languages: ${{ matrix.language }}
7676
build-mode: ${{ matrix.build-mode }}
@@ -98,6 +98,6 @@ jobs:
9898
exit 1
9999
100100
- name: Perform CodeQL Analysis
101-
uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
101+
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
102102
with:
103103
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-review.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ jobs:
1717
runs-on: ubuntu-latest
1818
steps:
1919
- name: 'Checkout Repository'
20-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4.3.0
20+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.3.0
2121
- name: 'Dependency Review'
22-
uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
22+
uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

‎.github/workflows/npm_release_cli.yml‎

Lines changed: 172 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -3,75 +3,213 @@ name: 'nativescript -> npm'
33
on:
44
workflow_dispatch:
55
inputs:
6-
bump_version:
7-
description: 'Bump Version'
8-
required: true
9-
default: true
10-
type: boolean
6+
release_type:
7+
description: 'Release type. "dev" publishes a -next prerelease without bumping package.json. patch/minor/major/prerelease bump package.json, commit + tag to main, then publish as a stable release.'
8+
type: choice
9+
options:
10+
- auto
11+
- patch
12+
- minor
13+
- major
14+
- prerelease
15+
default: auto
1116
next_version:
1217
description: 'Next Version with Next tag'
1318
required: true
1419
default: false
1520
type: boolean
1621

17-
permissions:
18-
contents: read
22+
permissions: read-all
23+
24+
env:
25+
NPM_TAG: 'next'
1926

2027
jobs:
21-
release:
28+
build:
29+
name: Build
2230
runs-on: macos-latest
31+
permissions:
32+
contents: write
33+
outputs:
34+
npm_version: ${{ steps.npm_version_output.outputs.NPM_VERSION }}
35+
npm_tag: ${{ steps.npm_version_output.outputs.NPM_TAG }}
36+
is_release: ${{ steps.npm_version_output.outputs.IS_RELEASE }}
2337

2438
steps:
25-
2639
- name: Harden the runner (Audit all outbound calls)
27-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
40+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
2841
with:
2942
egress-policy: audit
3043

31-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
32-
33-
- uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
44+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
45+
with:
46+
fetch-depth: 0
47+
token: ${{ secrets.GITHUB_TOKEN }}
48+
49+
- uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
3450
with:
3551
node-version: 22.14.0
52+
registry-url: "https://registry.npmjs.org"
3653

3754
- name: Setup
3855
run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock
3956

57+
- name: Get Current Version
58+
run: |
59+
NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
60+
echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
61+
62+
- name: Bump, commit and tag stable release (manual dispatch)
63+
if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type != 'auto' && inputs.release_type != 'dev' }}
64+
run: |
65+
git config user.name "github-actions[bot]"
66+
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
67+
npm version ${{ inputs.release_type }} -m "chore: release v%s"
68+
NPM_VERSION=$(node -e "console.log(require('./package.json').version);")
69+
echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
70+
git push origin HEAD:${GITHUB_REF_NAME} --follow-tags
71+
72+
- name: Bump version for dev release
73+
if: ${{ !contains(github.ref, 'refs/tags/') && (github.event_name != 'workflow_dispatch' || inputs.release_type == 'dev') }}
74+
run: |
75+
NPM_VERSION=$(node ./scripts/get-next-version.js)
76+
echo NPM_VERSION=$NPM_VERSION >> $GITHUB_ENV
77+
npm version $NPM_VERSION --no-git-tag-version
78+
4079
- name: Bump Standard Version
41-
if: github.event.inputs.bump_version == 'true'
80+
if: inputs.release_type == 'auto'
4281
run: |
4382
npm run release
4483
4584
- name: Generate Version
4685
run: |
4786
echo NPM_VERSION=$(node -e "console.log(require('./package.json').version);") >> $GITHUB_ENV
4887
49-
- name: Bump Version
50-
if: github.event.inputs.next_version == 'true'
51-
run: npm version $NPM_VERSION
88+
- name: Output NPM Version and tag
89+
id: npm_version_output
90+
run: |
91+
NPM_TAG=$(node ./scripts/get-npm-tag.js)
92+
if [[ "${GITHUB_REF}" == refs/tags/* ]] || [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.release_type }}" != "dev" && "${{ inputs.release_type }}" != "auto" ]]; then
93+
IS_RELEASE=true
94+
else
95+
IS_RELEASE=false
96+
fi
97+
echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT
98+
echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT
99+
echo IS_RELEASE=$IS_RELEASE >> $GITHUB_OUTPUT
52100
53101
- name: Build nativescript
54102
run: npm pack
55-
56-
- name: npm ENV
57-
env:
58-
NPM_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
59-
run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
60103

61-
- name: Publish next nativescript version
62-
if: github.event.inputs.next_version == 'true'
104+
- name: Upload npm package artifact
105+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
106+
with:
107+
name: npm-package
108+
path: akylas-nativescript-cli-${{steps.npm_version_output.outputs.NPM_VERSION}}.tgz
109+
110+
publish:
111+
runs-on: ubuntu-latest
112+
environment: npm-publish
113+
needs:
114+
- build
115+
permissions:
116+
contents: read
117+
id-token: write
118+
env:
119+
NPM_VERSION: ${{needs.build.outputs.npm_version}}
120+
NPM_TAG: ${{needs.build.outputs.npm_tag}}
121+
steps:
122+
- name: Harden the runner (Audit all outbound calls)
123+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
124+
with:
125+
egress-policy: audit
126+
127+
- uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
128+
with:
129+
node-version: 22.14.0
130+
registry-url: "https://registry.npmjs.org"
131+
132+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
133+
with:
134+
name: npm-package
135+
path: dist
136+
137+
- name: Update npm (required for OIDC trusted publishing)
138+
run: |
139+
npm install -g npm@^11.5.1
140+
npm --version
141+
142+
- name: Publish package (OIDC trusted publishing)
143+
if: ${{ vars.USE_NPM_TOKEN != 'true' }}
63144
run: |
64-
echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG..."
65-
npm publish akylas-nativescript-cli-$NPM_VERSION.tgz --tag $NPM_TAG
145+
echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG via OIDC trusted publishing..."
146+
unset NODE_AUTH_TOKEN
147+
if [ -n "${NPM_CONFIG_USERCONFIG:-}" ]; then
148+
rm -f "$NPM_CONFIG_USERCONFIG"
149+
fi
150+
npm publish ./dist/akylas-nativescript-cli-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance
151+
env:
152+
NODE_AUTH_TOKEN: ""
66153

67-
- name: Publish nativescript
68-
if: github.event.inputs.next_version == 'false'
154+
- name: Publish package (granular token)
155+
if: ${{ vars.USE_NPM_TOKEN == 'true' }}
69156
run: |
70-
echo "Publishing nativescript@$NPM_VERSION to NPM..."
71-
npm publish akylas-nativescript-cli-$NPM_VERSION.tgz
157+
echo "Publishing nativescript@$NPM_VERSION to NPM with tag $NPM_TAG via granular token..."
158+
npm publish ./dist/nativescript-${{env.NPM_VERSION}}.tgz --tag $NPM_TAG --access public --provenance
159+
env:
160+
NODE_AUTH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
161+
162+
github-release:
163+
runs-on: ubuntu-latest
164+
# runs for tag pushes and for manual dispatches that bumped a stable release
165+
if: ${{ needs.build.outputs.is_release == 'true' }}
166+
permissions:
167+
contents: write
168+
needs:
169+
- build
170+
env:
171+
NPM_VERSION: ${{needs.build.outputs.npm_version}}
172+
steps:
173+
- name: Harden the runner (Audit all outbound calls)
174+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
175+
with:
176+
egress-policy: audit
177+
178+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
179+
with:
180+
fetch-depth: 0
181+
ref: v${{needs.build.outputs.npm_version}}
72182

73-
- name: Push to git
74-
if: github.event.inputs.bump_version == 'true'
183+
- uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
184+
with:
185+
node-version: 22.14.0
186+
187+
- name: Setup
188+
run: npm i --ignore-scripts --legacy-peer-deps --no-package-lock
189+
190+
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
191+
with:
192+
name: npm-package
193+
path: dist
194+
195+
- name: Generate provenance statement
75196
run: |
76-
git push origin --tags
77-
git push origin
197+
TGZ_PATH=$(ls dist/nativescript-*.tgz | head -n1)
198+
TGZ_NAME=$(basename "$TGZ_PATH")
199+
TGZ_SHA=$(sha256sum "$TGZ_PATH" | awk '{ print $1 }')
200+
PROV_PATH="dist/${TGZ_NAME%.tgz}.intoto.jsonl"
201+
202+
cat > "$PROV_PATH" <<EOF
203+
{"_type":"https://in-toto.io/Statement/v1","subject":[{"name":"$TGZ_NAME","digest":{"sha256":"$TGZ_SHA"}}],"predicateType":"https://slsa.dev/provenance/v1"}
204+
EOF
205+
206+
- name: Partial Changelog
207+
run: npx conventional-changelog -p angular -r2 > body.md
208+
209+
- uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
210+
with:
211+
tag: v${{needs.build.outputs.npm_version}}
212+
artifacts: "dist/nativescript-*.tgz,dist/nativescript-*.intoto.jsonl"
213+
bodyFile: "body.md"
214+
prerelease: ${{needs.build.outputs.npm_tag != 'latest'}}
215+
allowUpdates: true

‎.github/workflows/npm_release_doctor.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ jobs:
2424
steps:
2525

2626
- name: Harden the runner (Audit all outbound calls)
27-
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
27+
uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
2828
with:
2929
egress-policy: audit
3030

31-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
31+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
3232

3333
- name: Setup
3434
run: npm install

‎.github/workflows/scorecard.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
steps:
3434

3535
- name: "Checkout code"
36-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4.3.0
36+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.3.0
3737
with:
3838
persist-credentials: false
3939

@@ -46,7 +46,7 @@ jobs:
4646
# - you want to enable the Branch-Protection check on a *public* repository, or
4747
# - you are installing Scorecards on a *private* repository
4848
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
49-
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
49+
repo_token: ${{ secrets.SCORECARD_TOKEN }}
5050

5151
# Public repositories:
5252
# - Publish results to OpenSSF REST API for easy access by consumers
@@ -60,14 +60,14 @@ jobs:
6060
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6161
# format to the repository Actions tab.
6262
- name: "Upload artifact"
63-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
63+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
6464
with:
6565
name: SARIF file
6666
path: results.sarif
6767
retention-days: 5
6868

6969
# Upload the results to GitHub's code scanning dashboard.
7070
- name: "Upload to code-scanning"
71-
uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
71+
uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
7272
with:
7373
sarif_file: results.sarif

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,5 @@ lib/common/test-reports.xml
8787
!lib/common/test-scripts/**
8888
!lib/common/scripts/**
8989
config/test-deps-versions-generated.json
90+
!scripts/get-next-version.js
91+
!scripts/get-npm-tag.js

0 commit comments

Comments
 (0)