From 2621c8a61a9c219108b0d5e6523aa10e88b8f82e Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Tue, 21 Jul 2026 00:42:54 +0200 Subject: [PATCH 1/2] chore(ci): adopt node-ci gold-standard reusable Replace lint.and.build.yml + codeql.yml + security.yml with one ci.yml calling the org node-ci reusable (lint/type-check/test/build + node-audit + codeql + gitleaks + dependency-review). Piloting against the reusable's feature branch; flips to @main once netresearch/.github#248 merges. Signed-off-by: Sebastian Mendel --- .github/workflows/ci.yml | 32 +++++++++++++ .github/workflows/codeql.yml | 24 ---------- .github/workflows/lint.and.build.yml | 71 ---------------------------- .github/workflows/security.yml | 41 ---------------- 4 files changed, 32 insertions(+), 136 deletions(-) create mode 100644 .github/workflows/ci.yml delete mode 100644 .github/workflows/codeql.yml delete mode 100644 .github/workflows/lint.and.build.yml delete mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..dfc125d --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,32 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + +permissions: {} + +concurrency: + group: ci-${{ github.ref }} + cancel-in-progress: true + +jobs: + # Whole CI surface via the org node gold-standard reusable: TS + # lint/type-check, tests, build, dependency audit, CodeQL, secret + # scanning, dependency review. Replaces lint.and.build.yml + codeql.yml + + # security.yml. + ci: + uses: netresearch/.github/.github/workflows/node-ci.yml@feat/node-gold-standard + permissions: + actions: read + contents: read + security-events: write + pull-requests: write + with: + package-manager: bun + type-check-cmd: "bun run build:lib" + build-cmd: "bun run build:lib" + enable-format-check: false + secrets: + GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index df4dde9..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,24 +0,0 @@ -name: 'CodeQL' - -on: - push: - branches: ['main'] - pull_request: - branches: ['main'] - schedule: - - cron: '18 21 * * 2' - -permissions: {} - -jobs: - # CodeQL runs through the org's shared reusable in netresearch/.github, - # so the pinned github/codeql-action versions are maintained centrally - # instead of bumped per-repo by Renovate. - analyze: - uses: netresearch/.github/.github/workflows/codeql.yml@main - permissions: - actions: read - contents: read - security-events: write - with: - languages: javascript-typescript diff --git a/.github/workflows/lint.and.build.yml b/.github/workflows/lint.and.build.yml deleted file mode 100644 index 490f52f..0000000 --- a/.github/workflows/lint.and.build.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: ๐Ÿ”Ž Lint - -on: - workflow_dispatch: - push: - branches-ignore: [gh-pages] - pull_request: - branches-ignore: [gh-pages] - types: [opened, synchronize] - -permissions: - contents: read - -concurrency: - group: ci-${{ github.ref }} - cancel-in-progress: true - -env: - HUSKY: '0' - -jobs: - build: - name: ๐Ÿ”จ Build - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: 24 - - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - - - name: โšก Install dependencies - run: bun install --frozen-lockfile - - - name: ๐Ÿ”จ Build - run: bun run build:lib - - test: - name: ๐Ÿงช Test - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: 24 - - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - - - name: โšก Install dependencies - run: bun install --frozen-lockfile - - - name: ๐Ÿงช Test - run: bun run test:coverage - - lint: - name: ๐Ÿ”Ž Lint - runs-on: ubuntu-24.04 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 - with: - node-version: 24 - - - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0 - - - name: โšก Install dependencies - run: bun install --frozen-lockfile - - - name: ๐Ÿ”Ž Lint - run: bun run lint diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml deleted file mode 100644 index ef62637..0000000 --- a/.github/workflows/security.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: Security - -# Aggregated security scans: secret scanning (gitleaks), dependency review on -# PRs, and a Node.js dependency audit. -# -# Top-level `permissions: {}` denies everything by default; each reusable -# caller job re-declares the exact union its reusable requires, so the token -# passed to each reusable is fully explicit and never relies on the repo -# default (default_workflow_permissions). This is the same contract proven in -# netresearch/.github's go-app / php-module templates. - -on: - push: - branches: [main, master] - pull_request: - -permissions: {} - -jobs: - gitleaks: - uses: netresearch/.github/.github/workflows/gitleaks.yml@main - permissions: - contents: read - security-events: write - secrets: - GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} - - dependency-review: - if: github.event_name == 'pull_request' - uses: netresearch/.github/.github/workflows/dependency-review.yml@main - permissions: - contents: read - pull-requests: write - - node-audit: - uses: netresearch/.github/.github/workflows/node-audit.yml@main - permissions: - contents: read - with: - package-manager: bun - audit-level: high From 044a1587c225402108abfa57278c944b53b4597e Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Tue, 21 Jul 2026 00:49:06 +0200 Subject: [PATCH 2/2] chore(ci): pin node-ci reusable to @main (gold standard merged) Signed-off-by: Sebastian Mendel --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index dfc125d..1bcb63d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: # scanning, dependency review. Replaces lint.and.build.yml + codeql.yml + # security.yml. ci: - uses: netresearch/.github/.github/workflows/node-ci.yml@feat/node-gold-standard + uses: netresearch/.github/.github/workflows/node-ci.yml@main permissions: actions: read contents: read