From ea15a9f14607806a775201e63d9fd4cdde48084f Mon Sep 17 00:00:00 2001 From: Matt Travi <126441+travi@users.noreply.github.com> Date: Mon, 25 Mar 2024 11:05:09 -0500 Subject: [PATCH] ci(corepack): pinned the expected dev version of npm and explicitly used it for audit signatures (#895) * ci(corepack): pinned the expected dev version of npm and explicitly used it for audit signatures * ci(matrix): added job to ensure the full matrix succeeds, enabling proper required enforcement * test(publish): verify details of the published package --- .github/workflows/node-ci.yml | 16 +++++- .github/workflows/release.yml | 2 +- package-lock.json | 103 ++++++++++++++++++++++++++++++++++ package.json | 5 +- 4 files changed, 123 insertions(+), 3 deletions(-) diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml index 8fa39fd7a1..523b7be4c8 100644 --- a/.github/workflows/node-ci.yml +++ b/.github/workflows/node-ci.yml @@ -26,7 +26,7 @@ jobs: cache: npm - run: npm clean-install - run: npm test - verify: + verify-dev: runs-on: ubuntu-latest steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 @@ -36,4 +36,18 @@ jobs: node-version-file: .nvmrc cache: npm - run: npm clean-install + - run: corepack npm audit signatures - run: npm test + verify: + runs-on: ubuntu-latest + needs: + - verify-dev + - verify-matrix + if: ${{ !cancelled() }} + steps: + - name: All matrix versions passed + if: ${{ !(contains(needs.*.result, 'failure')) }} + run: exit 0 + - name: Some matrix version failed + if: ${{ contains(needs.*.result, 'failure') }} + run: exit 1 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d1cdd63a75..ab2ffdd0a4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: node-version-file: .nvmrc cache: npm - run: npm clean-install - - run: npm audit signatures + - run: corepack npm audit signatures - run: npx semantic-release@23.0.6 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/package-lock.json b/package-lock.json index 3435004ae6..b850ea8b7a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -26,6 +26,7 @@ "nodemon": "3.1.0", "npm-run-all2": "6.1.2", "prettier-standard": "16.4.1", + "publint": "0.2.7", "smee-client": "2.0.1", "standard": "17.1.0" }, @@ -16227,6 +16228,108 @@ "integrity": "sha512-77DZwxQmxKnu3aR542U+X8FypNzbfJ+C5XQDk3uWjWxn6151aIMGthWYRXTqT1E5oJvg+ljaa2OJi+VfvCOQ8w==", "dev": true }, + "node_modules/publint": { + "version": "0.2.7", + "resolved": "https://registry.npmjs.org/publint/-/publint-0.2.7.tgz", + "integrity": "sha512-tLU4ee3110BxWfAmCZggJmCUnYWgPTr0QLnx08sqpLYa8JHRiOudd+CgzdpfU5x5eOaW2WMkpmOrFshRFYK7Mw==", + "dev": true, + "dependencies": { + "npm-packlist": "^5.1.3", + "picocolors": "^1.0.0", + "sade": "^1.8.1" + }, + "bin": { + "publint": "lib/cli.js" + }, + "engines": { + "node": ">=16" + }, + "funding": { + "url": "https://bjornlu.com/sponsor" + } + }, + "node_modules/publint/node_modules/glob": { + "version": "8.1.0", + "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz", + "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==", + "dev": true, + "dependencies": { + "fs.realpath": "^1.0.0", + "inflight": "^1.0.4", + "inherits": "2", + "minimatch": "^5.0.1", + "once": "^1.3.0" + }, + "engines": { + "node": ">=12" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" + } + }, + "node_modules/publint/node_modules/ignore-walk": { + "version": "5.0.1", + "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-5.0.1.tgz", + "integrity": "sha512-yemi4pMf51WKT7khInJqAvsIGzoqYXblnsz0ql8tM+yi1EKYTY1evX4NAbJrLL/Aanr2HyZeluqU+Oi7MGHokw==", + "dev": true, + "dependencies": { + "minimatch": "^5.0.1" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, + "node_modules/publint/node_modules/minimatch": { + "version": "5.1.6", + "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz", + "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==", + "dev": true, + "dependencies": { + "brace-expansion": "^2.0.1" + }, + "engines": { + "node": ">=10" + } + }, + "node_modules/publint/node_modules/npm-bundled": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/npm-bundled/-/npm-bundled-2.0.1.tgz", + "integrity": "sha512-gZLxXdjEzE/+mOstGDqR6b0EkhJ+kM6fxM6vUuckuctuVPh80Q6pw/rSZj9s4Gex9GxWtIicO1pc8DB9KZWudw==", + "dev": true, + "dependencies": { + "npm-normalize-package-bin": "^2.0.0" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, + "node_modules/publint/node_modules/npm-normalize-package-bin": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-2.0.0.tgz", + "integrity": "sha512-awzfKUO7v0FscrSpRoogyNm0sajikhBWpU0QMrW09AMi9n1PoKU6WaIqUzuJSQnpciZZmJ/jMZ2Egfmb/9LiWQ==", + "dev": true, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, + "node_modules/publint/node_modules/npm-packlist": { + "version": "5.1.3", + "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-5.1.3.tgz", + "integrity": "sha512-263/0NGrn32YFYi4J533qzrQ/krmmrWwhKkzwTuM4f/07ug51odoaNjUexxO4vxlzURHcmYMH1QjvHjsNDKLVg==", + "dev": true, + "dependencies": { + "glob": "^8.0.1", + "ignore-walk": "^5.0.1", + "npm-bundled": "^2.0.0", + "npm-normalize-package-bin": "^2.0.0" + }, + "bin": { + "npm-packlist": "bin/index.js" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, "node_modules/pump": { "version": "3.0.0", "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz", diff --git a/package.json b/package.json index c9d9378073..ed743555cc 100644 --- a/package.json +++ b/package.json @@ -13,6 +13,7 @@ "lint:lockfile": "lockfile-lint --path package-lock.json --type npm --validate-https --allowed-hosts npm", "lint:engines": "ls-engines", "lint:peer": "npm ls >/dev/null", + "lint:publish": "publint --strict", "test:unit": "jest 'test/unit/'", "test:unit:watch": "npm run test:unit -- --watch", "test:integration": "run-s 'test:integration:base -- --profile noWip'", @@ -43,6 +44,7 @@ "nodemon": "3.1.0", "npm-run-all2": "6.1.2", "prettier-standard": "16.4.1", + "publint": "0.2.7", "smee-client": "2.0.1", "standard": "17.1.0" }, @@ -71,5 +73,6 @@ "publishConfig": { "access": "public", "provenance": true - } + }, + "packageManager": "npm@10.5.0+sha256.17ca6e08e7633b624e8f870db81a78f46afe119de62bcaf0a7407574139198fc" }