Skip to content

Commit f8a42a7

Browse files
amanstepamanstep
authored
Merge pull request #2 from step-security/release
feat: Initial release
2 parents ec33388 + e8c2612 commit f8a42a7

27 files changed

+29337
-1
lines changed

‎.eslintignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
dist/
2+
lib/
3+
node_modules/

‎.eslintrc.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"plugins": ["jest", "@typescript-eslint"],
3+
"extends": ["plugin:github/recommended"],
4+
"parser": "@typescript-eslint/parser",
5+
"parserOptions": {
6+
"ecmaVersion": 9,
7+
"sourceType": "module",
8+
"project": "./tsconfig.json"
9+
},
10+
"rules": {
11+
"i18n-text/no-en": "off",
12+
"eslint-comments/no-use": "off",
13+
"import/no-namespace": "off",
14+
"no-unused-vars": "off",
15+
"@typescript-eslint/no-unused-vars": "error",
16+
"@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
17+
"@typescript-eslint/no-require-imports": "error",
18+
"@typescript-eslint/array-type": "error",
19+
"@typescript-eslint/await-thenable": "error",
20+
"@typescript-eslint/ban-ts-comment": "error",
21+
"camelcase": "off",
22+
"@typescript-eslint/consistent-type-assertions": "error",
23+
"@typescript-eslint/explicit-function-return-type": ["error", {"allowExpressions": true}],
24+
"@typescript-eslint/func-call-spacing": ["error", "never"],
25+
"@typescript-eslint/no-array-constructor": "error",
26+
"@typescript-eslint/no-empty-interface": "error",
27+
"@typescript-eslint/no-explicit-any": "error",
28+
"@typescript-eslint/no-extraneous-class": "error",
29+
"@typescript-eslint/no-for-in-array": "error",
30+
"@typescript-eslint/no-inferrable-types": "error",
31+
"@typescript-eslint/no-misused-new": "error",
32+
"@typescript-eslint/no-namespace": "error",
33+
"@typescript-eslint/no-non-null-assertion": "warn",
34+
"@typescript-eslint/no-unnecessary-qualifier": "error",
35+
"@typescript-eslint/no-unnecessary-type-assertion": "error",
36+
"@typescript-eslint/no-useless-constructor": "error",
37+
"@typescript-eslint/no-var-requires": "error",
38+
"@typescript-eslint/prefer-for-of": "warn",
39+
"@typescript-eslint/prefer-function-type": "warn",
40+
"@typescript-eslint/prefer-includes": "error",
41+
"@typescript-eslint/prefer-string-starts-ends-with": "error",
42+
"@typescript-eslint/promise-function-async": "error",
43+
"@typescript-eslint/require-array-sort-compare": "error",
44+
"@typescript-eslint/restrict-plus-operands": "error",
45+
"semi": "off",
46+
"@typescript-eslint/semi": ["error", "never"],
47+
"@typescript-eslint/type-annotation-spacing": "error",
48+
"@typescript-eslint/unbound-method": "error"
49+
},
50+
"env": {
51+
"node": true,
52+
"es6": true,
53+
"jest/globals": true
54+
}
55+
}

‎.github/workflows/actions_release.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Release GitHub Actions
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag:
7+
description: "Tag for the release"
8+
required: true
9+
script:
10+
description: "Specify the build script to run"
11+
required: true
12+
type: string
13+
default: "npm run all"
14+
15+
permissions:
16+
contents: read
17+
18+
jobs:
19+
release:
20+
permissions:
21+
actions: read
22+
id-token: write
23+
contents: write
24+
25+
uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@v1
26+
with:
27+
tag: "${{ github.event.inputs.tag }}"
28+
script: "${{ github.event.inputs.script }}"

‎.github/workflows/audit_package.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: NPM Audit Fix Run
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
force:
7+
description: "Use --force flag for npm audit fix?"
8+
required: true
9+
type: boolean
10+
base_branch:
11+
description: "Specify a base branch"
12+
required: false
13+
default: "main"
14+
script:
15+
description: "Specify the build script to run"
16+
required: false
17+
type: string
18+
default: "npm run all"
19+
schedule:
20+
- cron: "0 0 * * 1"
21+
22+
jobs:
23+
audit-fix:
24+
uses: step-security/reusable-workflows/.github/workflows/audit_fix.yml@v1
25+
with:
26+
force: ${{ inputs.force || false }}
27+
base_branch: ${{ inputs.base_branch || 'main' }}
28+
script: ${{ inputs.script || 'npm run all' }}
29+
30+
permissions:
31+
contents: write
32+
pull-requests: write
33+
packages: read
34+
issues: write

‎.github/workflows/auto_cherry_pick.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Auto Cherry-Pick from Upstream
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
base_branch:
7+
description: "Base branch to create the PR against"
8+
required: true
9+
default: "main"
10+
mode:
11+
description: "Run mode: cherry-pick or verify"
12+
required: false
13+
default: "cherry-pick"
14+
script:
15+
description: "Specify the build script to run"
16+
required: false
17+
type: string
18+
default: "npm run all"
19+
20+
pull_request:
21+
types: [opened, synchronize, labeled]
22+
23+
permissions:
24+
contents: write
25+
pull-requests: write
26+
packages: read
27+
issues: write
28+
29+
jobs:
30+
cherry-pick:
31+
if: github.event_name == 'workflow_dispatch' || contains(fromJson(toJson(github.event.pull_request.labels)).*.name, 'review-required')
32+
uses: step-security/reusable-workflows/.github/workflows/auto_cherry_pick.yaml@v1
33+
with:
34+
original-owner: "akhilerm"
35+
repo-name: "tag-push-action"
36+
base_branch: ${{ inputs.base_branch }}
37+
mode: ${{ github.event_name == 'pull_request' && 'verify' || inputs.mode }}
38+
script: ${{ inputs.script || 'npm run all' }}

‎.github/workflows/docker.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Publish docker image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
release_tag:
7+
description: 'Tag to release'
8+
required: true
9+
type: string
10+
11+
permissions:
12+
contents: read
13+
packages: write
14+
15+
jobs:
16+
build:
17+
runs-on: ubuntu-latest
18+
if: startsWith(github.event.inputs.release_tag, 'v')
19+
steps:
20+
- name: Harden the runner (Audit all outbound calls)
21+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
22+
with:
23+
egress-policy: audit
24+
25+
- name: Checkout
26+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
27+
- name: Validate tag format
28+
run: |
29+
TAG=${{ github.event.inputs.release_tag }}
30+
if ! echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
31+
echo "❌ Invalid tag format: $TAG"
32+
exit 1
33+
fi
34+
echo "✅ Valid semver tag: $TAG"
35+
- name: Log in to GitHub Container Registry
36+
uses: step-security/docker-login-action@c3e677aae8393bc9c81cfdf9709648720ea4bd4d # v3.6.0
37+
with:
38+
registry: ghcr.io
39+
username: ${{ github.actor }}
40+
password: ${{ secrets.GITHUB_TOKEN }}
41+
42+
- name: Set up QEMU for ARM builds
43+
uses: step-security/setup-qemu-action@8c4aef027ab2df56e08f597afe6dd8cd31cb84f5 # v3.7.0
44+
45+
- name: Set up Docker Buildx
46+
uses: step-security/setup-buildx-action@c60a792b446ef83310733d5cd9d0c8d6870d043f # v3.12.0
47+
48+
- name: Build and push Docker image
49+
uses: step-security/docker-build-push-action@a8c3d08b23f8be6aeed43eb1a14ce6fe51284438 # v6.18.0
50+
with:
51+
context: ./repo-copy
52+
push: true
53+
platforms: linux/amd64,linux/arm64
54+
tags: |
55+
ghcr.io/${{ github.repository }}/repo-copy:${{ github.event.inputs.release_tag }}

‎.github/workflows/guarddog.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Run GuardDog Scan on PRs
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
call-guarddog-scan:
14+
uses: step-security/reusable-workflows/.github/workflows/guarddog.yml@v1

‎.gitignore‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# Dependency directory
2+
node_modules
3+
4+
# Rest pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
5+
# Logs
6+
logs
7+
*.log
8+
npm-debug.log*
9+
yarn-debug.log*
10+
yarn-error.log*
11+
lerna-debug.log*
12+
13+
# Diagnostic reports (https://nodejs.org/api/report.html)
14+
report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
15+
16+
# Runtime data
17+
pids
18+
*.pid
19+
*.seed
20+
*.pid.lock
21+
22+
# Directory for instrumented libs generated by jscoverage/JSCover
23+
lib-cov
24+
25+
# Coverage directory used by tools like istanbul
26+
coverage
27+
*.lcov
28+
29+
# nyc test coverage
30+
.nyc_output
31+
32+
# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
33+
.grunt
34+
35+
# Bower dependency directory (https://bower.io/)
36+
bower_components
37+
38+
# node-waf configuration
39+
.lock-wscript
40+
41+
# Compiled binary addons (https://nodejs.org/api/addons.html)
42+
build/Release
43+
44+
# Dependency directories
45+
jspm_packages/
46+
47+
# TypeScript v1 declaration files
48+
typings/
49+
50+
# TypeScript cache
51+
*.tsbuildinfo
52+
53+
# Optional npm cache directory
54+
.npm
55+
56+
# Optional eslint cache
57+
.eslintcache
58+
59+
# Optional REPL history
60+
.node_repl_history
61+
62+
# Output of 'npm pack'
63+
*.tgz
64+
65+
# Yarn Integrity file
66+
.yarn-integrity
67+
68+
# dotenv environment variables file
69+
.env
70+
.env.test
71+
72+
# parcel-bundler cache (https://parceljs.org/)
73+
.cache
74+
75+
# next.js build output
76+
.next
77+
78+
# nuxt.js build output
79+
.nuxt
80+
81+
# vuepress build output
82+
.vuepress/dist
83+
84+
# Serverless directories
85+
.serverless/
86+
87+
# FuseBox cache
88+
.fusebox/
89+
90+
# DynamoDB Local files
91+
.dynamodb/
92+
93+
# OS metadata
94+
.DS_Store
95+
Thumbs.db
96+
97+
# Ignore built ts files
98+
__tests__/runner/*
99+
lib/**/*

‎.prettierignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
dist/
2+
lib/
3+
node_modules/

‎.prettierrc.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"printWidth": 80,
3+
"tabWidth": 2,
4+
"useTabs": false,
5+
"semi": false,
6+
"singleQuote": true,
7+
"trailingComma": "none",
8+
"bracketSpacing": false,
9+
"arrowParens": "avoid"
10+
}

0 commit comments

Comments
 (0)