ci: add GitHub Actions CI and publish workflows - #3
Merged
Conversation
Modeled on the pino-cloudwatch-ts setup, adapted to this repo:
CI (push/PR to main):
- test job across Node 18/20/22/24 (18 = the engines floor): install,
test:coverage, build, then verify:dist — the artifact gate that caught
the internal-symbol leak (ADR-007) while src sat at 100% coverage.
Runs per-Node so a Node-specific build regression fails here too.
- static job (once, Node 24): format:check, lint, typecheck, typecheck:test-types.
Publish (on v* tag): install, test:coverage, build, verify:dist, then
`npm publish --provenance --access public` and a GitHub release. Dormant
until a tag is pushed; requires npm trusted publishing (OIDC) configured
for the package, same as the other libs.
The repo had no CI — a stack-overflow crash (#1) and a state leak (#2) both
shipped to npm with 100% coverage. These gates would have caught both.
pnpm/action-setup@v6 needs either a `version` input or a `packageManager` field; without either it errors "No pnpm version is specified" and every CI job fails at setup. Pin pnpm@10.33.4 (matches the other libs) as the single source of truth.
There was a problem hiding this comment.
Pull request overview
This PR introduces GitHub Actions workflows to add CI gates (tests/coverage/build + dist verification across a Node matrix, plus one-pass static checks) and a tag-triggered publish pipeline with npm provenance and automated GitHub Releases.
Changes:
- Add
ci.ymlworkflow for push/PR tomainwith Node 18/20/22/24 test matrix and separate static checks on Node 24. - Add
publish.ymlworkflow forv*tags to run validation gates, publish to npm with provenance (OIDC), and create a GitHub Release.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/ci.yml | Adds PR/push CI with Node matrix testing, verify:dist gating, and coverage artifact upload. |
| .github/workflows/publish.yml | Adds tag-based publish workflow running the same gates prior to npm publish --provenance and creating a GitHub release. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
|
||
| - uses: pnpm/action-setup@v6 |
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
|
||
| - uses: pnpm/action-setup@v6 |
CI surfaced two pre-existing issues the repo never had a gate for:
- test-types/tsconfig.json was 2-space indented and never prettier-formatted,
so `prettier --check .` (format:check) failed on it. Reformat to 4-space.
- On Node 18 one test fails: it constructs `new File([], 'file.txt')` but the
File/Blob globals only exist on Node 20+, so on 18 it falls back to `{}` while
still asserting the File name. The library code is runtime-agnostic; only the
test infra assumes 20+. Node 18 is EOL (Apr 2025) and the rimraf devDep already
requires >=20, so bump `engines` to >=20 and drop 18 from the matrix rather than
carry per-test global guards for an EOL runtime.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Modeled on
pino-cloudwatch-ts, adapted to this repo. The repo had no CI — a stack-overflow crash (#1) and a state leak (#2) both shipped to npm at 100% coverage. These gates catch both.ci.yml(push / PR tomain)test — matrix Node 18 / 20 / 22 / 24 (18 = the
enginesfloor):install --frozen-lockfile→test:coverage→build→verify:dist→ upload coverage.verify:distruns per-Node after build — it's the artifact gate that caught the ADR-007 leak whilesrcwas at 100%, and running it on each Node also catches a Node-specific build regression.static — once on Node 24 (these checks are Node-independent):
format:check→lint→typecheck→typecheck:test-types.publish.yml(onv*tag)install→test:coverage→build→verify:dist→npm publish --provenance --access public→ GitHub release.Dormant until a
v*tag is pushed — adding it publishes nothing. It needs npm trusted publishing (OIDC) configured for the package (theid-token: write+--provenancepath), same as your other libs. This keeps the publish deferral intact: nothing ships until you tag.Notes
master→main;enginesfloor20.9→18; this repo's actual script names (test:coverage,format:check,lint) plus its two extra gates pino lacks (typecheck/typecheck:test-typesandverify:dist).rimraf(a devDep) declaresengines: 20 || >=22, but it's only used byclean/prepublishOnly, neither of which CI runs, and there's noengine-strict, sopnpm installwarns-not-fails.