Skip to content

Commit 73248f2

Browse files
Copilothotlong
Copilot
and
hotlong
committed
Add explicit permissions to workflows for security
Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>
1 parent 8752f82 commit 73248f2

File tree

3 files changed

+201
-0
lines changed

3 files changed

+201
-0
lines changed

‎.github/WORKFLOWS.md‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
# Automation Workflows
2+
3+
This document provides an overview of all automation workflows configured in this repository.
4+
5+
## Continuous Integration & Deployment
6+
7+
### CI Workflow (`ci.yml`)
8+
**Trigger:** Push to `main` or `develop`, Pull Requests, Manual dispatch
9+
10+
**What it does:**
11+
- Tests code on Node.js 18.x and 20.x
12+
- Installs dependencies using `npm ci`
13+
- Runs TypeScript type checking
14+
- Builds all workspace packages
15+
- Runs all example scripts to validate functionality:
16+
- Basic example
17+
- E-commerce example
18+
- Blog example
19+
- CRM example
20+
- Comprehensive CRM example
21+
- Archives build artifacts (for Node.js 20.x)
22+
23+
**Matrix Strategy:** Tests on multiple Node.js versions to ensure compatibility
24+
25+
---
26+
27+
### Code Quality Workflow (`code-quality.yml`)
28+
**Trigger:** Pull Requests to `main` or `develop`, Manual dispatch
29+
30+
**What it does:**
31+
- Runs comprehensive TypeScript type checking
32+
- Verifies successful build without TypeScript errors
33+
- Validates package structure (directories and files exist)
34+
- Tests that examples can execute successfully
35+
36+
**Purpose:** Ensures code quality before merging PRs
37+
38+
---
39+
40+
### Release Workflow (`release.yml`)
41+
**Trigger:** Git tags matching `v*.*.*` pattern (e.g., v1.0.0), Manual dispatch
42+
43+
**What it does:**
44+
- Builds all packages
45+
- Creates GitHub releases automatically
46+
- Generates release notes from commits
47+
- Attaches package.json files and documentation to release
48+
49+
**Usage:** Create and push a version tag to trigger a release:
50+
```bash
51+
git tag v1.0.0
52+
git push origin v1.0.0
53+
```
54+
55+
---
56+
57+
## Dependency Management
58+
59+
### Dependabot (`dependabot.yml`)
60+
**Trigger:** Weekly on Mondays
61+
62+
**What it does:**
63+
- Checks for npm dependency updates in:
64+
- Root package
65+
- Core package (`packages/core`)
66+
- Examples package (`packages/examples`)
67+
- Checks for GitHub Actions updates
68+
- Creates PRs with dependency updates
69+
- Auto-assigns PRs to `hotlong`
70+
- Limits to 5 PRs per ecosystem
71+
- Adds appropriate labels (dependencies, core, examples, github-actions)
72+
73+
**Configuration:**
74+
- Conventional commit messages with scope
75+
- Weekly schedule
76+
- Separate configurations for better organization
77+
78+
---
79+
80+
## Repository Automation
81+
82+
### Auto-assign Workflow (`auto-assign.yml`)
83+
**Trigger:** New issues or pull requests
84+
85+
**What it does:**
86+
- Automatically assigns new issues and PRs to `hotlong`
87+
- Assigns 1 person per issue/PR
88+
89+
---
90+
91+
### Auto-label Workflow (`auto-label.yml`)
92+
**Trigger:** PR opened, synchronized, or reopened
93+
94+
**What it does:**
95+
- Automatically labels PRs based on changed files:
96+
- `core` - Changes in packages/core
97+
- `examples` - Changes in packages/examples
98+
- `documentation` - Changes in markdown files
99+
- `dependencies` - Changes in package.json files
100+
- `ci/cd` - Changes in workflow files
101+
- `typescript` - Changes in TypeScript files
102+
- `configuration` - Changes in config files
103+
104+
**Configuration:** Uses `.github/labeler.yml` for label rules
105+
106+
---
107+
108+
### Stale Issues/PRs Workflow (`stale.yml`)
109+
**Trigger:** Daily at 00:00 UTC, Manual dispatch
110+
111+
**What it does:**
112+
- Marks issues as stale after 60 days of inactivity
113+
- Closes stale issues after 7 additional days
114+
- Marks PRs as stale after 30 days of inactivity
115+
- Closes stale PRs after 7 additional days
116+
- Removes stale label when activity resumes
117+
- Exempts pinned, security, and enhancement issues
118+
- Exempts pinned, security, and work-in-progress PRs
119+
120+
**Purpose:** Keeps the issue tracker clean and organized
121+
122+
---
123+
124+
### Proof HTML Workflow (`proof-html.yml`)
125+
**Trigger:** Push to any branch, Manual dispatch
126+
127+
**What it does:**
128+
- Validates HTML content in the repository
129+
- Checks for broken links and HTML issues
130+
131+
---
132+
133+
## Best Practices
134+
135+
### For Contributors
136+
1. **Before creating a PR:**
137+
- Run `npm run type-check` locally
138+
- Run `npm run build` to ensure no build errors
139+
- Test relevant examples
140+
141+
2. **Dependency updates:**
142+
- Review Dependabot PRs regularly
143+
- Test changes before merging
144+
145+
3. **Releases:**
146+
- Use semantic versioning (MAJOR.MINOR.PATCH)
147+
- Tag releases with `v` prefix (e.g., v1.0.0)
148+
149+
### For Maintainers
150+
1. **Weekly tasks:**
151+
- Review Dependabot PRs
152+
- Check stale issues/PRs
153+
- Monitor CI failures
154+
155+
2. **Release process:**
156+
- Update version in package.json files
157+
- Create and push git tag
158+
- Verify release workflow success
159+
160+
3. **Workflow maintenance:**
161+
- Keep GitHub Actions up to date
162+
- Review workflow runs regularly
163+
- Adjust stale timings as needed
164+
165+
## Troubleshooting
166+
167+
### CI Failures
168+
1. Check the workflow run in GitHub Actions tab
169+
2. Review error logs for specific failures
170+
3. Run the same commands locally to reproduce
171+
4. Common issues:
172+
- TypeScript errors: Run `npm run type-check`
173+
- Build errors: Run `npm run build`
174+
- Example failures: Run specific example script
175+
176+
### Dependabot Issues
177+
1. Check for breaking changes in dependency updates
178+
2. Review changelogs of updated packages
179+
3. Test locally before merging
180+
4. Adjust version constraints if needed
181+
182+
### Stale Bot False Positives
183+
1. Add `pinned` label to keep issues open
184+
2. Comment on issues to reset the timer
185+
3. Adjust stale timings in `stale.yml` if needed
186+
187+
## Workflow Files
188+
189+
- `.github/workflows/ci.yml` - Main CI pipeline
190+
- `.github/workflows/code-quality.yml` - Code quality checks
191+
- `.github/workflows/release.yml` - Release automation
192+
- `.github/workflows/auto-assign.yml` - Auto-assignment
193+
- `.github/workflows/auto-label.yml` - Auto-labeling
194+
- `.github/workflows/stale.yml` - Stale issue management
195+
- `.github/workflows/proof-html.yml` - HTML validation
196+
- `.github/dependabot.yml` - Dependency update config
197+
- `.github/labeler.yml` - Auto-labeling rules

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ on:
1010
jobs:
1111
build-and-test:
1212
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
1315

1416
strategy:
1517
matrix:

‎.github/workflows/code-quality.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
jobs:
99
quality-checks:
1010
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
1113

1214
steps:
1315
- name: Checkout code

0 commit comments

Comments
 (0)