ci(action): update workflows

Author: sheerlox

.commitlintrc

@@ -1 +1,5 @@
-{"extends": ["@insurgentlab/commitlint-config"]}
+{
+  "extends": [
+    "@insurgentlab/commitlint-config"
+  ]
+}

.github/workflows/release.yml

@@ -1,17 +1,18 @@
-name: Test & Release
+name: Release
 
 on:
   push:
     branches:
       - main
 
 jobs:
-  lint-and-test:
+  test:
     uses: ./.github/workflows/test.yml
-    secrets: inherit
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   release:
-    needs: lint-and-test
+    needs: test
 
     runs-on: ubuntu-latest
 
@@ -20,14 +21,21 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           persist-credentials: false
-      - name: Use Node.js
+
+      - name: Use Node.js LTS
         uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4
         with:
           node-version: 'lts/*'
+          cache: npm
+
       - name: Install packages
         run: npm ci
+
+      - name: Audit npm signatures
+        run: npm audit signatures
+
       - name: Run Semantic Release
-        run: npm run release
+        run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.CI_GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/test.yml

@@ -1,46 +1,76 @@
-name: Lint & Test
+name: Test
 
 on:
-  workflow_call:
+  push:
+    branches:
+      - isn-renovate/** # branches generated by https://github.com/apps/isn-renovate
   pull_request:
     branches:
       - main
+  workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: true
 
 jobs:
-  lint-and-test:
-    runs-on: ${{ matrix.os }}
+  test_matrix:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
+        node-version: [18, 20, 21]
+
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 5
 
     steps:
       - name: Checkout project
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
-      - name: Use Node.js
+
+      - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4
         with:
-          node-version: 'lts/*'
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
       - name: Install packages
         run: npm ci
+
+      - name: Audit npm signatures
+        run: npm audit signatures
+
       - name: Check codestyle compliance
         run: npm run lint
+
       - name: Run tests
         run: npm run test
 
-      # Ensure commitlint is working with HEAD version of our preset
-      - name: Validate current commit (last commit) with commitlint
+      - name: Ensure commitlint works with our current config (push event)
         if: github.event_name == 'push'
         run: npx commitlint --from HEAD~1 --to HEAD --verbose
-      - name: Validate PR commits with commitlint
+      - name: Ensure commitlint works with our current config (pull_request event)
         if: github.event_name == 'pull_request'
         run: npx commitlint --from ${{ github.event.pull_request.head.sha }}~${{ github.event.pull_request.commits }} --to ${{ github.event.pull_request.head.sha }} --verbose
 
       - name: Upload coverage reports to Codecov
-        if: ${{ matrix.os == 'ubuntu-latest' }}
+        if: strategy.job-index == 0
         uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage/coverage-final.json
           fail_ci_if_error: true
+
+  # separate job to set as required status check in branch protection
+  required_check:
+    runs-on: ubuntu-latest
+    needs:
+      - test_matrix
+    if: always()
+    steps:
+      - name: All required jobs and matrix versions passed
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0
+      - name: Some required jobs or matrix versions failed
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: exit 1

package.json

@@ -13,8 +13,7 @@
     "lint": "npm run lint:eslint && npm run lint:prettier",
     "lint:fix": "npm run lint:eslint -- --fix && npm run lint:prettier -- --write",
     "test": "jest --coverage",
-    "test:commitlint": "commitlint --from HEAD~1 --to HEAD --verbose",
-    "release": "semantic-release"
+    "test:commitlint": "commitlint --from HEAD~1 --to HEAD --verbose"
   },
   "engines": {
     "node": ">=v16"