From 21d054bc4d7361e8a86ff0ef0f17e1d1c427024c Mon Sep 17 00:00:00 2001 From: Benoit TRAVERS Date: Fri, 24 Jul 2026 10:17:53 +0200 Subject: [PATCH 1/3] ci: adopt shared @btravstack reusable CI + release workflows --- .github/workflows/ci.yml | 122 ++++------------------------------ .github/workflows/release.yml | 58 ++-------------- 2 files changed, 17 insertions(+), 163 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 833e358..8b46650 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,51 +12,19 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: - format: - name: Format - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Check formatting - run: pnpm format --check - - lint: - name: Lint - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run linter - run: pnpm lint - - typecheck: - name: Type Check - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run type check - run: pnpm typecheck + ci: + uses: btravstack/config/.github/workflows/ci-reusable.yml@main + with: + changeset: true + # knip has an extra pre-step (Prisma client generation), so it stays a + # bespoke job below rather than running via the reusable workflow. + knip: false + test-command: "pnpm test -- --coverage --reporter=default --reporter=github-actions" knip: name: Knip + needs: ci runs-on: ubuntu-latest steps: - name: Checkout @@ -73,42 +41,9 @@ jobs: - name: Run knip run: pnpm exec knip --reporter github-actions - test: - name: Tests - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run tests - run: pnpm test -- --coverage --reporter=default --reporter=github-actions - - - name: Upload Coverage Report - if: always() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 - with: - name: coverage-report - path: ./**/coverage/ - retention-days: 30 - - build: - name: Build - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run build - run: pnpm build - node-floor: name: Node 22 (engine floor) + needs: ci runs-on: ubuntu-latest # CI otherwise runs the .node-version (24). Exercise the declared `engines.node` # floor so the published package is verified on the oldest supported Node. @@ -133,6 +68,7 @@ jobs: package-check: name: Package + needs: ci runs-on: ubuntu-latest steps: - name: Checkout @@ -147,43 +83,9 @@ jobs: - name: Validate published surface (publint + are-the-types-wrong) run: pnpm --filter demesne run check:package - changeset: - name: Changeset - runs-on: ubuntu-latest - # Only on PRs: fail if a versioned package changed without a changeset (docs/examples, - # which are private and unversioned, don't trigger it). `changeset add --empty` opts out. - # Skip the auto-generated release PR (`changeset-release/main`): it CONSUMES the changesets - # while bumping versions, so `changeset status` would (correctly) find none and fail. - if: github.event_name == 'pull_request' && github.head_ref != 'changeset-release/main' - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - with: - fetch-depth: 0 - - - name: Setup - uses: ./.github/actions/setup - - - name: Require a changeset for package changes - run: | - git fetch --no-tags origin main - pnpm exec changeset status --since=origin/main - - security-audit: - name: Security Audit - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Run security audit - run: pnpm audit --audit-level=high - bundle-size: name: Bundle Size + needs: ci runs-on: ubuntu-latest steps: - name: Checkout diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1e7841b..1b0efda 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,62 +3,14 @@ name: Release on: workflow_run: workflows: ["CI"] - types: - - completed - branches: - - main + types: [completed] + branches: [main] concurrency: ${{ github.workflow }}-${{ github.ref }} -env: - FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true - jobs: release: - name: Release - runs-on: ubuntu-latest if: ${{ github.event.workflow_run.conclusion == 'success' }} - permissions: - contents: write - pull-requests: write - id-token: write - - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - with: - # PAT so the git remote is configured with PAT credentials; the bare - # GITHUB_TOKEN push checkout normally sets up is treated as a bot - # event and would not fire `pull_request` workflows on the resulting - # branch — defeating the point of a PAT release. - token: ${{ secrets.RELEASE_PAT }} - - - name: Setup - uses: ./.github/actions/setup - - - name: Build - run: pnpm build - - - name: Create Release Pull Request or Publish to npm - id: changesets - uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1 - with: - # Use `pnpm run …` so we invoke the package.json scripts. Bare - # `pnpm version` collides with pnpm's built-in `version` command and - # silently prints `process.versions` instead of running the changeset - # version script. - version: pnpm run version - publish: pnpm run release - commit: "chore: release packages" - title: "chore: release packages" - env: - # PAT rather than GITHUB_TOKEN: events triggered by GITHUB_TOKEN do - # not start new workflow runs (anti-recursion safeguard), so the - # "Version Packages" PR would otherwise skip CI. Required repo secret: - # RELEASE_PAT (classic PAT with `repo`, or fine-grained with - # Contents + Pull requests read/write on this repo). - GITHUB_TOKEN: ${{ secrets.RELEASE_PAT }} - # NPM_TOKEN intentionally absent — npm Trusted Publishing uses the - # OIDC token minted via `id-token: write`. Each package must have a - # Trusted Publisher configured on npmjs.com pointing at this repo + - # workflow file (.github/workflows/release.yml). + uses: btravstack/config/.github/workflows/release-reusable.yml@main + secrets: + RELEASE_PAT: ${{ secrets.RELEASE_PAT }} From 7023cb00fbf78d65c5821a204ee3462e8cac723c Mon Sep 17 00:00:00 2001 From: Benoit TRAVERS Date: Fri, 24 Jul 2026 11:01:07 +0200 Subject: [PATCH 2/3] ci: absorb knip/bundle-size/node-floor into reusable; pin @workflows-v1; fix release permissions --- .github/workflows/ci.yml | 80 ++--------------------------------- .github/workflows/release.yml | 6 ++- 2 files changed, 8 insertions(+), 78 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8b46650..3ec335d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,71 +1,23 @@ name: CI permissions: contents: read - on: push: branches: [main] pull_request: branches: [main] - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true - jobs: ci: - uses: btravstack/config/.github/workflows/ci-reusable.yml@main + uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1 with: changeset: true - # knip has an extra pre-step (Prisma client generation), so it stays a - # bespoke job below rather than running via the reusable workflow. - knip: false + bundle-size: true + node-floor: "22.19" test-command: "pnpm test -- --coverage --reporter=default --reporter=github-actions" - knip: - name: Knip - needs: ci - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - # knip resolves the example's `../generated/prisma/client.ts` import; generate it - # explicitly rather than relying on the install-time postinstall hook. - - name: Generate the Prisma client - run: pnpm --filter @demesne-examples/hono-prisma-api run prisma:generate - - - name: Run knip - run: pnpm exec knip --reporter github-actions - - node-floor: - name: Node 22 (engine floor) - needs: ci - runs-on: ubuntu-latest - # CI otherwise runs the .node-version (24). Exercise the declared `engines.node` - # floor so the published package is verified on the oldest supported Node. - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup pnpm - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 - - - name: Setup Node 22 - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: "22.19" - cache: pnpm - - - name: Install - run: pnpm install --frozen-lockfile - - - name: Build + test the published package on Node 22 - run: pnpm --filter demesne build && pnpm --filter demesne test - package-check: name: Package needs: ci @@ -82,29 +34,3 @@ jobs: - name: Validate published surface (publint + are-the-types-wrong) run: pnpm --filter demesne run check:package - - bundle-size: - name: Bundle Size - needs: ci - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - - name: Setup - uses: ./.github/actions/setup - - - name: Build the published package - run: pnpm --filter demesne build - - - name: Report bundle size (gzipped, shipped entry points) - run: | - echo "## Bundle size (gzipped)" >> $GITHUB_STEP_SUMMARY - echo "" >> $GITHUB_STEP_SUMMARY - echo "| File | Raw | Gzip |" >> $GITHUB_STEP_SUMMARY - echo "|------|-----|------|" >> $GITHUB_STEP_SUMMARY - for f in packages/core/dist/index.mjs packages/core/dist/index.cjs; do - raw=$(wc -c < "$f" | tr -d ' ') - gz=$(gzip -c "$f" | wc -c | tr -d ' ') - echo "| $(basename "$f") | ${raw} B | ${gz} B |" >> $GITHUB_STEP_SUMMARY - done diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1b0efda..a0c2250 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,6 +11,10 @@ concurrency: ${{ github.workflow }}-${{ github.ref }} jobs: release: if: ${{ github.event.workflow_run.conclusion == 'success' }} - uses: btravstack/config/.github/workflows/release-reusable.yml@main + permissions: + contents: write + pull-requests: write + id-token: write + uses: btravstack/config/.github/workflows/release-reusable.yml@workflows-v1 secrets: RELEASE_PAT: ${{ secrets.RELEASE_PAT }} From 3476b1dadaa5aaae6d13555ef4753ac49bc33aa8 Mon Sep 17 00:00:00 2001 From: Benoit TRAVERS Date: Fri, 24 Jul 2026 11:39:01 +0200 Subject: [PATCH 3/3] =?UTF-8?q?ci:=20thin=20caller=20=E2=80=94=20standardi?= =?UTF-8?q?zed=20reusable=20defaults;=20keep=20package-check?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/ci.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3ec335d..d4e920f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,22 +1,26 @@ name: CI permissions: contents: read + on: push: branches: [main] pull_request: branches: [main] + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true + +env: + FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true + jobs: ci: uses: btravstack/config/.github/workflows/ci-reusable.yml@workflows-v1 with: changeset: true - bundle-size: true node-floor: "22.19" - test-command: "pnpm test -- --coverage --reporter=default --reporter=github-actions" package-check: name: Package @@ -25,12 +29,9 @@ jobs: steps: - name: Checkout uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 - - name: Setup uses: ./.github/actions/setup - - name: Build the published package run: pnpm --filter demesne build - - name: Validate published surface (publint + are-the-types-wrong) run: pnpm --filter demesne run check:package