Javascript Wrapper Release #102
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Javascript Wrapper Release | |
| on: | |
| workflow_call: | |
| inputs: | |
| cliTag: | |
| description: 'CLI tag name' | |
| required: false | |
| type: string | |
| default: 2.0.0-nightly | |
| jsTag: | |
| description: 'JS Wrapper tag name' | |
| required: false | |
| type: string | |
| default: nightly | |
| dev: | |
| description: 'Is dev build' | |
| required: false | |
| default: true | |
| type: boolean | |
| bumpVersion: | |
| description: 'Bump npm version, create and merge version PR' | |
| required: false | |
| default: true | |
| type: boolean | |
| workflow_dispatch: | |
| inputs: | |
| cliTag: | |
| description: 'CLI tag name (ignored if not dev build)' | |
| required: false | |
| jsTag: | |
| description: 'Tag name (ignored if not dev build)' | |
| required: false | |
| type: string | |
| default: rc | |
| dev: | |
| description: 'Is dev build' | |
| required: false | |
| default: true | |
| type: boolean | |
| bumpVersion: | |
| description: 'Bump npm version, create and merge version PR' | |
| required: false | |
| default: true | |
| type: boolean | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| jobs: | |
| delete: | |
| permissions: | |
| contents: write # for gh release delete and tag cleanup | |
| packages: write # for deleting npm package versions | |
| uses: Checkmarx/ast-cli-javascript-wrapper-runtime-cli/.github/workflows/delete-packages-and-releases.yml@main # zizmor: ignore[unpinned-uses] | |
| with: | |
| tag: ${{ inputs.jsTag }} | |
| secrets: inherit # zizmor: ignore[secrets-inherit] | |
| if: inputs.dev == true | |
| release: | |
| name: Release | |
| permissions: | |
| id-token: write # allows this job to request a GitHub OIDC token | |
| contents: write # for git tag push and creating the GitHub release | |
| packages: write # for publishing the npm package to GitHub Packages | |
| runs-on: cx-public-ubuntu-x64 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BRANCH_NAME: npm-version-patch | |
| outputs: | |
| TAG_NAME: ${{ steps.generate_tag_name.outputs.TAG_NAME }} | |
| CLI_VERSION: ${{ steps.extract_cli_version.outputs.CLI_VERSION }} | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Verify single lockfile (Step 0 - Supply Chain Policy) | |
| run: | | |
| if [ -f yarn.lock ] && [ -f package-lock.json ]; then | |
| echo "❌ ERROR: Both yarn.lock and package-lock.json found. Policy requires exactly ONE package manager. Allowed: npm + package-lock.json OR Yarn + yarn.lock" | |
| exit 1 | |
| fi | |
| if [ ! -f yarn.lock ] && [ ! -f package-lock.json ]; then | |
| echo "❌ ERROR: No lockfile found. Policy requires exactly ONE package manager lockfile. Required: npm + package-lock.json OR Yarn + yarn.lock" | |
| exit 1 | |
| fi | |
| - name: Git Configuration | |
| run: | | |
| git config user.name github-actions | |
| git config user.email github-actions@github.com | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22.11.0 | |
| registry-url: https://npm.echohq.com/ | |
| - name: Configure GitHub Packages auth | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: npm config set //npm.pkg.github.com/:_authToken "${GH_TOKEN}" | |
| - name: Generate Tag name | |
| id: generate_tag_name | |
| env: | |
| INPUT_DEV: ${{ inputs.dev }} | |
| INPUT_JS_TAG: ${{ inputs.jsTag }} | |
| INPUT_BUMP_VERSION: ${{ inputs.bumpVersion }} | |
| run: | | |
| if [ "$INPUT_DEV" == "true" ]; then | |
| TAG_NAME=$(npm version prerelease --preid="$INPUT_JS_TAG" --no-git-tag-version --allow-same-version) | |
| elif [ "$INPUT_BUMP_VERSION" == "true" ]; then | |
| TAG_NAME=$(npm version patch --no-git-tag-version) | |
| else | |
| TAG_NAME=v$(node -p "require('./package.json').version") | |
| fi | |
| echo "Generated TAG_NAME: $TAG_NAME" | |
| echo "TAG_NAME=$TAG_NAME" >> $GITHUB_ENV | |
| echo "TAG_NAME=$TAG_NAME" >> $GITHUB_OUTPUT | |
| - name: Extract CLI version | |
| id: extract_cli_version | |
| run: | | |
| CLI_VERSION=$(cat checkmarx-ast-cli.version | grep -Eo '^[0-9]+\.[0-9]+\.[0-9]+') | |
| echo "CLI version being packed is $CLI_VERSION" | |
| echo "CLI_VERSION=$CLI_VERSION" >> $GITHUB_ENV | |
| echo "CLI_VERSION=$CLI_VERSION" >> $GITHUB_OUTPUT | |
| - name: Check if CLI version is latest | |
| id: check_latest_cli_version | |
| env: | |
| INPUT_DEV: ${{ inputs.dev }} | |
| INPUT_CLI_TAG: ${{ inputs.cliTag }} | |
| GIT_REF: ${{ github.ref }} | |
| run: | | |
| if [ "$INPUT_DEV" == "false" ] || [ -n "$INPUT_CLI_TAG" ] || [ "$GIT_REF" != "refs/heads/main" ]; then | |
| exit 0 | |
| fi | |
| LATEST_CLI_VERSION=$(curl -s https://api.github.com/repos/Checkmarx/ast-cli/releases/latest | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/') | |
| if [ "$CLI_VERSION" = "$LATEST_CLI_VERSION" ]; then | |
| echo "Confirm that the CLI version in the repository is up-to-date with the most recent release: $CLI_VERSION" | |
| else | |
| echo "The current repository contains a CLI version that differs from the latest released version: Expected $LATEST_CLI_VERSION, got $CLI_VERSION" | |
| exit 1 | |
| fi | |
| - name: NPM ci and build | |
| env: | |
| ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }} | |
| run: | | |
| npm ci --ignore-scripts | |
| npm run build | |
| - name: Create Pull Request | |
| id: create_pr | |
| if: inputs.dev == false && inputs.bumpVersion == true | |
| uses: step-security/create-pull-request@50c103da2b9ca12cd5bc013fc6931051a5aa872b # v8.1.1 | |
| with: | |
| token: ${{ env.GITHUB_TOKEN }} | |
| branch: ${{ env.BRANCH_NAME }} | |
| title: "Update Version - Automated Changes" | |
| body: "This is an automated PR created by GitHub Actions" | |
| base: main | |
| draft: false | |
| - name: Wait for PR to be created | |
| id: pr | |
| if: inputs.dev == false && inputs.bumpVersion == true | |
| uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0 | |
| with: | |
| route: GET /repos/${{ github.repository }}/pulls?head=${{ github.repository_owner }}:${{ env.BRANCH_NAME }} | |
| - name: Merge Pull Request | |
| if: inputs.dev == false && inputs.bumpVersion == true | |
| uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0 | |
| with: | |
| route: PUT /repos/${{ github.repository }}/pulls/${{ steps.create_pr.outputs.pull-request-number }}/merge | |
| merge_method: squash | |
| - name: Push tag | |
| if: inputs.dev == false | |
| run: | | |
| git pull | |
| git tag "$TAG_NAME" | |
| git push --tags | |
| - name: Publish npm package | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| INPUT_DEV: ${{ inputs.dev }} | |
| INPUT_JS_TAG: ${{ inputs.jsTag }} | |
| run: | | |
| if [ "$INPUT_DEV" == "true" ]; then | |
| npm publish --tag="$INPUT_JS_TAG" | |
| else | |
| npm publish --access public | |
| fi | |
| - name: Create Release | |
| uses: step-security/action-gh-release@277bfa82abcfdb73e5bbb19e213fd76532ee2be5 # v3.0.0 | |
| with: | |
| name: ${{env.TAG_NAME}} | |
| tag_name: ${{env.TAG_NAME}} | |
| generate_release_notes: true | |
| prerelease: ${{ inputs.dev }} | |
| # notify: | |
| # if: inputs.dev == false | |
| # needs: release | |
| # uses: Checkmarx/plugins-release-workflow/.github/workflows/release-notify.yml@main | |
| # with: | |
| # product_name: Javascript Runtime Wrapper | |
| # release_version: ${{ needs.release.outputs.TAG_NAME }} | |
| # cli_release_version: ${{ needs.release.outputs.CLI_VERSION }} | |
| # release_author: "Sypher Team" | |
| # release_url: https://github.com/Checkmarx/ast-cli-javascript-wrapper-runtime-cli/releases/tag/${{ needs.release.outputs.TAG_NAME }} | |
| # jira_product_name: JS_RUNTIME_WRAPPER | |
| # secrets: inherit | |
| # dispatch_auto_release: | |
| # name: Update ADO Extension With new Wrapper Version | |
| # if: inputs.dev == false | |
| # needs: notify | |
| # uses: Checkmarx/plugins-release-workflow/.github/workflows/dispatch-workflow.yml@main | |
| # with: | |
| # cli_version: ${{ needs.release.outputs.CLI_VERSION }} | |
| # is_cli_release: false | |
| # is_js_runtime_release: true | |
| # secrets: inherit |