Skip to content

Commit 67b0de8

Browse files
gitops-mergemnrendra
gitops-merge
and
mnrendra
authored
chore: update skeleton (#133)
issues: * chore: update skeleton (#132) commits: * chore: update skeleton (f21ce7b) * chore: fix reusable workflow paths (b0e6d15) * chore: fix secrets workflows (08a414a) * chore: add id-token in release workflows (1b401ae) --------- Co-authored-by: Muhammad Rendra <[email protected]>
1 parent ff32029 commit 67b0de8

19 files changed

+545
-227
lines changed

‎.github/dependabot.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
version: 2
2+
3+
updates:
4+
# github-actions
5+
- package-ecosystem: github-actions
6+
directory: /
7+
schedule:
8+
interval: weekly
9+
commit-message:
10+
prefix: chore(actions)
11+
# npm
12+
- package-ecosystem: npm
13+
directory: /
14+
schedule:
15+
interval: weekly
16+
commit-message:
17+
prefix: chore(npm)

‎.github/workflows/audit.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Audit
2+
3+
on:
4+
branch_protection_rule:
5+
schedule:
6+
- cron: '0 17 * * 5' # Every Friday at 17:00 UTC (Saturday 00:00 Jakarta time)
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
# CodeQL
13+
codeql:
14+
name: CodeQL
15+
permissions:
16+
# read
17+
actions: read
18+
contents: read
19+
packages: read
20+
# write
21+
security-events: write
22+
uses: ./.github/workflows/reusable.codeql.yml
23+
# Scorecard
24+
scorecard:
25+
name: Scorecard
26+
permissions:
27+
# read
28+
actions: read
29+
checks: read
30+
contents: read
31+
issues: read
32+
pull-requests: read
33+
# write
34+
id-token: write
35+
security-events: write
36+
uses: ./.github/workflows/reusable.scorecard.yml

‎.github/workflows/checkpoint.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Checkpoint
2+
3+
on:
4+
pull_request:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
# Review
11+
review:
12+
name: Review
13+
uses: ./.github/workflows/reusable.review.yml
14+
# CodeQL
15+
codeql:
16+
name: CodeQL
17+
permissions:
18+
# read
19+
actions: read
20+
contents: read
21+
packages: read
22+
# write
23+
security-events: write
24+
uses: ./.github/workflows/reusable.codeql.yml
25+
# Scorecard
26+
scorecard:
27+
name: Scorecard
28+
permissions:
29+
# read
30+
actions: read
31+
checks: read
32+
contents: read
33+
issues: read
34+
pull-requests: read
35+
# write
36+
id-token: write
37+
security-events: write
38+
uses: ./.github/workflows/reusable.scorecard.yml
39+
# Test
40+
test:
41+
name: Test
42+
uses: ./.github/workflows/reusable.test.yml
43+
secrets:
44+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 145 deletions
Original file line numberDiff line numberDiff line change
@@ -19,49 +19,17 @@ jobs:
1919
# CodeQL
2020
codeql:
2121
name: CodeQL
22-
runs-on: ubuntu-latest
2322
permissions:
2423
# read
2524
actions: read
2625
contents: read
26+
packages: read
2727
# write
2828
security-events: write
29-
steps:
30-
# Harden Runner
31-
- name: Harden Runner # Audit all outbound calls
32-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
33-
with:
34-
egress-policy: audit
35-
# Checkout
36-
- name: Checkout
37-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
38-
with:
39-
persist-credentials: false
40-
# Initialize CodeQL
41-
- name: Initialize CodeQL
42-
uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
43-
with:
44-
languages: javascript
45-
# Setup Node
46-
- name: Setup Node
47-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
48-
with:
49-
node-version: "lts/*"
50-
# Install Dependencies
51-
- name: Install Dependencies
52-
run: npm ci
53-
# Build Source Code
54-
- name: Build Source Code
55-
run: npm run build
56-
# Analyze CodeQL
57-
- name: Analyze CodeQL
58-
uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
59-
with:
60-
category: /language:javascript
29+
uses: ./.github/workflows/reusable.codeql.yml
6130
# Scorecard
6231
scorecard:
6332
name: Scorecard
64-
runs-on: ubuntu-latest
6533
permissions:
6634
# read
6735
actions: read
@@ -72,125 +40,26 @@ jobs:
7240
# write
7341
id-token: write
7442
security-events: write
75-
steps:
76-
# Harden Runner
77-
- name: Harden Runner # Audit all outbound calls
78-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
79-
with:
80-
egress-policy: audit
81-
# Checkout
82-
- name: Checkout
83-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
84-
with:
85-
persist-credentials: false
86-
# Analyze OSSF Scorecard
87-
- name: Analyze OSSF Scorecard
88-
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
89-
with:
90-
results_file: ossf_scorecard.sarif
91-
results_format: sarif
92-
publish_results: true
93-
repo_token: ${{ secrets.TOKEN }}
94-
# Upload to GitHub Actions Artifact
95-
- name: Upload to GitHub Actions Artifact
96-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
97-
with:
98-
name: OSSF Scorecard
99-
path: ossf_scorecard.sarif
100-
overwrite: true
101-
# Upload to GitHub Code Scanning
102-
- name: Upload to GitHub Code Scanning
103-
uses: github/codeql-action/upload-sarif@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
104-
with:
105-
sarif_file: ossf_scorecard.sarif
43+
uses: ./.github/workflows/reusable.scorecard.yml
10644
# Test
10745
test:
10846
name: Test
109-
runs-on: ubuntu-latest
110-
steps:
111-
# Harden Runner
112-
- name: Harden Runner # Audit all outbound calls
113-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
114-
with:
115-
egress-policy: audit
116-
# Checkout
117-
- name: Checkout
118-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
119-
with:
120-
fetch-depth: 2 # At least fetch the last two commits for comparison
121-
persist-credentials: false
122-
# Setup Node
123-
- name: Setup Node
124-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
125-
with:
126-
node-version: "lts/*"
127-
# Install Dependencies
128-
- name: Install Dependencies
129-
run: npm ci
130-
# Build Source Code
131-
- name: Build Source Code
132-
run: npm run build
133-
# Run Test and Generate Coverage
134-
- name: Run Test and Generate Coverage
135-
run: npm test
136-
# Upload Coverage Reports to Codecov
137-
- name: Upload Coverage Reports to Codecov
138-
uses: codecov/codecov-action@ad3126e916f78f00edff4ed0317cf185271ccc2d # v5.4.2
139-
with:
140-
token: ${{ secrets.CODECOV_TOKEN }}
47+
uses: ./.github/workflows/reusable.test.yml
48+
secrets:
49+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
14150
# Release
14251
release:
14352
name: Release
14453
needs: [codeql, scorecard, test]
145-
runs-on: ubuntu-latest
14654
permissions:
14755
# write
14856
contents: write
57+
id-token: write
14958
issues: write
150-
steps:
151-
# Harden Runner
152-
- name: Harden Runner # Audit all outbound calls
153-
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
154-
with:
155-
egress-policy: audit
156-
# Checkout
157-
- name: Checkout
158-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
159-
with:
160-
fetch-depth: 0 # All commits need to be analyzed
161-
token: ${{ secrets.TOKEN }}
162-
# Import GPG
163-
- name: Import GPG
164-
uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
165-
with:
166-
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
167-
passphrase: ${{ secrets.PASSPHRASE }}
168-
git_user_signingkey: true
169-
git_commit_gpgsign: true
170-
# Setup Node
171-
- name: Setup Node
172-
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
173-
with:
174-
node-version: "lts/*"
175-
# Install Dependencies
176-
- name: Install Dependencies
177-
run: npm ci
178-
# Build Source Code
179-
- name: Build Source Code
180-
run: npm run build
181-
# Release and Publish to NPM
182-
- name: Release and Publish to NPM
183-
env:
184-
GIT_AUTHOR_NAME: ${{ vars.GIT_AUTHOR_NAME }}
185-
GIT_AUTHOR_EMAIL: ${{ vars.GIT_AUTHOR_EMAIL }}
186-
GIT_COMMITTER_NAME: ${{ vars.GIT_COMMITTER_NAME }}
187-
GIT_COMMITTER_EMAIL: ${{ vars.GIT_COMMITTER_EMAIL }}
188-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
189-
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
190-
run: npx semantic-release
191-
# Rebase Development Branch
192-
- name: Rebase Development Branch
193-
run: |
194-
git checkout dev
195-
git pull --rebase origin main
196-
git push --force origin dev
59+
pull-requests: write
60+
uses: ./.github/workflows/reusable.release.yml
61+
secrets:
62+
GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
63+
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
64+
PASSPHRASE: ${{ secrets.PASSPHRASE }}
65+
TOKEN: ${{ secrets.TOKEN }}

‎.github/workflows/reusable.codeql.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: CodeQL
2+
3+
on:
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
# CodeQL
11+
codeql:
12+
name: CodeQL
13+
runs-on: ubuntu-latest
14+
permissions:
15+
# read
16+
actions: read
17+
contents: read
18+
packages: read
19+
# write
20+
security-events: write
21+
steps:
22+
# Harden Runner
23+
- name: Harden Runner # Audit all outbound calls
24+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
25+
with:
26+
egress-policy: audit
27+
# Checkout
28+
- name: Checkout
29+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
30+
with:
31+
persist-credentials: false
32+
# Initialize CodeQL
33+
- name: Initialize CodeQL
34+
uses: github/codeql-action/init@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
35+
with:
36+
languages: javascript
37+
# Setup Node
38+
- name: Setup Node
39+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
40+
with:
41+
node-version: lts/*
42+
# Clean Install
43+
- name: Clean Install
44+
run: npm ci
45+
# Build Source Code
46+
- name: Build Source Code
47+
run: npm run build
48+
# Analyze CodeQL
49+
- name: Analyze CodeQL
50+
uses: github/codeql-action/analyze@28deaeda66b76a05916b6923827895f2b14ab387 # v3.28.16
51+
with:
52+
category: /language:javascript

0 commit comments

Comments
 (0)