Skip to content

Commit d56d4ff

Browse files
hckhanhhckhanh
committed
add workflows
1 parent dddce57 commit d56d4ff

File tree

5 files changed

+194
-0
lines changed

5 files changed

+194
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "npm"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"
7+
timezone: "Asia/Saigon"
8+
time: "00:00"
9+
target-branch: "main"
10+
open-pull-requests-limit: 20
11+
reviewers:
12+
- "hckhanh"
13+
commit-message:
14+
prefix: "deps"
15+
include: "scope"
16+
- package-ecosystem: "github-actions"
17+
directory: "/"
18+
schedule:
19+
interval: "daily"
20+
timezone: "Asia/Saigon"
21+
time: "15:30"
22+
target-branch: "main"
23+
open-pull-requests-limit: 20
24+
reviewers:
25+
- "hckhanh"
26+
commit-message:
27+
prefix: "build"

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
# The branches below must be a subset of the branches above
8+
branches: [main]
9+
schedule:
10+
- cron: "0 11 * * 3"
11+
12+
jobs:
13+
analyze:
14+
name: Analyze
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@v2.3.4
20+
21+
# Initializes the CodeQL tools for scanning.
22+
- name: Initialize CodeQL
23+
uses: github/codeql-action/init@v1
24+
# Override language selection by uncommenting this and choosing your languages
25+
with:
26+
languages: javascript
27+
28+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
29+
# If this step fails, then you should remove it and run the build manually (see below)
30+
- name: Autobuild
31+
uses: github/codeql-action/autobuild@v1
32+
33+
# ℹ️ Command-line programs to run using the OS shell.
34+
# 📚 https://git.io/JvXDl
35+
36+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
37+
# and modify them (or add more) to build your code if your project
38+
# uses a compiled language
39+
40+
#- run: |
41+
# make bootstrap
42+
# make release
43+
44+
- name: Perform CodeQL Analysis
45+
uses: github/codeql-action/analyze@v1

‎.github/workflows/ossar-analysis.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# This workflow integrates a collection of open source static analysis tools
2+
# with GitHub code scanning. For documentation, or to provide feedback, visit
3+
# https://github.com/github/ossar-action
4+
name: OSSAR
5+
6+
on:
7+
push:
8+
pull_request:
9+
10+
jobs:
11+
OSSAR-Scan:
12+
# OSSAR runs on windows-latest.
13+
# ubuntu-latest and macos-latest support coming soon
14+
runs-on: windows-latest
15+
16+
steps:
17+
# Checkout your code repository to scan
18+
- name: Checkout repository
19+
uses: actions/checkout@v2.3.4
20+
with:
21+
# We must fetch at least the immediate parents so that if this is
22+
# a pull request then we can checkout the head.
23+
fetch-depth: 2
24+
25+
# If this run was triggered by a pull request event, then checkout
26+
# the head of the pull request instead of the merge commit.
27+
- run: git checkout HEAD^2
28+
if: ${{ github.event_name == 'pull_request' }}
29+
30+
# Ensure a compatible version of dotnet is installed.
31+
# The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201.
32+
# A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action.
33+
# GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped.
34+
# For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action:
35+
# - name: Install .NET
36+
# uses: actions/setup-dotnet@v1
37+
# with:
38+
# dotnet-version: '3.1.x'
39+
# Run open source static analysis tools
40+
- name: Run OSSAR
41+
uses: github/ossar-action@v1
42+
id: ossar
43+
44+
# Upload results to the Security tab
45+
- name: Upload OSSAR results
46+
uses: github/codeql-action/upload-sarif@v1
47+
with:
48+
sarif_file: ${{ steps.ossar.outputs.sarifFile }}

‎.github/workflows/pull-request.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Pull Request
2+
3+
on: pull_request
4+
5+
jobs:
6+
pull-request:
7+
name: npm
8+
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Checkout
13+
uses: actions/checkout@v2.3.4
14+
- name: Set up Node
15+
uses: actions/setup-node@v2.1.4
16+
with:
17+
check-latest: true
18+
- name: Get yarn cache directory path
19+
id: yarn-cache-dir-path
20+
run: echo "::set-output name=dir::$(yarn cache dir)"
21+
- name: Cache dependencies and build outputs
22+
uses: actions/cache@v2
23+
id: yarn-cache
24+
with:
25+
path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
26+
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
27+
restore-keys: |
28+
${{ runner.os }}-yarn-
29+
- name: Check dependencies
30+
run: yarn --frozen-lockfile --check-files
31+
- name: Run tests
32+
run: yarn test

‎.github/workflows/release.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
jobs:
9+
release:
10+
name: npm
11+
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v2.3.4
17+
with:
18+
fetch-depth: 0
19+
- name: Set up Node
20+
uses: actions/setup-node@v2.1.4
21+
with:
22+
check-latest: true
23+
- name: Get yarn cache directory path
24+
id: yarn-cache-dir-path
25+
run: echo "::set-output name=dir::$(yarn cache dir)"
26+
- name: Cache dependencies and build outputs
27+
uses: actions/cache@v2
28+
id: yarn-cache
29+
with:
30+
path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
31+
key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
32+
restore-keys: |
33+
${{ runner.os }}-yarn-
34+
- name: Check dependencies
35+
run: yarn --frozen-lockfile --check-files
36+
- name: Run tests
37+
run: yarn test
38+
- name: Release
39+
env:
40+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
41+
NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
42+
run: npx semantic-release

0 commit comments

Comments
 (0)