@ebalzan/ci 0.0.0-stage → 1.0.0

package/templates/.github/workflows/pr-checks.yml

@@ -0,0 +1,110 @@
+# =============================================================================
+# PR Checks — the quality gate for every PR into dev or main.
+#
+#   pr-check / Work PR     __CI_REPO__'s pr-checks action for feat/fix/… PRs
+#                          into dev — Conventional title and commits, then the
+#                          PR's data: branch, title type, type label, assignee,
+#                          author, milestone, board, description.
+#   pr-check / Release PR  The same action for the dev → main PR — the same
+#                          commitlint steps, the computed
+#                          `<type>[!]: release vX.Y.Z` title, the `release`
+#                          label, assignee, milestone, board, description.
+#
+# The other kind is skipped, as are drafts. Keep the two job names as they are:
+# they are the check names the shared rulesets require.
+#
+# The PR's metadata is part of the check, so it also re-runs when the title,
+# description, labels, milestone or assignees change.
+# Add this repo's own build/test/lint jobs below; they run in parallel.
+# Generated by `ebalzan-ci onboard`; the check logic lives in the action (it
+# follows __CI_REF__).
+# =============================================================================
+name: PR Checks
+
+on:
+  pull_request:
+    branches: ['main', 'dev']
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+      - edited
+      - labeled
+      - unlabeled
+      - milestoned
+      - demilestoned
+      - assigned
+      - unassigned
+
+permissions:
+  contents: read
+  pull-requests: write
+
+concurrency:
+  group: pr-checks-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  AUTO_BASE_BRANCH: dev
+  AUTO_RELEASE_BRANCH: main
+  REPO_VARS_JSON: ${{ toJSON(vars) }}
+
+jobs:
+  work-pr:
+    name: pr-check / Work PR
+    if: ${{ github.event.pull_request.head.ref != 'dev' && !github.event.pull_request.draft }}
+    runs-on: __RUNS_ON__
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - uses: __CI_REPO__/actions/pr-checks@__CI_REF__
+        with:
+          kind: work
+          project-token: ${{ secrets.GH_PROJECT_TOKEN }}
+
+  release-pr:
+    name: pr-check / Release PR
+    if: ${{ github.event.pull_request.head.ref == 'dev' && !github.event.pull_request.draft }}
+    runs-on: __RUNS_ON__
+    steps:
+      # Full history with the tags: git-cliff computes the version from them.
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - uses: __CI_REPO__/actions/pr-checks@__CI_REF__
+        with:
+          kind: release
+          project-token: ${{ secrets.GH_PROJECT_TOKEN }}
+
+  # A Node repo's own checks. Uncomment and adapt; other stacks replace the
+  # steps (e.g. `go test ./...`).
+  # validate:
+  #   name: Validate
+  #   runs-on: __RUNS_ON__
+  #   steps:
+  #     - uses: actions/checkout@v4
+  #     - uses: actions/setup-node@v4
+  #       with:
+  #         node-version: 24
+  #         cache: npm
+  #     - run: npm ci
+  #     # Prettier/ESLint/TypeScript extend @ebalzan/config instead of copying it.
+  #     - run: npx --no-install ebalzan-config verify
+  #     # The repo's own script: format:check, lint, typecheck, test, …
+  #     - run: npm run validate

package/templates/.github/workflows/release.yml

@@ -0,0 +1,76 @@
+# =============================================================================
+# Release — runs __CI_REPO__'s release action.
+#
+# Runs when a PR into main is closed; the `release` job runs only when it is
+# the dev → main release PR and it was merged (with a merge commit). Merging a
+# work PR into dev never runs it. The release: the version from the
+# Conventional Commits since the last tag, package.json bumped when there is
+# one, the vX.Y.Z tag, the GitHub Release (the PR's description as notes), and
+# dev brought up to main.
+#
+# Then `deploy` hands the new tag to deploy.yml — this repo's own file, where
+# what ships the release lives. Generated by `ebalzan-ci onboard`; the release
+# logic lives in the action (it follows __CI_REF__). Keep deploying out of this
+# file.
+# =============================================================================
+name: Release
+
+on:
+  pull_request:
+    types: [closed]
+    branches: ['main']
+
+permissions:
+  contents: write
+  pull-requests: read
+
+jobs:
+  release:
+    name: Version, tag and publish
+    if: >-
+      ${{ github.event.pull_request.merged
+      && github.event.pull_request.head.ref == 'dev'
+      && github.event.pull_request.head.repo.full_name == github.repository }}
+    runs-on: __RUNS_ON__
+    # Queued, never cancelled: a run cut short could tag without a Release.
+    concurrency:
+      group: release-${{ github.repository }}
+      cancel-in-progress: false
+    env:
+      AUTO_BASE_BRANCH: dev
+      AUTO_RELEASE_BRANCH: main
+    outputs:
+      tag: ${{ steps.release.outputs.tag }}
+      sha: ${{ steps.release.outputs.sha }}
+    steps:
+      # The merge commit, with full history and the tags: git-cliff computes the
+      # version from them. Credentials stay: the job pushes main and dev.
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - id: release
+        uses: __CI_REPO__/actions/release@__CI_REF__
+        with:
+          dev-token: ${{ secrets.GH_PROJECT_TOKEN }}
+
+  deploy:
+    needs: release
+    if: ${{ needs.release.outputs.tag != '' }}
+    # What deploy.yml may use: a called workflow gets at most what this job
+    # grants. Keep it equal to deploy.yml's own `permissions` (e.g. add
+    # attestations: write to both).
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+      deployments: write
+    uses: ./.github/workflows/deploy.yml
+    with:
+      tag: ${{ needs.release.outputs.tag }}
+    secrets: inherit

package/templates/.husky/commit-msg

@@ -0,0 +1,11 @@
+# Conventional Commits check for every local commit, from __CI_PACKAGE__
+# (generated by `ebalzan-ci onboard`). The same rule runs on every PR title in
+# CI, so a missing package only loses the early local warning — never the check.
+
+if [ -x node_modules/.bin/ebalzan-ci ]; then
+  exec node_modules/.bin/ebalzan-ci commit-msg "$1"
+fi
+
+echo "commit-msg: __CI_PACKAGE__ is not installed; commit message not checked locally."
+echo "Install it with: npm install --save-dev __CI_PACKAGE__"
+exit 0

package/templates/eslint.config.mjs

@@ -0,0 +1,6 @@
+// ESLint: the shared rules from @ebalzan/config, then this repo's own blocks
+// (generated by `ebalzan-ci onboard`). A later block wins for the files it
+// matches, e.g. { ignores: ['generated/'] } or { files: [...], rules: {...} }.
+import node from '@ebalzan/config/eslint/node'
+
+export default [...node]

package/templates/renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>__CI_REPO__//renovate/tooling#__CI_REF__"]
+}

package/templates/secrets.gitignore

@@ -0,0 +1,4 @@
+# Actions secrets, pushed by `ebalzan-ci sync`. Never commit them.
+/.github/secrets.env
+/.github/secrets.*.env
+!/.github/secrets*.env.example

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.