diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e2eefb8..61383e7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,23 +1,120 @@ -name: CI +name: CI and Release on: + push: + branches: + - main + - next + - beta + - alpha + - '*.*.x' # Matches branches like '1.2.x', '2.3.x' + - '*.x' # Matches branches like '1.x', '2.x' pull_request: + branches: + - main + - next + - beta + - alpha + - '*.*.x' # Matches PRs targeting '1.2.x', '2.3.x' + - '*.x' # Matches PRs targeting '1.x', '2.x' permissions: - contents: read # for checkout + contents: read jobs: + # Job 1: Commit Linting commitlint: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: - fetch-depth: 0 # Fetch full history to check commit differences + fetch-depth: 0 # Fetch full history to check commit differences + - name: Set up Node.js uses: actions/setup-node@v4 with: node-version: '22.x' + - name: Install dependencies run: npm ci - - name: Validate all commits from push - run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose \ No newline at end of file + + - name: Validate all commits + run: npx commitlint --from ${{ github.event.pull_request.base.sha || github.event.before }} --to ${{ github.event.pull_request.head.sha || github.sha }} --verbose + + # Job 2: Build and Test + test: + runs-on: ubuntu-latest + needs: [commitlint] + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: '22.x' + + - name: Install + run: npm ci + + - name: Build + run: npm run build + + - name: Test + run: npm run test + + - name: List test logs + run: ls -la .test-logs/ + + - name: Upload test logs + uses: actions/upload-artifact@v4 + if: always() + with: + name: test-logs + path: .test-logs/** + include-hidden-files: true + + - name: Verify integrity of dependencies + run: npm audit signatures + + # Job 3: Publish + publish: + needs: [test] + runs-on: ubuntu-latest + permissions: + contents: write # To publish a GitHub release + packages: write # To publish to GitHub Package registry + issues: write # To comment on released issues + pull-requests: write # To comment on released pull requests + id-token: write # To enable OIDC for npm provenance + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Set up Node.js + uses: actions/setup-node@v4 + with: + node-version: '22.x' + registry-url: 'https://npm.pkg.github.com' + scope: '@mitre-attack' + + - name: Install dependencies + run: npm clean-install + env: + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies + run: npm audit signatures + + - name: Release + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # NPM_TOKEN: ${{ secrets.NPM_TOKEN }} DO NOT USE + HUSKY: 0 # Temporarily disables all Git hooks + run: npx semantic-release diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index ba59243..0000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: Release - -on: - pull_request: - branches: - - main - - next - - beta - - alpha - workflow_run: - workflows: ["CI"] # The name of the CI workflow - types: - - completed - -permissions: - contents: read # for checkout - -jobs: - release: - if: | - github.event_name == 'pull_request' && - github.ref == 'refs/heads/main' || - github.ref == 'refs/heads/next' || - github.ref == 'refs/heads/beta' || - github.ref == 'refs/heads/alpha' || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') - runs-on: ubuntu-latest - permissions: - contents: write # to be able to publish a GitHub release - issues: write # to be able to comment on released issues - pull-requests: write # to be able to comment on released pull requests - id-token: write # to enable use of OIDC for npm provenance - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - fetch-depth: 0 - # Note: Automatically populated GITHUB_TOKEN cannot be used if branch protection is enabled - # for the target branch. If the risk is acceptable, some extra configuration is needed. The - # actions/checkout persist-credentials option needs to be false, otherwise the generated - # GITHUB_TOKEN will interfere with the custom one. - # ref: https://github.com/semantic-release/semantic-release/blob/master/docs/recipes/ci-configurations/github-actions.md#pushing-packagejson-changes-to-your-repository - persist-credentials: false - - name: Set up Node.js - uses: actions/setup-node@v4 - with: - node-version: '22.x' - registry-url: 'https://npm.pkg.github.com' - scope: '@mitre-attack' - - name: Install - run: npm clean-install - - name: Build - run: npm run build - - name: Test - run: npm run test - - name: Upload test logs - uses: actions/upload-artifact@v4 - if: always() - with: - name: test-logs - path: .test-logs/ - - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies - run: npm audit signatures - - name: Release - run: npx semantic-release - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..6ebb15c --- /dev/null +++ b/.npmrc @@ -0,0 +1 @@ +@mitre-attack:registry=https://npm.pkg.github.com \ No newline at end of file diff --git a/package-lock.json b/package-lock.json index 9c17002..6945d04 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@mitre-attack/attack-data-model", - "version": "1.0.0-rc.1", + "version": "0.0.0-semantically-released", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@mitre-attack/attack-data-model", - "version": "1.0.0-rc.1", + "version": "0.0.0-semantically-released", "license": "APACHE-2.0", "dependencies": { "axios": "^1.7.5", diff --git a/package.json b/package.json index b2c5dfe..c9f06c2 100644 --- a/package.json +++ b/package.json @@ -36,7 +36,7 @@ "test:interactive": "vitest", "export": "npm pack", "clean": "rm -rf test/**/*.js test/**/*.js.map test/**/*.d.ts test/**/*.ts.map src/**/*.js src/**/*.js.map src/**/*.d.ts", - "prepare": "husky", + "prepare": "husky || true", "lint": "npx eslint src", "lint:fix": "npm run lint -- --fix", "prettier": "npx prettier src --check",