fix: bump glob from 8.1.0 to 11.0.0

.cherry.cjs

@@ -0,0 +1,19 @@
+const JS_FILES = '**/*.{js,jsx}'
+const TS_FILES = '**/*.{ts,tsx}'
+
+module.exports = {
+  project_name: 'cherrypush/cherry-cli',
+  plugins: {
+    // npmOutdated: {}, // TODO: this requires an active internet connection thus should not be used in tests
+    loc: {},
+    eslint: {},
+    jsCircularDependencies: { include: 'src/**' },
+    // jsUnimported: {}, // TODO: investigate why this takes so long with a slow internet connection
+  },
+  metrics: [
+    {
+      name: 'TODO',
+      pattern: /TODO/,
+    },
+  ],
+}

.eslintrc.cjs

@@ -1,17 +1,35 @@
 module.exports = {
+  ignorePatterns: ['dist/', 'node_modules/', '.eslintrc.cjs'],
   env: {
-    browser: true,
+    node: true,
     es2021: true,
   },
-  extends: ['eslint:recommended', 'plugin:react/recommended', 'plugin:@typescript-eslint/recommended'],
-  overrides: [],
   parser: '@typescript-eslint/parser',
   parserOptions: {
     ecmaVersion: 'latest',
     sourceType: 'module',
+    project: './tsconfig.json',
   },
-  plugins: ['react', '@typescript-eslint'],
+  plugins: ['@typescript-eslint'],
+  extends: ['eslint:recommended', 'prettier', 'plugin:@typescript-eslint/recommended'],
+  root: true,
+  overrides: [],
   rules: {
-    'react/prop-types': 'off',
+    'no-return-await': 'error',
+    '@typescript-eslint/await-thenable': 'error',
+    '@typescript-eslint/no-floating-promises': 'error',
+    '@typescript-eslint/no-unused-vars': [
+      'error',
+      // We need to ignore unused variables that start with an underscore to avoid linting errors on catch(error) blocks
+      {
+        args: 'all',
+        argsIgnorePattern: '^_',
+        caughtErrors: 'all',
+        caughtErrorsIgnorePattern: '^_',
+        destructuredArrayIgnorePattern: '^_',
+        varsIgnorePattern: '^_',
+        ignoreRestSiblings: true,
+      },
+    ],
   },
 }

.github/dependabot.yml

@@ -5,16 +5,12 @@
 
 version: 2
 updates:
-  - package-ecosystem: "bundler"
-    directory: "/"
-    schedule:
-      interval: 'daily'
-      time: '09:00'
-    versioning-strategy: 'lockfile-only'
   - package-ecosystem: 'npm'
-    directory: "/"
+    directory: '/'
+    versioning-strategy: 'increase'
     schedule:
       interval: 'daily'
       time: '09:00'
-    versioning-strategy: 'increase'
-
+    commit-message:
+      prefix: 'fix: '
+      prefix-development: 'fix(dev): '

.github/workflows/cherry_diff.yml

@@ -1,27 +1,22 @@
-name: cherry diff
+name: Prevent new violations
 
 on:
   pull_request:
 
 jobs:
-  cherry:
-    name: runner / cherry
-    runs-on: ubuntu-22.04
+  cherry_diff:
+    runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - name: Checkout repo
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 0
-
-      - name: Setup ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: 3.2.1
+          fetch-depth: 0 # fetches all commits from all branches
+          ref: ${{ github.head_ref }} # checks out the branch that triggered the workflow
 
       - name: Install dependencies
-        run: |
-          bundle install
-          npm i -g cherrypush
+        run: npm install
 
-      - name: Cherry diff
-        run: cherry diff origin/${{ github.base_ref }}
+      - name: Raise if new JavaScript code is added
+        # This command will fail if the number of lines of code in JavaScript files has increased
+        # in the current branch compared to the base branch, encouraging developers to contribute to migrating to TS.
+        run: npm run cherry -- diff --metric='[loc] JavaScript' --error-if-increase --quiet

.github/workflows/cherry_push.yml

@@ -2,28 +2,19 @@ name: cherry push
 
 on:
   push:
-    branches:
-      - main
+    branches: [main]
 
 jobs:
-  cherry:
-    name: cherry push
-    runs-on: ubuntu-22.04
+  cherry_push:
+    runs-on: ubuntu-latest
     steps:
-      - name: Checkout repo
-        uses: actions/checkout@v3
+      - name: Checkout project
+        uses: actions/checkout@v4
         with:
-          fetch-depth: 0
-
-      - name: Setup ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: 3.2.1
+          fetch-depth: 2
 
       - name: Install dependencies
-        run: |
-          bundle install
-          npm i -g cherrypush
+        run: npm install
 
       - name: Push metrics
-        run: cherry push --api-key=${{ secrets.CHERRY_API_KEY }}
+        run: npm run cherry -- push --quiet --api-key=${{ secrets.CHERRY_API_KEY }}

.github/workflows/ci_tests.yml

@@ -6,59 +6,41 @@ on:
   pull_request:
     branches: [main]
 
-env:
-  POSTGRES_DB: postgres
-  POSTGRES_USER: postgres
-  POSTGRES_PASSWORD: password
-  RAILS_ENV: test
-  PGHOST: localhost
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   test:
     runs-on: ubuntu-latest
-
-    env:
-      RAILS_MASTER_KEY: ${{ secrets.RAILS_MASTER_KEY }}
-
-    services:
-      postgres:
-        image: postgres:12
-        env:
-          POSTGRES_DB: ${{ env.POSTGRES_DB }} # if this is not set, then the value of POSTGRES_USER will be used
-          POSTGRES_PASSWORD: ${{ env.POSTGRES_PASSWORD }} # required
-        ports: ['5432:5432']
-        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
+    timeout-minutes: 10
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Setup ruby
-        uses: ruby/setup-ruby@v1
+        uses: actions/checkout@v4 # https://github.com/actions/checkout
         with:
-          ruby-version: 3.2.1
+          # Depth 0 will fetch all commits from all branches
+          # This is required for cherry diff to checkout the master branch when running on pull requests
+          fetch-depth: 0
+          # Checks out the branch that triggered the workflow
+          # - head_ref is set when the event that triggered the workflow is a pull request
+          # - ref_name is set when the event that triggered the workflow is a push on master
+          # Refer to: https://stackoverflow.com/a/71158878/1096110
+          ref: ${{ github.head_ref || github.ref_name }}
 
       - name: Set up node
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@v4
         with:
-          node-version: 16.13.1
-
-      - name: Install ruby dependencies
-        run: bundle install
-
-      - name: Prepare database
-        run: bundle exec rails db:schema:load
+          node-version-file: .nvmrc
+          cache: npm
 
       - name: Install node dependencies
-        run: npm install
+        run: npm ci
 
-      - name: Run unit tests
-        run: bundle exec rails test
+      - name: Run lint
+        run: npm run lint
 
-      - name: Install chrome headless
-        run: |
-          sudo apt-get update
-          sudo apt-get install google-chrome-stable
+      - name: Setup fixtures for tests
+        run: npm run test:setup
 
-      - name: Run system tests
-        run: HEADLESS=1 bundle exec rails test:system
+      - name: Run tests
+        run: npm test

.github/workflows/pull_request_automation.yml

@@ -0,0 +1,28 @@
+name: Pull Request Automation
+
+on:
+  pull_request_target:
+    types: [labeled]
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    timeout-minutes: 5
+    if: ${{ github.event.label.name == 'auto-approve' }}
+    steps:
+      - uses: hmarr/auto-approve-action@v4
+
+  auto-merge:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: ${{ github.event.label.name == 'auto-merge' }}
+    steps:
+      - name: Auto merge
+        run: gh pr merge --auto ${STRATEGY} "${PR_URL}"
+        shell: bash
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STRATEGY: '--squash'

.github/workflows/release-please.yml

@@ -0,0 +1,43 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: google-github-actions/release-please-action@v4
+        id: release
+        with:
+          release-type: node
+
+      # The logic below handles the npm publication.
+      # The if statements ensure that a publication only occurs when a new release is created.
+      - uses: actions/checkout@v4
+        if: ${{ steps.release.outputs.release_created }}
+
+      # The registry-url must be set for authentication to work on the npm publish step
+      # Ref: https://github.com/actions/setup-node/issues/342#issuecomment-950119520
+      - uses: actions/setup-node@v4
+        if: ${{ steps.release.outputs.release_created }}
+        with:
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: npm ci
+        if: ${{ steps.release.outputs.release_created }}
+
+      - run: npm run build
+        if: ${{ steps.release.outputs.release_created }}
+
+      # Make sure that the NPM_TOKEN has been set as a "Repository secret"
+      - run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+        if: ${{ steps.release.outputs.release_created }}

.gitignore

@@ -34,14 +34,33 @@
 /app/assets/builds/*
 !/app/assets/builds/.keep
 
-# project-specific
-/node_modules
-/vendor/cache
-.env
-
 # Vite Ruby
 /public/vite*
 # Vite uses dotenv and suggests to ignore local-only env files. See
 # https://vitejs.dev/guide/env-and-mode.html#env-files
 *.local
 
+# Environment variables
+.env
+.rbenv-vars
+
+# outputs
+cherry.json
+cherry.sarif
+cherry.sonar
+
+# project-specific
+node_modules
+/vendor/cache
+/vendor/bundle
+latest.dump
+results.json
+
+# TypeScript files
+dist/
+
+# Ignore test fixtures
+test/fixtures/super-project-source
+test/fixtures/super-project-remote
+test/fixtures/empty-project-source
+test/fixtures/empty-project-remote

.husky/pre-commit

@@ -0,0 +1,6 @@
+npx lint-staged
+
+# TODO: it'd be nice to run tests here, but it does not work because cherry diff requires the git diff to be clean.
+# Ideally, we should be able to run tests independently of the uncommitted changes, probably by using a dummy repo.
+# Once we have that, we can unskip the line below.
+# npm test

.npmignore

@@ -0,0 +1,6 @@
+# ignore everything
+*
+
+# include these
+!dist/
+!package.json

.nvmrc

@@ -1 +1 @@
-19.7.0
+v20.14.0