Skip to content
Merged
Show file tree
Hide file tree
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/CODEOWNERS
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
* @splitio/sdk
7 changes: 7 additions & 0 deletions .github/pull_request_template.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# JavaScript Browser SDK

## What did you accomplish?

## How do we test the changes introduced in this PR?

## Extra Notes
142 changes: 142 additions & 0 deletions .github/workflows/ci-cd.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,142 @@
name: ci-cd
on:
pull_request:
branches:
- main
- development
push:
branches:
- '*'

env:
PUPPETEER_SKIP_DOWNLOAD: 'true'

concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.run_number || github.event.pull_request.number }}
cancel-in-progress: true

permissions:
contents: read

Check warning on line 19 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Move this read permission from workflow level to job level.

[S8264] Read permissions should be defined at the job level See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=202b0aab-0aab-4160-ac57-d567c177266e&open=202b0aab-0aab-4160-ac57-d567c177266e
id-token: write

Check warning on line 20 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Move this write permission from workflow level to job level.

[S8233] Write permissions should be defined at the job level See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=fd12fef4-e136-466d-91b6-c5f7de26e3c7&open=fd12fef4-e136-466d-91b6-c5f7de26e3c7

jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v5

- name: Setup Node.js
uses: actions/setup-node@v6
with:
node-version: 'lts/*'
cache: 'npm'

- name: npm ci
run: npm ci

Check warning on line 37 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Omitting "--ignore-scripts" can lead to the execution of shell scripts. Make sure it is safe here.

[S6505] Allowing shell scripts execution during package installation is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=073896ba-8e47-429c-aee6-9d7110620b3f&open=073896ba-8e47-429c-aee6-9d7110620b3f

- name: Setup Chrome
uses: browser-actions/setup-chrome@19ae4b339ee18925ab85cf12c1041150ea4a44c8 # v1
with:
chrome-version: '125'
- name: Set CHROME_BIN
run: echo "CHROME_BIN=$(which chrome)" >> $GITHUB_ENV

- name: npm test-ts-decls
run: npm run test-ts-decls

- name: npm check
run: npm run check

- name: npm test
run: npm run test

- name: npm build
run: BUILD_BRANCH=$(echo "${GITHUB_REF#refs/heads/}") npm run build

- name: Store assets
if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/development' || github.ref == 'refs/heads/main') }}
uses: actions/upload-artifact@v5
with:
name: assets
path: umd/
retention-days: 1

upload-stage:
name: Upload assets
runs-on: ubuntu-latest
needs: build
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/development' }}
strategy:
matrix:
environment:
- stage
include:
- environment: stage
account_id: "079419646996"
bucket: split-public-stage

steps:
- name: Download assets
uses: actions/download-artifact@v6
with:
name: assets
path: umd

- name: Display structure of assets
run: ls -R
working-directory: umd

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4

Check warning on line 92 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=5e7d0364-05cf-48ba-a5f8-01ab47031b9d&open=5e7d0364-05cf-48ba-a5f8-01ab47031b9d
with:
role-to-assume: arn:aws:iam::${{ matrix.account_id }}:role/gha-public-assets-role
aws-region: us-east-1

- name: Upload to S3
run: aws s3 sync $SOURCE_DIR s3://$BUCKET/$DEST_DIR $ARGS
env:
BUCKET: ${{ matrix.bucket }}
SOURCE_DIR: ./umd
DEST_DIR: sdk
ARGS: --acl public-read --follow-symlinks --cache-control max-age=31536000,public

upload-prod:
name: Upload assets
runs-on: ubuntu-latest
needs: build
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
strategy:
matrix:
environment:
- prod
include:
- environment: prod
account_id: "825951051969"
bucket: split-public

steps:
- name: Download assets
uses: actions/download-artifact@v6
with:
name: assets
path: umd

- name: Display structure of assets
run: ls -R
working-directory: umd

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4

Check warning on line 131 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=f24501bf-095c-48f4-8720-a92855556be8&open=f24501bf-095c-48f4-8720-a92855556be8
with:
role-to-assume: arn:aws:iam::${{ matrix.account_id }}:role/gha-public-assets-role
aws-region: us-east-1

- name: Upload to S3
run: aws s3 sync $SOURCE_DIR s3://$BUCKET/$DEST_DIR $ARGS
env:
BUCKET: ${{ matrix.bucket }}
SOURCE_DIR: ./umd
DEST_DIR: sdk
ARGS: --acl public-read --follow-symlinks --cache-control max-age=31536000,public
66 changes: 66 additions & 0 deletions .github/workflows/sonar-scan.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
name: sonar-scan
on:
pull_request:
branches:
- main
- development
push:
branches:
- main
- development

jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0

- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: 'lts/*'
cache: 'npm'

- name: npm CI
run: npm ci

Check warning on line 29 in .github/workflows/sonar-scan.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Omitting "--ignore-scripts" can lead to the execution of shell scripts. Make sure it is safe here.

[S6505] Allowing shell scripts execution during package installation is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=dded4b87-aac3-45ec-a25a-a034952ee9b0&open=dded4b87-aac3-45ec-a25a-a034952ee9b0

- name: npm Check
run: npm run check

- name: npm Build
run: BUILD_BRANCH=$(echo "${GITHUB_REF#refs/heads/}") npm run build

- name: SonarQube Scan (Push)
if: github.event_name == 'push'
uses: SonarSource/sonarqube-scan-action@v6

Check warning on line 39 in .github/workflows/sonar-scan.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=12437986-85d9-4b94-b929-e57b83bdbece&open=12437986-85d9-4b94-b929-e57b83bdbece
env:
SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
with:
projectBaseDir: .
args: >
-Dsonar.host.url=${{ secrets.SONARQUBE_HOST }}
-Dsonar.projectName=${{ github.event.repository.name }}
-Dsonar.projectKey=${{ github.event.repository.name }}
-Dsonar.links.ci="https://github.com/splitio/${{ github.event.repository.name }}/actions"
-Dsonar.links.scm="https://github.com/splitio/${{ github.event.repository.name }}"

- name: SonarQube Scan (Pull Request)
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
uses: SonarSource/sonarqube-scan-action@v6

Check warning on line 53 in .github/workflows/sonar-scan.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=e0d1dcac-485d-4931-a7c0-bcb06e5e6ece&open=e0d1dcac-485d-4931-a7c0-bcb06e5e6ece
env:
SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
with:
projectBaseDir: .
args: >
-Dsonar.host.url=${{ secrets.SONARQUBE_HOST }}
-Dsonar.projectName=${{ github.event.repository.name }}
-Dsonar.projectKey=${{ github.event.repository.name }}
-Dsonar.links.ci="https://github.com/splitio/${{ github.event.repository.name }}/actions"
-Dsonar.links.scm="https://github.com/splitio/${{ github.event.repository.name }}"
-Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
-Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }}
-Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}
45 changes: 45 additions & 0 deletions .github/workflows/update-notice-year.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
name: Update Notice Year

on:
schedule:
- cron: "0 3 1 1 *" # 03:00 AM on January 1

permissions:
contents: write
pull-requests: write

jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Set Current year
run: "echo CURRENT=$(date +%Y) >> $GITHUB_ENV"

- name: Set Previous Year
run: "echo PREVIOUS=$(($CURRENT-1)) >> $GITHUB_ENV"

- name: Update NOTICE
uses: jacobtomlinson/gha-find-replace@v3

Check warning on line 27 in .github/workflows/update-notice-year.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=0d5df086-912e-4eca-9db9-a973f098ca72&open=0d5df086-912e-4eca-9db9-a973f098ca72
with:
find: ${{ env.PREVIOUS }}
replace: ${{ env.CURRENT }}
include: "NOTICE"
regex: false

- name: Commit files
run: |
git config user.name 'github-actions[bot]'
git config user.email 'github-actions[bot]@users.noreply.github.com'
git commit -m "Updated Notice Year" -a

- name: Create Pull Request
uses: peter-evans/create-pull-request@v5

Check warning on line 41 in .github/workflows/update-notice-year.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=a5c392a5-db40-48d2-a4be-810daa671cd9&open=a5c392a5-db40-48d2-a4be-810daa671cd9
with:
token: ${{ secrets.GITHUB_TOKEN }}
title: Update Notice Year
branch: update-notice
Loading
Loading