Skip to content

Commit 13c7244

Browse files
muhammedaksammuhammedaksam
committed
feat: Establish CI/CD workflows, security policies, and enhance documentation and configuration management.
1 parent 179f22a commit 13c7244

18 files changed

Lines changed: 1175 additions & 602 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Dependabot reviewers (migrated from .github/dependabot.yml)
2+
3+
# npm dependencies (root directory)
4+
5+
/package.json @muhammedaksam
6+
/package-lock.json @muhammedaksam
7+
/npm-shrinkwrap.json @muhammedaksam
8+
/yarn.lock @muhammedaksam
9+
/bun.lock @muhammedaksam
10+
/pnpm-lock.yaml @muhammedaksam
11+
12+
# GitHub Actions workflows
13+
14+
/.github/workflows/*.yml @muhammedaksam
15+
/.github/workflows/*.yaml @muhammedaksam
16+
/action.yml @muhammedaksam
17+
/action.yaml @muhammedaksam
18+
19+
# Default owner for all other files
20+
21+
* @muhammedaksam

‎.github/actions/setup/action.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: "Setup Environment"
2+
description: "Setup Bun and install dependencies"
3+
4+
inputs:
5+
frozen-lockfile:
6+
description: "Use --frozen-lockfile for install"
7+
required: false
8+
default: "false"
9+
10+
runs:
11+
using: "composite"
12+
steps:
13+
- name: Setup Bun
14+
uses: oven-sh/setup-bun@v2
15+
with:
16+
bun-version: latest
17+
18+
- name: Install dependencies
19+
shell: bash
20+
run: |
21+
if [ "${{ inputs.frozen-lockfile }}" = "true" ]; then
22+
bun install --frozen-lockfile
23+
else
24+
bun install
25+
fi

‎.github/dependabot.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for npm
4+
- package-ecosystem: "npm"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
open-pull-requests-limit: 10
11+
assignees:
12+
- "muhammedaksam"
13+
commit-message:
14+
prefix: "chore"
15+
include: "scope"
16+
target-branch: "develop"
17+
18+
# Enable version updates for GitHub Actions
19+
- package-ecosystem: "github-actions"
20+
directory: "/"
21+
schedule:
22+
interval: "weekly"
23+
day: "monday"
24+
time: "09:00"
25+
open-pull-requests-limit: 5
26+
assignees:
27+
- "muhammedaksam"
28+
commit-message:
29+
prefix: "ci"
30+
include: "scope"
31+
target-branch: "develop"

‎.github/workflows/build.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Build Check
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main, develop]
8+
9+
jobs:
10+
build:
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout repository
15+
uses: actions/checkout@v6
16+
17+
- name: Setup environment
18+
uses: ./.github/actions/setup
19+
20+
- name: Type check
21+
run: bun run typecheck
22+
23+
- name: Build package
24+
run: bun run build
25+
26+
- name: Verify build artifacts
27+
run: |
28+
echo "Checking build artifacts..."
29+
test -d dist || (echo "❌ dist directory not found" && exit 1)
30+
test -f dist/index.js || (echo "❌ dist/index.js not found" && exit 1)
31+
echo "✅ dist/index.js: $(ls -lh dist/index.js | awk '{print $5}')"

‎.github/workflows/ci.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main, develop]
8+
9+
jobs:
10+
lint-and-build:
11+
name: Lint, Format & Build
12+
runs-on: ubuntu-latest
13+
if: ${{ !contains(github.event.head_commit.message || '', '[skip ci]') && !contains(github.event.pull_request.title || '', '[skip ci]') }}
14+
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v6
18+
19+
- name: Setup environment
20+
uses: ./.github/actions/setup
21+
22+
- name: Run ESLint
23+
run: bun run lint
24+
25+
- name: Check Prettier formatting
26+
run: bun run format:check
27+
28+
- name: Type check
29+
run: bun run typecheck
30+
31+
- name: Build project
32+
run: bun run build

‎.github/workflows/publish-trusted.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Publish Package (Trusted Publishing)
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
8+
permissions:
9+
id-token: write # Required for OIDC trusted publishing
10+
contents: read
11+
12+
jobs:
13+
publish:
14+
name: Publish to npm with Trusted Publishing
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v6
20+
21+
- name: Setup environment
22+
uses: ./.github/actions/setup
23+
with:
24+
frozen-lockfile: "true"
25+
26+
- name: Setup Node.js
27+
uses: actions/setup-node@v6
28+
with:
29+
node-version: "22.x"
30+
registry-url: "https://registry.npmjs.org"
31+
32+
# Ensure npm 11.5.1 or later is installed for trusted publishing support
33+
- name: Update npm to latest version
34+
run: npm install -g npm@latest
35+
36+
- name: Build package
37+
run: bun run build
38+
39+
- name: Verify build artifacts
40+
run: |
41+
if [ ! -f "dist/index.js" ]; then
42+
echo "ERROR: Build artifacts missing - dist/index.js not found"
43+
exit 1
44+
fi
45+
echo "✓ Build artifacts verified"
46+
ls -la dist/
47+
48+
# Publish using OIDC authentication (no NPM_TOKEN needed)
49+
- name: Publish to npm
50+
run: npm publish --access public --no-git-checks

‎.github/workflows/security.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Security Scan
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main, develop]
8+
schedule:
9+
# Run weekly on Monday at 9am
10+
- cron: "0 9 * * 1"
11+
12+
permissions:
13+
contents: read
14+
security-events: write
15+
16+
jobs:
17+
dependency-audit:
18+
name: Dependency Audit
19+
runs-on: ubuntu-latest
20+
21+
steps:
22+
- name: Checkout code
23+
uses: actions/checkout@v6
24+
25+
- name: Setup environment
26+
uses: ./.github/actions/setup
27+
28+
- name: Audit dependencies
29+
run: bun pm audit 2>/dev/null || echo "No vulnerabilities found or audit not supported"
30+
31+
codeql:
32+
name: CodeQL Analysis
33+
runs-on: ubuntu-latest
34+
35+
steps:
36+
- name: Checkout code
37+
uses: actions/checkout@v6
38+
39+
- name: Initialize CodeQL
40+
uses: github/codeql-action/init@v4
41+
with:
42+
languages: typescript
43+
44+
- name: Autobuild
45+
uses: github/codeql-action/autobuild@v4
46+
47+
- name: Perform CodeQL Analysis
48+
uses: github/codeql-action/analyze@v4
49+
with:
50+
category: "/language:typescript"

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2025 Muhammed Mustafa AKŞAM
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

0 commit comments

Comments
 (0)