Skip to content

Commit 2d0f9e4

Browse files
mcabreradevmcabreradev
authored
fix: workflows actions (#81)
* feat: refactor code structure for improved readability and maintainability * feat: add GitHub workflows for release, PR title linting, and security audit * fix: update version to 5.9.0 in package.json * feat: add build step to testing workflow
1 parent f93ce0d commit 2d0f9e4

6 files changed

Lines changed: 243 additions & 16 deletions

File tree

‎.github/workflows/github-release.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: GitHub Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*'
7+
8+
permissions:
9+
contents: write
10+
11+
jobs:
12+
release:
13+
name: 🚀 Create GitHub Release
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: ⬇️ Checkout repo
18+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
19+
with:
20+
fetch-depth: 0
21+
22+
- name: 🏷️ Create GitHub Release
23+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
24+
with:
25+
script: |
26+
const tag = context.ref.replace('refs/tags/', '');
27+
const version = tag.replace(/^v/, '');
28+
29+
const installBlock = [
30+
'## Install',
31+
'```sh',
32+
`npm install @mcabreradev/filter@${version}`,
33+
`pnpm add @mcabreradev/filter@${version}`,
34+
`yarn add @mcabreradev/filter@${version}`,
35+
'```',
36+
'',
37+
`📦 [View on npm](https://www.npmjs.com/package/@mcabreradev/filter/v/${version})`,
38+
'',
39+
'---',
40+
'',
41+
].join('\n');
42+
43+
const { data: release } = await github.rest.repos.createRelease({
44+
owner: context.repo.owner,
45+
repo: context.repo.repo,
46+
tag_name: tag,
47+
name: `Release ${tag}`,
48+
body: installBlock,
49+
generate_release_notes: true,
50+
draft: false,
51+
prerelease: false,
52+
});
53+
54+
console.log(`✅ Release created: ${release.html_url}`);

‎.github/workflows/npm-publish-manual.yml‎

Lines changed: 28 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -51,19 +51,24 @@ jobs:
5151
echo "Build files:"
5252
ls -la build/
5353
54+
- name: 🔒 Security audit
55+
run: pnpm audit --audit-level=high
56+
5457
- name: 🔍 Running Check/Test Suite
5558
run: pnpm run check
5659

5760
- name: 🔍 Determine version bump from PR title or labels
5861
id: version
62+
env:
63+
PR_TITLE: ${{ github.event.pull_request.title }}
64+
PR_LABELS: ${{ toJSON(github.event.pull_request.labels) }}
5965
run: |
6066
VERSION_TYPE=""
6167
DETECTION_METHOD=""
6268
6369
# ============================================
6470
# PASO 1: Intentar detectar por título del PR
6571
# ============================================
66-
PR_TITLE="${{ github.event.pull_request.title }}"
6772
echo "📋 PR Title: $PR_TITLE"
6873
6974
# Extraer el tipo (soporta: "type: msg", "type(scope): msg", "type!: msg")
@@ -100,8 +105,7 @@ jobs:
100105
if [ -z "$VERSION_TYPE" ]; then
101106
echo "⚠️ No valid conventional commit format in title, checking labels..."
102107
103-
LABELS='${{ toJSON(github.event.pull_request.labels) }}'
104-
LABEL_NAMES=$(echo "$LABELS" | jq -r '.[].name' 2>/dev/null || echo "")
108+
LABEL_NAMES=$(echo "$PR_LABELS" | jq -r '.[].name' 2>/dev/null || echo "")
105109
106110
if [ -n "$LABEL_NAMES" ]; then
107111
echo "🏷️ Labels found: $LABEL_NAMES"
@@ -144,26 +148,36 @@ jobs:
144148
145149
echo "type=$VERSION_TYPE" >> $GITHUB_OUTPUT
146150
147-
- name: 📈 Bump version
151+
- name: 📈 Bump version (local only)
148152
run: |
149153
git config user.name "github-actions[bot]"
150154
git config user.email "github-actions[bot]@users.noreply.github.com"
151155
pnpm version ${{ steps.version.outputs.type }} --no-git-tag-version
156+
157+
- name: 🔎 Check version doesn't already exist on npm
158+
run: |
152159
NEW_VERSION=$(node -p "require('./package.json').version")
153160
echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV
161+
if npm view "@mcabreradev/filter@$NEW_VERSION" version 2>/dev/null | grep -q "$NEW_VERSION"; then
162+
echo "❌ Version $NEW_VERSION already exists on npm. Aborting to avoid duplicate publish."
163+
exit 1
164+
fi
165+
echo "✅ Version $NEW_VERSION is available for publishing."
166+
167+
- name: 🚀 Publish to npm
168+
run: pnpm publish --no-git-checks --access public --provenance
169+
env:
170+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
171+
172+
- name: 📝 Commit version bump
173+
run: |
154174
git add package.json
155175
git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
156176
157177
- name: 🔄 Push version bump
158-
run: |
159-
git push origin main
178+
run: git push origin main
160179

161-
- name: 📝 Create Git Tag
180+
- name: 🏷️ Create Git Tag
162181
run: |
163-
git tag -a "v${{ env.NEW_VERSION }}" -m "Release v${{ env.NEW_VERSION }}"
164-
git push origin "v${{ env.NEW_VERSION }}"
165-
166-
- name: 🚀 Publish to npm
167-
run: pnpm publish --no-git-checks --access public
168-
env:
169-
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
182+
git tag -a "v$NEW_VERSION" -m "Release v$NEW_VERSION"
183+
git push origin "v$NEW_VERSION"

‎.github/workflows/pr-title-lint.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
name: PR Title Lint
2+
3+
on:
4+
pull_request:
5+
types: [opened, edited, synchronize, reopened]
6+
branches:
7+
- main
8+
9+
permissions:
10+
pull-requests: read
11+
12+
jobs:
13+
lint-pr-title:
14+
name: 📋 Validate PR Title
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: ✅ Validate conventional commit format
19+
env:
20+
PR_TITLE: ${{ github.event.pull_request.title }}
21+
run: |
22+
PATTERN='^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert|major|breaking|minor|feature|bugfix|hotfix|patch)(\([^)]+\))?!?:[[:space:]].+'
23+
24+
echo "📋 PR Title: $PR_TITLE"
25+
echo ""
26+
27+
if echo "$PR_TITLE" | grep -qE "$PATTERN"; then
28+
echo "✅ PR title follows conventional commits format."
29+
else
30+
echo "❌ PR title does not follow conventional commits format."
31+
echo ""
32+
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
33+
echo " Expected format:"
34+
echo ""
35+
echo " <type>(<scope>): <description>"
36+
echo " <type>!: <description> (breaking change)"
37+
echo " <type>(<scope>)!: <description> (breaking change)"
38+
echo ""
39+
echo " Valid types:"
40+
echo " MINOR bump → feat, feature, minor"
41+
echo " PATCH bump → fix, bugfix, hotfix, chore, docs,"
42+
echo " style, refactor, perf, test, build,"
43+
echo " ci, revert"
44+
echo " MAJOR bump → major, breaking, or any type with !"
45+
echo ""
46+
echo " Examples:"
47+
echo " feat: add \$in operator support"
48+
echo " fix(core): resolve cache invalidation bug"
49+
echo " feat!: remove deprecated find() API"
50+
echo " chore(deps): update dependencies"
51+
echo " refactor(predicate): simplify factory pattern"
52+
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
53+
exit 1
54+
fi

‎.github/workflows/security-audit.yml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: Security Audit
2+
3+
on:
4+
schedule:
5+
- cron: '0 8 * * 1' # every Monday at 08:00 UTC
6+
push:
7+
branches:
8+
- main
9+
pull_request:
10+
branches:
11+
- main
12+
workflow_dispatch:
13+
14+
permissions:
15+
contents: read
16+
issues: write
17+
18+
jobs:
19+
audit:
20+
name: 🔒 Security Audit
21+
runs-on: ubuntu-latest
22+
23+
steps:
24+
- name: ⬇️ Checkout repo
25+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
26+
27+
- name: 📦 Setup pnpm
28+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
29+
with:
30+
version: 10
31+
32+
- name: ⎔ Setup Node.js
33+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
34+
with:
35+
node-version: 20
36+
cache: 'pnpm'
37+
38+
- name: 📥 Install dependencies
39+
run: pnpm install --frozen-lockfile --ignore-scripts
40+
41+
- name: 🔍 Audit (high & critical)
42+
id: audit_high
43+
run: pnpm audit --audit-level=high
44+
continue-on-error: true
45+
46+
- name: 📋 Audit report (all severities)
47+
id: audit_full
48+
run: |
49+
echo "## Security Audit Report" >> $GITHUB_STEP_SUMMARY
50+
echo "" >> $GITHUB_STEP_SUMMARY
51+
pnpm audit --json 2>/dev/null | node -e "
52+
const chunks = [];
53+
process.stdin.on('data', c => chunks.push(c));
54+
process.stdin.on('end', () => {
55+
try {
56+
const data = JSON.parse(chunks.join(''));
57+
const meta = data.metadata || {};
58+
const vulns = meta.vulnerabilities || {};
59+
const total = (vulns.critical||0) + (vulns.high||0) + (vulns.moderate||0) + (vulns.low||0) + (vulns.info||0);
60+
console.log('| Severity | Count |');
61+
console.log('|---|---|');
62+
if (vulns.critical) console.log('| 🔴 Critical | ' + vulns.critical + ' |');
63+
if (vulns.high) console.log('| 🔴 High | ' + vulns.high + ' |');
64+
if (vulns.moderate) console.log('| 🟡 Moderate | ' + vulns.moderate + ' |');
65+
if (vulns.low) console.log('| 🟢 Low | ' + vulns.low + ' |');
66+
if (total === 0) console.log('| ✅ None | 0 |');
67+
} catch(e) {
68+
console.log('Could not parse audit output.');
69+
}
70+
});
71+
" >> $GITHUB_STEP_SUMMARY
72+
continue-on-error: true
73+
74+
- name: 🚨 Open issue if high/critical vulnerabilities found (scheduled only)
75+
if: steps.audit_high.outcome == 'failure' && github.event_name == 'schedule'
76+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
77+
with:
78+
script: |
79+
const title = '🔒 Security vulnerabilities found in dependencies';
80+
const { data: issues } = await github.rest.issues.listForRepo({
81+
owner: context.repo.owner,
82+
repo: context.repo.repo,
83+
state: 'open',
84+
labels: 'security',
85+
});
86+
const existing = issues.find(i => i.title === title);
87+
if (!existing) {
88+
await github.rest.issues.create({
89+
owner: context.repo.owner,
90+
repo: context.repo.repo,
91+
title,
92+
body: `The weekly security audit found high or critical vulnerabilities in dependencies.\n\nRun \`pnpm audit\` locally to see details and \`pnpm audit --fix\` or update \`pnpm.overrides\` to resolve them.\n\nWorkflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}`,
93+
labels: ['security'],
94+
});
95+
}
96+
97+
- name: ❌ Fail if high/critical vulnerabilities found
98+
if: steps.audit_high.outcome == 'failure'
99+
run: |
100+
echo "High or critical vulnerabilities were found. See audit report above."
101+
exit 1

‎.github/workflows/testing.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,14 @@ name: Code Check
33
on:
44
push:
55
branches:
6+
- main
67
- dev
78
- stage
89
- master
910
- prod
1011
pull_request:
1112
branches:
13+
- main
1214
- dev
1315
- stage
1416
- master
@@ -60,6 +62,9 @@ jobs:
6062
- name: 📊 Generate coverage report
6163
run: pnpm run test:coverage
6264

65+
- name: 🏗️ Build
66+
run: pnpm run build
67+
6368
- name: Re Check All
6469
run: pnpm run check
6570

‎package.json‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -297,8 +297,7 @@
297297
],
298298
"publishConfig": {
299299
"access": "public",
300-
"registry": "https://registry.npmjs.org",
301-
"provenance": true
300+
"registry": "https://registry.npmjs.org"
302301
},
303302
"pnpm": {
304303
"overrides": {

0 commit comments

Comments
 (0)