Skip to content

Commit b27e2e7

Browse files
rajnavakoticlaude
rajnavakoti
and
claude
authored
chore: milestone 8 — CI/CD and release pipeline (#49)
* chore: GitHub Actions CI — test, lint, build on PR CI runs on push to master and PRs. Steps: checkout, npm ci, validate YAML, type check, test, build. Matrix tests on Node 18 and 20 with npm cache. Closes #33 Co-Authored-By: Claude <noreply@anthropic.com> * chore: automated npm publish on GitHub Release Triggers on release creation. Runs full CI then publishes to npm with --provenance flag for supply chain attestation. Requires NPM_TOKEN secret. Closes #34 Co-Authored-By: Claude <noreply@anthropic.com> * chore: publish to GitHub Packages for enterprise consumers Publishes @ea-toolkit/architecture-blocks to GitHub Packages alongside npm on release. Uses GITHUB_TOKEN for auth. Closes #35 Co-Authored-By: Claude <noreply@anthropic.com> * chore: semver strategy with changelog generation Documents when to bump major/minor/patch, deprecation process, commit conventions, and version file update requirements. Closes #36 Co-Authored-By: Claude <noreply@anthropic.com> * chore: package provenance and supply chain security Adds SECURITY.md with vulnerability reporting process. Configures Dependabot for npm and GitHub Actions dependency updates. Publish workflow already uses --provenance flag. Closes #37 Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
1 parent 4b650da commit b27e2e7

6 files changed

Lines changed: 204 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: npm
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
open-pull-requests-limit: 10
8+
labels:
9+
- dependencies
10+
11+
- package-ecosystem: github-actions
12+
directory: /
13+
schedule:
14+
interval: weekly
15+
labels:
16+
- dependencies

‎.github/workflows/ci.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [master]
6+
pull_request:
7+
branches: [master]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
strategy:
13+
matrix:
14+
node-version: [18, 20]
15+
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- uses: actions/setup-node@v4
20+
with:
21+
node-version: ${{ matrix.node-version }}
22+
cache: npm
23+
24+
- run: npm ci
25+
26+
- name: Validate shape YAML
27+
run: npm run validate
28+
29+
- name: Type check
30+
run: npx tsc --noEmit
31+
32+
- name: Test
33+
run: npm test
34+
35+
- name: Build
36+
run: npm run build

‎.github/workflows/publish-gpr.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Publish to GitHub Packages
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
permissions:
8+
contents: read
9+
packages: write
10+
11+
jobs:
12+
publish-gpr:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
17+
- uses: actions/setup-node@v4
18+
with:
19+
node-version: 20
20+
cache: npm
21+
registry-url: https://npm.pkg.github.com
22+
scope: "@ea-toolkit"
23+
24+
- run: npm ci
25+
- run: npm run build
26+
27+
- name: Publish to GitHub Packages
28+
run: npm publish --access public
29+
env:
30+
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/publish.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Publish
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
permissions:
8+
contents: read
9+
id-token: write
10+
11+
jobs:
12+
publish:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
17+
- uses: actions/setup-node@v4
18+
with:
19+
node-version: 20
20+
cache: npm
21+
registry-url: https://registry.npmjs.org
22+
23+
- run: npm ci
24+
25+
- name: Validate shape YAML
26+
run: npm run validate
27+
28+
- name: Type check
29+
run: npx tsc --noEmit
30+
31+
- name: Test
32+
run: npm test
33+
34+
- name: Build
35+
run: npm run build
36+
37+
- name: Publish to npm with provenance
38+
run: npm publish --provenance --access public
39+
env:
40+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

‎SECURITY.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
| Version | Supported |
6+
|---------|-----------|
7+
| 0.1.x | Yes |
8+
9+
## Reporting a Vulnerability
10+
11+
If you discover a security vulnerability in this package:
12+
13+
1. **Do NOT open a public issue**
14+
2. Email: rajnavakoti@gmail.com with subject "architecture-blocks security"
15+
3. Include: description, reproduction steps, and impact assessment
16+
4. Expected response time: 48 hours
17+
18+
## Supply Chain Security
19+
20+
- Published packages include [npm provenance](https://docs.npmjs.com/generating-provenance-statements) attestation
21+
- All releases are built by GitHub Actions from this repository
22+
- Verify provenance: `npm audit signatures`
23+
- Package lockfile (`package-lock.json`) is committed and used in CI (`npm ci`)
24+
25+
## Dependencies
26+
27+
This package has minimal runtime dependencies:
28+
- `commander` — CLI framework
29+
- `fast-xml-parser` — XML parsing (no native dependencies)
30+
- `yaml` — YAML parsing
31+
32+
All dependencies are regularly audited via `npm audit` and Dependabot.

‎docs/VERSIONING.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# Versioning Strategy
2+
3+
This package follows [Semantic Versioning](https://semver.org/).
4+
5+
## When to bump
6+
7+
### Major (breaking)
8+
- Shape **removed** from the library
9+
- Shape `blockId` **renamed** (breaks existing diagram matching)
10+
- Shape **layer reassignment** (changes categorization)
11+
- CLI command removed or behavior changed incompatibly
12+
13+
### Minor (feature)
14+
- **New shapes** added to the library
15+
- New CLI commands or options
16+
- New YAML schema fields (backward-compatible)
17+
- New layer added
18+
19+
### Patch (fix)
20+
- **Style updates** (color, stroke, font changes) — handled by upgrade command
21+
- Bug fixes in parser, matcher, differ, or upgrader
22+
- Documentation updates
23+
- Dependency updates
24+
25+
## Deprecation process
26+
27+
1. Shape marked `deprecated: true` in YAML with `deprecatedSince` version
28+
2. CLI `check` command warns on deprecated shapes
29+
3. Shape remains functional for **2 minor versions**
30+
4. Shape removed in next major version
31+
5. If replaced: `replacedBy` field points to new blockId, upgrade command handles migration
32+
33+
## Commit conventions
34+
35+
Use [Conventional Commits](https://www.conventionalcommits.org/):
36+
- `feat:` → minor bump
37+
- `fix:` → patch bump
38+
- `feat!:` or `BREAKING CHANGE:` → major bump
39+
- `chore:`, `docs:`, `test:`, `refactor:` → no version bump
40+
41+
## Changelog
42+
43+
Generated from conventional commits using the release workflow.
44+
Each GitHub Release includes auto-generated release notes.
45+
46+
## Version files
47+
48+
When bumping version, update both:
49+
1. `package.json` → `version` field
50+
2. `src/library/versions.ts` → add new `VersionEntry`

0 commit comments

Comments
 (0)