@rahul05ranjan/dhruv-cli 1.2.4 → 1.4.6

package/.github/workflows/build-publish.yml

@@ -0,0 +1,154 @@
+name: Build & Publish
+
+on:
+  # Automatic main releases are owned by release.yml.
+  workflow_dispatch:
+    inputs:
+      version_type:
+        description: 'Version bump type'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+          - prerelease
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
+jobs:
+  build-and-publish:
+    name: Build and Publish
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment: npm-publish
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install npm with trusted publishing support
+        run: npm install --global npm@11.17.0
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run tests
+        run: npm run test:ci
+
+      - name: Run linting
+        run: npm run lint
+
+      - name: Build project
+        run: npm run build
+
+      - name: Generate documentation
+        run: npm run docs
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "GitHub Actions"
+          git config --global user.email "actions@github.com"
+
+      - name: Check if version needs update
+        id: check_version
+        run: |
+          CURRENT_VERSION=$(node -p "require('./package.json').version")
+          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
+          
+          # Check if this version exists on NPM
+          if npm view @rahul05ranjan/dhruv-cli@$CURRENT_VERSION version 2>/dev/null; then
+            echo "needs_version_bump=true" >> $GITHUB_OUTPUT
+            echo "Version $CURRENT_VERSION already exists on NPM, needs bump"
+          else
+            echo "needs_version_bump=false" >> $GITHUB_OUTPUT
+            echo "Version $CURRENT_VERSION is new, can publish"
+          fi
+
+      - name: Manual version bump
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          npm version ${{ github.event.inputs.version_type }} --no-git-tag-version
+          git add package.json package-lock.json
+          git commit -m "chore: bump version to $(node -p "require('./package.json').version") [skip ci]"
+          git push
+
+      - name: Get final version
+        id: final_version
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "Final version to publish: $VERSION"
+
+      - name: Create Git tag
+        run: |
+          TAG="v${{ steps.final_version.outputs.version }}"
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists, skipping tag creation"
+          else
+            git tag "$TAG"
+            git push origin "$TAG"
+          fi
+
+      - name: Publish to NPM
+        # npm 11.5.1+ uses the workflow's OIDC identity without a stored token.
+        run: |
+          echo "Publishing version ${{ steps.final_version.outputs.version }}"
+          npm publish --access public --tag latest --provenance
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ steps.final_version.outputs.version }}
+          name: Release v${{ steps.final_version.outputs.version }}
+          body: |
+            ## What's Changed
+            
+            Version ${{ steps.final_version.outputs.version }} of dhruv-cli
+            
+            ### Installation
+            ```bash
+            npm install -g @rahul05ranjan/dhruv-cli@${{ steps.final_version.outputs.version }}
+            ```
+            
+            **Full Changelog**: https://github.com/${{ github.repository }}/compare/v${{ steps.check_version.outputs.current_version }}...v${{ steps.final_version.outputs.version }}
+          files: |
+            dist/**
+            docs/api/**
+          draft: false
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Update documentation
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./docs/api
+          publish_branch: gh-pages
+          enable_jekyll: false
+
+      - name: Notify success
+        if: success()
+        run: |
+          echo "✅ Successfully published @rahul05ranjan/dhruv-cli@${{ steps.final_version.outputs.version }}"
+          echo "📦 NPM: https://www.npmjs.com/package/@rahul05ranjan/dhruv-cli"
+          echo "📖 Documentation: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}"
+          echo "🏷️ Release: https://github.com/${{ github.repository }}/releases/tag/v${{ steps.final_version.outputs.version }}"

package/.github/workflows/ci.yml

@@ -2,42 +2,268 @@ name: Dhruv CLI CI/CD
 
 on:
   push:
-    branches: [ main ]
+    branches: [ main, develop ]
   pull_request:
-    branches: [ main ]
+    branches: [ main, develop ]
+  schedule:
+    - cron: '0 2 * * 1' # Weekly security scans
+
+env:
+  NODE_VERSION: '22.14.0'
+  NODE_VERSION_MATRIX: '[18.x, 20.x, 21.x]'
 
 permissions:
   contents: write
+  security-events: write
+  actions: read
+  pull-requests: write
+  id-token: write
+  checks: write
 
 jobs:
+  security:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Full history for better security scanning
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run security audit
+        run: npm audit --audit-level=moderate
+        continue-on-error: true
+
+      - name: Run Semgrep Security Scan
+        uses: semgrep/semgrep-action@v1
+        with:
+          config: auto
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+        continue-on-error: true
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH,MEDIUM'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: 'trivy-results.sarif'
+
+      - name: Run CodeQL Analysis
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+          queries: security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:javascript"
+
+  test:
+    name: Test Suite
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [18.x, 20.x, 21.x]
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        include:
+          - node-version: 20.x
+            coverage: true
+        exclude:
+          - os: windows-latest
+            node-version: 18.x
+          - os: macos-latest
+            node-version: 18.x
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Type checking
+        run: npm run type-check
+
+      - name: Build project
+        run: npm run build
+
+      - name: Run unit tests
+        run: npm run test:ci
+        env:
+          CI: true
+
+      - name: Generate coverage report
+        if: matrix.coverage
+        run: npm run test:coverage
+
+      - name: Upload coverage to Codecov
+        if: matrix.coverage
+        uses: codecov/codecov-action@v4
+        with:
+          file: ./coverage/lcov.info
+          flags: unittests
+          name: codecov-${{ matrix.node-version }}
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+      - name: Upload test results
+        uses: dorny/test-reporter@v1
+        if: always()
+        continue-on-error: true
+        with:
+          name: Test Results (${{ matrix.node-version }})
+          path: coverage/junit.xml
+          reporter: jest-junit
+          fail-on-error: false
+
+  performance:
+    name: Performance Testing
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: github.event_name == 'push' || github.event.pull_request.draft == false
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Build project
+        run: npm run build
+
+      - name: Run Lighthouse CI
+        run: |
+          npm install -g @lhci/cli
+          lhci autorun --config=lighthouserc.json || echo "Lighthouse CI completed with warnings"
+        continue-on-error: true
+
+      - name: Performance benchmark
+        run: |
+          npm install -g autocannon
+          npm run benchmark || echo "Benchmark completed"
+        continue-on-error: true
+
+      - name: Bundle size analysis
+        run: |
+          npm install -g bundlesize
+          bundlesize || echo "Bundle size check completed"
+        continue-on-error: true
+
   build:
+    name: Build & Publish
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    needs: [security, test, performance]
+    if: always() && (needs.security.result == 'success' && needs.test.result == 'success')
+    environment:
+      name: ${{ github.ref == 'refs/heads/main' && 'production' || 'development' }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '20.8.1'
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
+
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit
+
       - name: Lint
-        run: npx eslint .
+        run: npm run lint
+
       - name: Build
         run: npm run build
-      - name: Test
-        run: npm test || echo "No tests yet"
+
+      - name: Generate API documentation
+        run: npm run docs
+
+      - name: Run security checks on build
+        run: |
+          npx audit-ci --config audit-ci.json || echo "Security check completed with warnings"
+        continue-on-error: true
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-artifacts
+          path: |
+            dist/
+            docs/
+          retention-days: 30
+
       - name: Upload docs to GitHub Pages
-        if: github.ref == 'refs/heads/main'
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
         uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs
           publish_branch: gh-pages
-      - name: Publish to npm
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        run: |
-          npm config set //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}
-          npm publish --access public
+          enable_jekyll: false
+
+      - name: Publish package (Dry Run)
+        if: github.event_name == 'pull_request'
+        run: npm publish --dry-run
+
       - name: Create GitHub Release
         if: startsWith(github.ref, 'refs/tags/v')
         uses: softprops/action-gh-release@v2
@@ -45,9 +271,16 @@ jobs:
           files: |
             dist/**
             docs/**
-      - name: Release (semantic-release)
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+          generate_release_notes: true
+          draft: false
+          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
+
+      - name: Notify deployment status
+        if: always() && github.ref == 'refs/heads/main'
+        uses: 8398a7/action-slack@v3
+        continue-on-error: true
+        with:
+          status: ${{ job.status }}
+          channel: '#deployments'
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npx semantic-release
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

package/.github/workflows/contribution.yml

@@ -1,51 +1,193 @@
-name: Community Contribution Checks
+name: Pull Request Validation
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  checks: write
 
 jobs:
-  lint:
+  validate-pr:
+    name: PR Validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.event.pull_request.draft == false
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate PR title
+        uses: amannn/action-semantic-pull-request@v5
+        with:
+          types: |
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            build
+            ci
+            chore
+            revert
+          requireScope: false
+          disallowScopes: |
+            release
+          subjectPattern: ^(?![A-Z]).+$
+          subjectPatternError: |
+            The subject "{subject}" found in the pull request title "{title}"
+            didn't match the configured pattern. Please ensure that the subject
+            doesn't start with an uppercase character.
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check PR size
+        uses: pascalgn/size-label-action@v0.5.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          sizes: >
+            {
+              "0": "XS",
+              "20": "S", 
+              "50": "M",
+              "200": "L",
+              "800": "XL",
+              "2000": "XXL"
+            }
+
+  lint-and-test:
+    name: Quality Checks
     runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: github.event.pull_request.draft == false
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18.x'
+          node-version: '20.8.1'
+          cache: 'npm'
+
       - name: Install dependencies
-        run: npm ci
-      - name: Lint
-        run: npx eslint .
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Type checking
+        run: npm run type-check
+
+      - name: Run tests
+        run: npm run test:ci
+        env:
+          CI: true
+
+      - name: Build project
+        run: npm run build
 
-  test:
+      - name: Check for breaking changes
+        run: |
+          npm run build
+          git diff --exit-code dist/ || (echo "Build artifacts changed, please commit the changes" && exit 1)
+        continue-on-error: true
+
+  security-check:
+    name: Security Validation
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.event.pull_request.draft == false
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '18.x'
+          node-version: '20.8.1'
+          cache: 'npm'
+
       - name: Install dependencies
-        run: npm ci
-      - name: Run tests
-        run: npm test || echo "No tests yet"
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run security audit
+        run: npm audit --audit-level=moderate
+        continue-on-error: true
+
+      - name: Scan for secrets
+        uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          base: ${{ github.event.repository.default_branch }}
+          head: HEAD
+          extra_args: --debug --only-verified
+        continue-on-error: true
 
-  pr-title:
-    if: github.event.pull_request.head.repo.full_name == github.repository
+  documentation:
+    name: Documentation Check
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.event.pull_request.draft == false
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
         with:
-          types: |
-            feat
-            fix
-            chore
-            docs
-            refactor
-            style
-            test
-            ci
-          githubBaseUrl: https://api.github.com
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.8.1'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Generate documentation
+        run: npm run docs
+
+      - name: Check for documentation changes
+        run: |
+          if git diff --quiet HEAD^ HEAD -- '*.md' 'docs/' ; then
+            echo "No documentation changes detected"
+          else
+            echo "Documentation changes detected"
+          fi
+
+  auto-assign:
+    name: Auto Assignment
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    if: github.event.action == 'opened'
+    steps:
+      - name: Auto assign PR
+        uses: kentaro-m/auto-assign-action@v1.2.6
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          configuration-path: .github/auto_assign.yml