GLSP-1594: Switch to trusted publishing

- Setup trusted publishing for client
- Remove client CI checks/publishs from Jenkins pipeline
- Add new CI workflow for Client CI
- Align prettier/eslint configs
- Update to lerna 9.x
Part of eclipse-glsp/glsp/issues/1594

Author: tortmayr

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI (Client)
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+on:
+  workflow_dispatch:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+jobs:
+  build:
+    name: Build
+    timeout-minutes: 60
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: 20.x
+      - name: Build
+        working-directory: ./client
+        run: yarn install
+      - name: Check for uncommitted changes in yarn.lock
+        run: |
+          if git diff --name-only | grep -q "^client/yarn.lock"; then
+            echo "::error::The yarn.lock file has uncommitted changes!"
+            exit 1
+          fi
+  lint:
+    name: Lint
+    timeout-minutes: 60
+    runs-on: ubuntu-22.04
+    working-directory: ./client
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: 20.x
+      - name: Install
+        run: |
+          yarn install
+      - name: Create eslint json report
+        run: |
+          yarn lint:ci
+      - name: Create summary
+        if: always()
+        run: |
+          npm_config_yes=true npx github:10up/eslint-json-to-md#82ff16b --path ./eslint_report.json --output ./eslint_report.md
+          cat eslint_report.md >> $GITHUB_STEP_SUMMARY
+ 

.github/workflows/codeql-analysis.yml

@@ -14,11 +14,6 @@ defaults:
   run:
     working-directory: ./client
 on:
-  push:
-    branches: [master]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [master]
   schedule:
     - cron: "19 3 * * 5"
 

.github/workflows/publish.yml

@@ -0,0 +1,92 @@
+name: 'Publish to NPM'
+
+on:
+  workflow_run:
+    workflows: ['CI']
+    types:
+      - completed
+    branches: [master]
+  workflow_call:
+    inputs:
+      ref:
+        description: 'Git ref (branch, tag, or commit SHA) to checkout and publish'
+        required: true
+        type: string
+      dist-tag:
+        description: 'NPM dist-tag to use for publishing'
+        required: false
+        type: string
+        default: 'next'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Git ref (branch, tag, or commit SHA) to checkout and publish'
+        required: true
+        type: string
+      dist-tag:
+        description: 'NPM dist-tag to use for publishing'
+        required: false
+        type: choice
+        options:
+          - next
+          - latest
+        default: 'next'
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    name: Build & Publish
+    runs-on: ubuntu-22.04
+    if: github.repository == 'eclipse-glsp/glsp-eclipse-integration' && (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || (github.event.workflow_run.conclusion == 'success'))
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ inputs.ref || github.event.inputs.ref || github.event.workflow_run.head_commit.id || github.sha }}
+          # Fetch all history for lerna to determine versions
+          fetch-depth: 0
+
+      - name: Check for changes in "client/packages" directory
+        id: check_changes
+        run: |
+          DIST_TAG="${{ inputs.dist-tag || github.event.inputs.dist-tag || 'next' }}"
+          # For 'next' dist-tag: check for changes when triggered by workflow_run or workflow_call
+          # For 'latest' dist-tag or workflow_dispatch: always publish
+          if [[ "$DIST_TAG" == "next" ]] && [[ "${{ github.event_name }}" != "workflow_dispatch" ]]; then
+            if git diff --name-only HEAD^ HEAD | grep -qE '^client/packages'; then
+              echo "should_publish=true" >> $GITHUB_OUTPUT
+            else
+              echo "should_publish=false" >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "should_publish=true" >> $GITHUB_OUTPUT
+          fi
+
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        if: steps.check_changes.outputs.should_publish == 'true'
+        with:
+          node-version: 20.x
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Build
+        working-directory: ./client
+        if: steps.check_changes.outputs.should_publish == 'true'
+        run: yarn
+
+      - name: Publish to NPM
+        if: steps.check_changes.outputs.should_publish == 'true'
+        working-directory: ./client
+        run: |
+          DIST_TAG="${{ inputs.dist-tag || github.event.inputs.dist-tag || 'next' }}"
+          if [[ "$DIST_TAG" == "next" ]]; then
+             yarn publish:next
+          elif [[ "$DIST_TAG" == "latest" ]]; then
+             yarn publish:latest
+          else
+            echo "Unknown dist-tag: $DIST_TAG"
+            exit 1
+          fi
+        env:
+          NPM_CONFIG_PROVENANCE: 'true'

Jenkinsfile

@@ -126,10 +126,6 @@ pipeline {
                         dir('server') {
                             sh 'mvn checkstyle:check -B'
                         }
-                        // Execute eslint checks 
-                        dir('client') {
-                            sh 'yarn lint:ci'
-                        }
                     }
                 }
             }
@@ -142,12 +138,7 @@ pipeline {
                     qualityGates: [[threshold: 1, type: 'TOTAL', unstable: true]]
 
                     // Record maven,java warnings
-                    recordIssues enabledForFailure: true, skipPublishingChecks:true, tools: [mavenConsole(), java()]    
-                
-                    // Record & publish esLint issues
-                    recordIssues enabledForFailure: true, publishAllIssues: true, aggregatingResults: true, 
-                    tools: [esLint(pattern: 'client/eslint.xml')], 
-                    qualityGates: [[threshold: 1, type: 'TOTAL', unstable: true]] 
+                    recordIssues enabledForFailure: true, skipPublishingChecks:true, tools: [mavenConsole(), java()]     
                 }
             }
         }
@@ -159,27 +150,11 @@ pipeline {
                     expression {  
                       /* Only trigger the deployment job if the changeset contains changes in 
                       the `server` or `client/packages/` directory */
-                      sh(returnStatus: true, script: 'git diff --name-only HEAD^ | grep -q "^server\\|client/packages/"') == 0
+                      sh(returnStatus: true, script: 'git diff --name-only HEAD^ | grep -q "^server"') == 0
                     }
                 }
             }
             stages {
-                stage('Deploy client (NPM)') {
-                    steps { 
-                        container('ci') {
-                            timeout(30) {
-                                dir('client') {
-                                    withCredentials([string(credentialsId: 'npmjs-token', variable: 'NPM_AUTH_TOKEN')]) {
-                                                sh 'printf "//registry.npmjs.org/:_authToken=${NPM_AUTH_TOKEN}\n" >> $WORKSPACE/client/.npmrc'
-                                    }
-                                    sh 'git config  user.email "[email protected]"'
-                                    sh 'git config  user.name "eclipse-glsp-bot"'
-                                    sh 'yarn publish:next'  
-                                }
-                            }
-                        }
-                    }
-                }
                 stage('Deploy server (P2)') {
                     steps {
                         build job: 'deploy-ide-p2-nightly', wait: false

client/.eslintignore

@@ -0,0 +1,13 @@
+# Compiled output
+**/dist/
+**/lib/
+**/node_modules/
+
+# Build files
+**/.eslintrc.js
+**/esbuild.js
+
+# Other generated files
+**/*.map
+
+**/scripts/

client/.eslintrc.js

@@ -2,7 +2,6 @@
 module.exports = {
     root: true,
     extends: '@eclipse-glsp',
-    ignorePatterns: ['**/{node_modules,lib}', '**/.eslintrc.js'],
 
     parserOptions: {
         tsconfigRootDir: __dirname,

client/.prettierignore

@@ -0,0 +1,17 @@
+# Dependencies
+node_modules/
+
+# Build outputs
+lib/
+dist/
+
+# Generated files
+*.min.js
+*.min.css
+
+# Lock files
+package-lock.json
+yarn.lock
+examples/workflow-webapp/app
+# Logs
+*.log

client/package.json

@@ -11,26 +11,28 @@
     "app": "yarn --cwd examples/workflow-webapp",
     "build": "yarn compile && yarn app bundle",
     "check:headers": "glsp checkHeaders ../../glsp-eclipse-integration -t lastCommit -f ts tsx java -e \"**/src-gen/**\"",
-    "check:pr": "yarn all && yarn check:headers",
+    "check:pr": "yarn all && yarn format:check && yarn check:headers",
     "clean": "lerna run clean",
     "compile": "tsc -b",
     "copy:client": "copyfiles -f ./examples/workflow-webapp/app/* ../server/example/org.eclipse.glsp.ide.workflow.editor/diagram",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
     "generate:index": "lerna run generate:index && yarn lint:fix",
     "lint": "eslint --ext .ts,.tsx .",
-    "lint:ci": "yarn lint -o eslint.xml -f checkstyle",
+    "lint:ci": "yarn lint --output-file eslint_report.json --format json",
     "lint:fix": " yarn lint --fix",
     "prepare": "yarn build && yarn copy:client",
-    "publish:latest": "lerna publish from-git --no-git-reset --no-git-tag-version --no-verify-access --no-push",
+    "publish:latest": "lerna publish from-package --no-git-reset -y",
     "publish:next": "lerna publish preminor --exact --canary --preid next --dist-tag next --no-git-reset --no-git-tag-version --no-push --ignore-scripts --yes",
-    "publish:prepare": "lerna version --ignore-scripts --yes --no-push",
     "upgrade:next": "glsp updateNext",
     "watch": "concurrently --kill-others -n tsc,webapp -c red,yellow \"tsc -b -w --preserveWatchOutput\" \"yarn -s app watch\""
   },
   "devDependencies": {
     "@eclipse-glsp/dev": "next",
     "@types/node": "20.x",
     "copyfiles": "^2.4.1",
-    "lerna": "^7.0.0",
+    "lerna": "^9.0.0",
+    "mocha-ctrf-json-reporter": "^0.0.9",
     "typescript": "^5.9.2"
   },
   "engines": {

client/tsconfig.eslint.json

@@ -3,6 +3,5 @@
   "compilerOptions": {
     "noEmit": true
   },
-  "exclude": ["**/node_modules", "**/.eslintrc.js"],
   "include": ["packages/*/src", "examples/*/src"]
 }