Improve pipelines and use GitHub releases

.ci/publishNpm.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -e
+
+if [ -z "$VERSION" ]; then
+    echo "The environment variable 'VERSION' must be set."
+    exit 1
+fi
+
+if printf -- "$VERSION" | grep -q " "; then
+    echo '$VERSION must not contain whitespaces'
+    exit 1
+fi
+
+# set the version of all packages in the workspace to $VERSION
+npm version --no-git-tag-version $VERSION
+
+# npm i to update the lockfile
+npm i
+
+# publish all packages
+npm exec -c 'enhanced-publish --if-possible --use-preid-as-tag'

.ci/build.sh → .ci/runChecks.sh

@@ -1,9 +1,9 @@
 set -e
-set -x
 
 npm ci
-npm run lint:prettier
+npm run build:node
 npm run lint:eslint
+npm run lint:prettier
+npm run cdep
 npx license-check
 npx better-npm-audit audit --exclude 1112706,1113686
-npm run build:ci

.ci/writeBuildInformation.sh

@@ -6,6 +6,11 @@ if [ -z "$(which jq)" ]; then
     exit 1
 fi
 
+if [ -z "$VERSION" ]; then
+    echo "The environment variable 'VERSION' must be set."
+    exit 1
+fi
+
 if [ -z "$BUILD_NUMBER" ]; then
     echo "The environment variable 'BUILD_NUMBER' must be set."
     exit 1
@@ -21,24 +26,20 @@ if [ "$DEPENDENCIES" = "null" ]; then
     DEPENDENCIES="{}"
 fi
 
-VERSION=$(jq .version package.json -cr)
-if [ -z "$VERSION" ]; then
-    echo "Couldn't read the version from package.json."
-    exit 1
-fi
+DEPENDENCIES="${DEPENDENCIES//[\/]/\\/}" # replace '/' with '\/' because it's a special char
 
 DATE=$(date -u --iso-8601=seconds)
 
+TARGET_FILE="./dist/buildInformation.js"
+
 echo "Writing the following properties into $TARGET_FILE"
 echo "  - DEPENDENCIES: $DEPENDENCIES"
 echo "  - VERSION: $VERSION"
 echo "  - BUILD_NUMBER: $BUILD_NUMBER"
 echo "  - COMMIT_HASH: $COMMIT_HASH"
 echo "  - DATE: $DATE"
 
-TARGET_FILE="./dist/BuildInformation.js"
-
-sed -i "s/\"{{dependencies}}\"/$DEPENDENCIES/" $TARGET_FILE
+sed -i "s/\"{{dependencies}}\"/"$DEPENDENCIES"/" $TARGET_FILE
 sed -i "s/{{version}}/$VERSION/" $TARGET_FILE
 sed -i "s/{{build}}/$BUILD_NUMBER/" $TARGET_FILE
 sed -i "s/{{commit}}/$COMMIT_HASH/" $TARGET_FILE

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,8 @@
+# Readiness checklist
+
+- [ ] I added/updated tests.
+- [ ] I ensured that the PR title is good enough for the changelog.
+- [ ] I labeled the PR.
+- [ ] I self-reviewed the PR.
+
+<!-- # Description -->

.github/mergify.yml

@@ -0,0 +1,6 @@
+pull_request_rules:
+  - name: update pull request
+    conditions:
+      - label!=wip
+    actions:
+      update:

.github/release.yml

@@ -0,0 +1,21 @@
+changelog:
+  exclude:
+    labels:
+      - ci
+      - chore
+      - dependencies
+      - refactoring
+      - test
+  categories:
+    - title: Breaking Changes
+      labels:
+        - breaking-change
+    - title: New Features
+      labels:
+        - enhancement
+    - title: Bug Fixes
+      labels:
+        - bug
+    - title: Other Changes
+      labels:
+        - "*"

.github/renovate.json5

@@ -0,0 +1,27 @@
+{
+    $schema: "https://docs.renovatebot.com/renovate-schema.json",
+    rangeStrategy: "bump",
+    extends: ["config:recommended", ":disableDependencyDashboard"],
+    labels: ["dependencies"],
+    schedule: ["after 10pm every weekday", "before 5am every weekday", "every weekend"],
+    reviewers: ["Milena-Czierlinski", "britsta"],
+    packageRules: [
+        {
+            // all patch versions of all packages should be part of a single group
+            groupName: "patch-all",
+            matchUpdateTypes: ["patch", "digest"],
+            automerge: true
+        },
+        // ############# Minor updates (one group per datasource) #############
+        {
+            groupName: "minor-updates-npm",
+            matchDatasources: ["npm"],
+            matchUpdateTypes: ["minor"]
+        },
+        {
+            groupName: "minor-updates-github-tags-and-runners",
+            matchDatasources: ["github-tags", "github-runners"],
+            matchUpdateTypes: ["minor"]
+        }
+    ]
+}

.github/settings.yml

@@ -0,0 +1,42 @@
+---
+# https://github.com/repository-settings/app
+
+repository:
+  allow_squash_merge: true
+  allow_merge_commit: false
+  allow_rebase_merge: false
+  allow_auto_merge: true
+  allow_update_branch: true
+  delete_branch_on_merge: true
+
+labels:
+  - name: breaking-change
+    color: "#16060F"
+    description: A breaking change
+  - name: bug
+    color: "#d73a4a"
+    description: Something isn't working
+  - name: chore
+    color: "#c2e0c6"
+    description: Some routine work like updating dependencies
+  - name: ci
+    color: "#DFB5FD"
+    description: Continuous Integration related stuff
+  - name: dependencies
+    color: "#0366d6"
+    description: Pull requests that update dependencies
+  - name: documentation
+    color: "#0075ca"
+    description: Improvements or additions to documentation
+  - name: enhancement
+    color: "#a2eeef"
+    description: New feature or request
+  - name: refactoring
+    color: "#880361"
+    description: Refactoring of code
+  - name: test
+    color: "#20D89D"
+    description: This pull request contains only new or changed tests
+  - name: wip
+    color: "#32BF4C"
+    description: Work in Progress (blocks mergify from auto update the branch)

.github/workflows/check-pr.yml

@@ -0,0 +1,20 @@
+name: Check Pull Request
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    types: [opened, labeled, unlabeled, synchronize]
+
+jobs:
+  validate-pr-label:
+    name: Validate the Pull Request's labels
+    runs-on: ubuntu-latest
+    steps:
+      - name: PR must be labeled
+        uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+        with:
+          disable-reviews: true
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+          valid-labels: "breaking-change, bug, chore, ci, dependencies, documentation, enhancement, refactoring, test"

.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["main", "release/**"]
+  pull_request:
+    branches: ["main", "release/**"]
+  schedule:
+    - cron: "38 11 * * 5"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: "ubuntu-latest"
+    timeout-minutes: 360
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript-typescript"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/publish.yml

@@ -2,25 +2,34 @@ name: Publish
 
 on:
   push:
-    branches:
-      - main
+    tags:
+      - "*"
 
 jobs:
+  run-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - run: bash .ci/runChecks.sh
+
   publish-npm:
     runs-on: ubuntu-latest
     permissions:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: current
+          node-version-file: .nvmrc
           registry-url: https://registry.npmjs.org
-      - uses: browser-actions/setup-chrome@latest
-      - run: bash .ci/build.sh
+      - run: npm ci
+      - run: npm run build:ci
         env:
           BUILD_NUMBER: ${{ github.run_number }}
           COMMIT_HASH: ${{ github.sha }}
-      - run: bash .ci/test.sh
-      - run: bash .ci/publish.sh
+          VERSION: ${{ github.ref_name }}
+      - run: bash .ci/publishNpm.sh
+        env:
+          VERSION: ${{ github.ref_name }}
+    needs: ["run-checks"]

.github/workflows/test.yml

@@ -6,16 +6,20 @@ on:
       - main
 
 jobs:
+  run-checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - run: bash .ci/runChecks.sh
+
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: current
+          node-version-file: .nvmrc
       - uses: browser-actions/setup-chrome@latest
-      - run: bash .ci/build.sh
-        env:
-          BUILD_NUMBER: ${{ github.run_number }}
-          COMMIT_HASH: ${{ github.sha }}
-      - run: bash .ci/test.sh
+      - run: npm ci
+      - run: npm run build
+      - run: npm run test:ci

.nvmrc

@@ -0,0 +1 @@
+25.8.1