@codfish/actions 0.0.0-PR-58--24ced07

package/setup-node-and-install/action.yml

@@ -0,0 +1,228 @@
+name: setup-node-and-install
+
+description:
+  Sets up Node.js environment and installs dependencies with automatic package manager detection (npm/pnpm/yarn),
+  intelligent caching, and version detection via input, .node-version, .nvmrc, or package.json volta.node
+
+inputs:
+  node-version:
+    description:
+      'Node.js version to install (e.g. "24", "lts/*"). Precedence: node-version input > .node-version > .nvmrc >
+      package.json volta.node.'
+    required: false
+  install-options:
+    description: Extra command-line options to pass to npm/pnpm/yarn install.
+    default: ''
+  working-directory:
+    description: Directory containing package.json and lockfile.
+    default: .
+  registry-url:
+    description:
+      'Optional registry URL to configure for publishing (e.g. "https://registry.npmjs.org/"). Creates .npmrc with
+      NODE_AUTH_TOKEN placeholder. NOT recommended if using semantic-release (it handles auth independently). Only
+      needed for publishing with manual npm publish or other non-semantic-release workflows.'
+    required: false
+  upgrade-npm:
+    description:
+      Whether to upgrade npm to v11.5.1. This is required for OIDC trusted publishing but can be disabled if you want to
+      shave off some run time and you are still using token-based authentication.
+    default: true
+
+outputs:
+  node-version:
+    description: The installed node version.
+    value: ${{ steps.setup-node.outputs.node-version }}
+  cache-hit:
+    description: Whether the dependency cache was hit (true/false).
+    value: "${{ steps.setup-node.outputs.cache-hit == 'true' && 'true' || 'false' }}"
+  pnpm-dest:
+    description: Expanded path of pnpm dest.
+    value: ${{ steps.pnpm-setup.outputs.dest }}
+  pnpm-bin-dest:
+    description: Location of pnpm and pnpx command.
+    value: ${{ steps.pnpm-setup.outputs.bin_dest }}
+
+runs:
+  using: composite
+
+  steps:
+    - name: Validate environment and detect package manager
+      id: detect-package-manager
+      working-directory: ${{ inputs.working-directory }}
+      shell: bash
+      run: |
+        # Validate package.json exists
+        if [ ! -f "./package.json" ]; then
+          echo "❌ ERROR: package.json not found in '${{ inputs.working-directory }}'"
+          echo "Make sure the working-directory contains a valid Node.js project"
+          exit 1
+        fi
+
+        # Detect package manager based on lockfiles (including yarn)
+        if [ -f "./pnpm-lock.yaml" ]; then
+          echo "package-manager=pnpm" >> $GITHUB_OUTPUT
+          echo "lockfile-exists=true" >> $GITHUB_OUTPUT
+          echo "lockfile-path=pnpm-lock.yaml" >> $GITHUB_OUTPUT
+          echo "📦 Detected package manager: pnpm"
+        elif [ -f "./yarn.lock" ]; then
+          echo "package-manager=yarn" >> $GITHUB_OUTPUT
+          echo "lockfile-exists=true" >> $GITHUB_OUTPUT
+          echo "lockfile-path=yarn.lock" >> $GITHUB_OUTPUT
+          echo "📦 Detected package manager: yarn"
+        elif [ -f "./package-lock.json" ]; then
+          echo "package-manager=npm" >> $GITHUB_OUTPUT
+          echo "lockfile-exists=true" >> $GITHUB_OUTPUT
+          echo "lockfile-path=package-lock.json" >> $GITHUB_OUTPUT
+          echo "📦 Detected package manager: npm"
+        else
+          echo "package-manager=npm" >> $GITHUB_OUTPUT
+          echo "lockfile-exists=false" >> $GITHUB_OUTPUT
+          echo "lockfile-path=" >> $GITHUB_OUTPUT
+          echo "📦 No lockfile found, defaulting to: npm"
+        fi
+
+    - name: Install pnpm
+      if: steps.detect-package-manager.outputs.package-manager == 'pnpm'
+      uses: pnpm/action-setup@v4
+      id: pnpm-setup
+      with:
+        run_install: false
+
+    # Detect Node.js version to use (input > .node-version > .nvmrc > package.json volta.node)
+    - name: Detect node version
+      id: detect-node-version
+      working-directory: ${{ inputs.working-directory }}
+      shell: bash
+      run: |
+        resolved_version=""
+
+        if [ -n "${INPUT_NODE_VERSION}" ]; then
+          resolved_version="$INPUT_NODE_VERSION"
+          echo "📋 Using Node version from input: $resolved_version"
+        elif [ -f "./.node-version" ]; then
+          file_version=$(cat ./.node-version | tr -d '\n\r' | xargs)
+          if [ -n "$file_version" ]; then
+            resolved_version="$file_version"
+            echo "📋 Using Node version from .node-version: $resolved_version"
+          fi
+        fi
+
+        if [ -z "$resolved_version" ] && [ -f "./.nvmrc" ]; then
+          nvmrc_version=$(cat ./.nvmrc | tr -d '\n\r' | xargs)
+          if [ -n "$nvmrc_version" ]; then
+            resolved_version="$nvmrc_version"
+            echo "📋 Using Node version from .nvmrc: $resolved_version"
+          fi
+        fi
+
+        if [ -z "$resolved_version" ]; then
+          volta_node=$(jq -r '.volta.node // empty' package.json 2>/dev/null || true)
+          if [ -n "$volta_node" ]; then
+            resolved_version="$volta_node"
+            echo "📋 Using Node version from package.json volta.node: $resolved_version"
+          fi
+        fi
+
+        echo "version=$resolved_version" >> $GITHUB_OUTPUT
+      env:
+        INPUT_NODE_VERSION: ${{ inputs.node-version }}
+
+    - name: Setup Node.js
+      uses: actions/setup-node@v6
+      id: setup-node
+      with:
+        # use detected package manager cache
+        cache: ${{ steps.detect-package-manager.outputs.package-manager }}
+        cache-dependency-path: ${{ inputs.working-directory }}
+        node-version: ${{ steps.detect-node-version.outputs.version }}
+        registry-url: ${{ inputs.registry-url }}
+
+    - name: Upgrade npm for OIDC support
+      if: inputs.upgrade-npm == 'true'
+      shell: bash
+      run: |
+        echo "📦 Current npm version: $(npm --version)"
+        echo "🔄 Upgrading npm to v11 (required for OIDC trusted publishing)..."
+        if ! npm install -g npm@^11.5.1; then
+          echo "❌ Failed to upgrade npm to v11.5.1. Check network access or permissions."
+          exit 1
+        fi
+        echo "✅ Updated to npm version: $(npm --version)"
+
+    # Apply `./node_modules` cache only if a lockfile is present and using `npm`
+    # Will remove the need to run install commands twice. Risk reduced by using a very specific cache key.
+    # Cache wont be used if the lockfile changes, package manager, node version, or OS changes.
+    - name: Setup node_modules dependency cache
+      if:
+        steps.detect-package-manager.outputs.lockfile-exists == 'true' &&
+        steps.detect-package-manager.outputs.package-manager == 'npm'
+      uses: actions/cache@v5
+      id: cache
+      with:
+        path: ${{ inputs.working-directory }}/node_modules
+        key:
+          ${{ runner.os }}-node_modules-${{ steps.detect-package-manager.outputs.package-manager }}-${{
+          steps.setup-node.outputs.node-version }}-${{ hashFiles(format('{0}/{1}', inputs.working-directory,
+          steps.detect-package-manager.outputs.lockfile-path)) }}
+
+    - name: Install dependencies with pnpm
+      if: steps.detect-package-manager.outputs.package-manager == 'pnpm' && steps.cache.outputs.cache-hit != 'true'
+      working-directory: ${{ inputs.working-directory }}
+      shell: bash
+      run: |
+        echo "🔧 Installing dependencies with pnpm..."
+        if [ "$LOCKFILE_EXISTS" = "true" ]; then
+          INPUT_INSTALL_OPTIONS="--frozen-lockfile $INPUT_INSTALL_OPTIONS"
+        else
+          echo "⚠️  Warning: No lockfile found, not using --frozen-lockfile"
+        fi
+        if ! pnpm i $INPUT_INSTALL_OPTIONS; then
+          echo "❌ ERROR: pnpm install failed"
+          exit 1
+        fi
+        echo "✅ pnpm install completed successfully"
+      env:
+        INPUT_INSTALL_OPTIONS: ${{ inputs.install-options }}
+        LOCKFILE_EXISTS: ${{ steps.detect-package-manager.outputs.lockfile-exists }}
+
+    - name: Install dependencies with yarn
+      if: steps.detect-package-manager.outputs.package-manager == 'yarn' && steps.cache.outputs.cache-hit != 'true'
+      working-directory: ${{ inputs.working-directory }}
+      shell: bash
+      run: |
+        echo "🔧 Installing dependencies with yarn..."
+        if [ "$LOCKFILE_EXISTS" = "true" ]; then
+          INPUT_INSTALL_OPTIONS="--frozen-lockfile $INPUT_INSTALL_OPTIONS"
+        else
+          echo "⚠️  Warning: No lockfile found, results may vary"
+        fi
+        if ! yarn install $INPUT_INSTALL_OPTIONS; then
+          echo "❌ ERROR: yarn install failed"
+          exit 1
+        fi
+        echo "✅ yarn install completed successfully"
+      env:
+        INPUT_INSTALL_OPTIONS: ${{ inputs.install-options }}
+        LOCKFILE_EXISTS: ${{ steps.detect-package-manager.outputs.lockfile-exists }}
+
+    - name: Install dependencies with npm
+      if: steps.detect-package-manager.outputs.package-manager == 'npm' && steps.cache.outputs.cache-hit != 'true'
+      working-directory: ${{ inputs.working-directory }}
+      shell: bash
+      run: |
+        NPM_CMD=""
+        if [ "$LOCKFILE_EXISTS" = "true" ]; then
+          NPM_CMD="ci"
+        else
+          echo "⚠️  Warning: No lockfile found, versions may vary"
+          NPM_CMD="install"
+        fi
+        echo "🔧 Installing dependencies with npm $NPM_CMD..."
+        if ! npm $NPM_CMD --no-save --prefer-offline --no-audit $INPUT_INSTALL_OPTIONS; then
+          echo "❌ ERROR: npm $NPM_CMD failed"
+          exit 1
+        fi
+        echo "✅ npm $NPM_CMD completed successfully"
+      env:
+        INPUT_INSTALL_OPTIONS: ${{ inputs.install-options }}
+        LOCKFILE_EXISTS: ${{ steps.detect-package-manager.outputs.lockfile-exists }}