@rahul05ranjan/dhruv-cli 1.3.0 → 1.5.0

package/.github/workflows/ci.yml

@@ -1,53 +1,66 @@
-name: Dhruv CLI CI/CD
+name: Dhruv CLI CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  test:
+    name: Test (${{ matrix.os }}, Node ${{ matrix.node-version }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            node-version: 18.x
+          - os: ubuntu-latest
+            node-version: 20.x
+          - os: ubuntu-latest
+            node-version: 22.x
+            coverage: true
+          - os: macos-latest
+            node-version: 22.x
+          - os: windows-latest
+            node-version: 22.x
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Node.js
+
+      - name: Set up Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@v4
         with:
-          node-version: '20.8.1'
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
       - name: Install dependencies
-        run: npm ci
-      - name: Lint
-        run: npx eslint .
-      - name: Build
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run linter
+        run: npm run lint
+
+      - name: Type checking
+        run: npm run type-check
+
+      - name: Build project
         run: npm run build
-      - name: Test
-        run: npm test || echo "No tests yet"
-      - name: Upload docs to GitHub Pages
-        if: github.ref == 'refs/heads/main'
-        uses: peaceiris/actions-gh-pages@v4
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./docs
-          publish_branch: gh-pages
-      - name: Publish to npm
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        run: |
-          npm config set //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}
-          npm publish --access public
-      - name: Create GitHub Release
-        if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@v2
-        with:
-          files: |
-            dist/**
-            docs/**
-      - name: Release (semantic-release)
-        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+
+      - name: Run unit tests
+        run: npm run test:ci
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: npx semantic-release
+          CI: true
+
+      - name: Upload coverage
+        if: matrix.coverage == true
+        uses: codecov/codecov-action@v4
+        with:
+          file: ./coverage/lcov.info
+          flags: unittests
+          name: codecov-${{ matrix.node-version }}
+          fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}

package/.github/workflows/contribution.yml

@@ -1,51 +1,58 @@
-name: Community Contribution Checks
+name: Pull Request Policy
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened]
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
 
-jobs:
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18.x'
-      - name: Install dependencies
-        run: npm ci
-      - name: Lint
-        run: npx eslint .
+permissions:
+  contents: read
+  pull-requests: write
 
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '18.x'
-      - name: Install dependencies
-        run: npm ci
-      - name: Run tests
-        run: npm test || echo "No tests yet"
-
-  pr-title:
-    if: github.event.pull_request.head.repo.full_name == github.repository
+jobs:
+  validate-pr:
+    name: PR Metadata
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.event.pull_request.draft == false
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - name: Validate PR title
+        uses: amannn/action-semantic-pull-request@v5
         with:
           types: |
             feat
             fix
-            chore
             docs
-            refactor
             style
+            refactor
+            perf
             test
+            build
             ci
-          githubBaseUrl: https://api.github.com
+            chore
+            revert
+          requireScope: false
+          disallowScopes: |
+            release
+          subjectPattern: ^(?![A-Z]).+
+          subjectPatternError: |
+            The subject "{subject}" found in the pull request title "{title}"
+            didn't match the configured pattern. Please ensure that the subject
+            doesn't start with an uppercase character.
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Apply PR size label
+        uses: pascalgn/size-label-action@v0.5.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          sizes: >
+            {
+              "0": "XS",
+              "20": "S",
+              "50": "M",
+              "200": "L",
+              "800": "XL",
+              "2000": "XXL"
+            }

package/.github/workflows/dependabot-auto-merge.yml

@@ -2,18 +2,78 @@ name: Dependabot Auto Merge
 
 on:
   pull_request:
+    branches: [main]
     types:
       - opened
       - synchronize
       - reopened
+      - ready_for_review
+
+permissions:
+  contents: write
+  pull-requests: write
+  checks: read
 
 jobs:
+  auto-approve:
+    name: Auto Approve Dependabot PRs
+    if: github.actor == 'dependabot[bot]' && github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Approve Dependabot PRs
+        uses: hmarr/auto-approve-action@v4
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
   auto-merge:
-    if: github.actor == 'dependabot[bot]'
+    name: Auto Merge Dependabot PRs
+    needs: auto-approve
+    if: github.actor == 'dependabot[bot]' && github.event.pull_request.draft == false
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - name: Enable auto-merge for Dependabot PRs
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Get Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
         uses: peter-evans/enable-pull-request-automerge@v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           merge-method: squash
+
+      - name: Enable auto-merge for minor updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-minor' && contains(steps.metadata.outputs.dependency-names, '@types/')
+        uses: peter-evans/enable-pull-request-automerge@v3
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          merge-method: squash
+
+      - name: Comment on major updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |
+            🚨 **Major Version Update Detected**
+            
+            This PR updates a dependency to a new major version. Please review the changelog and test thoroughly before merging.
+            
+            **Dependency:** ${{ steps.metadata.outputs.dependency-names }}
+            **Update Type:** ${{ steps.metadata.outputs.update-type }}
+            
+            This PR will not be auto-merged and requires manual review.

package/.github/workflows/labeler.yml

@@ -2,6 +2,7 @@ name: Pull Request Labeler
 
 on:
   pull_request:
+    branches: [main]
     types: [opened, synchronize, reopened]
 
 jobs:

package/.github/workflows/release.yml

@@ -0,0 +1,229 @@
+name: Release Management
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      release_type:
+        description: 'Release type (patch, minor, major, prerelease)'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+          - prerelease
+
+permissions:
+  contents: write
+  packages: write
+  pull-requests: write
+  issues: write
+  id-token: write
+
+jobs:
+  pre-release-validation:
+    name: Pre-Release Validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run full test suite
+        run: npm run test:ci
+
+      - name: Build project
+        run: npm run build
+
+      - name: Generate documentation
+        run: npm run docs
+
+      - name: Run security audit
+        run: npm audit --omit=dev --audit-level=high
+
+      - name: Package size check
+        run: |
+          npm pack --dry-run
+          du -sh *.tgz || echo "No package found"
+
+      - name: Validate package contents
+        run: |
+          npm pack
+          tar -tzf *.tgz | head -20
+
+  release:
+    name: Create Release
+    runs-on: ubuntu-latest
+    needs: pre-release-validation
+    timeout-minutes: 15
+    environment: production
+    env:
+      # Authentication uses OIDC with npm 11.5.1+; provenance is an attestation.
+      NPM_CONFIG_PROVENANCE: 'true'
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Build project
+        run: npm run build
+
+      - name: Generate documentation
+        run: npm run docs
+
+      - name: Install npm with trusted publishing support
+        run: npm install --global npm@11.17.0
+
+      - name: Generate changelog
+        run: |
+          npx conventional-changelog-cli -p angular -i CHANGELOG.md -s
+          git add CHANGELOG.md || echo "No changelog changes"
+
+      - name: Create Release PR
+        if: github.event_name == 'workflow_dispatch'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'chore(release): prepare release ${{ github.event.inputs.release_type }}'
+          title: 'chore(release): prepare ${{ github.event.inputs.release_type }} release'
+          body: |
+            ## Release Preparation
+            
+            This PR prepares a ${{ github.event.inputs.release_type }} release.
+            
+            ### Changes included:
+            - Updated version in package.json
+            - Generated changelog
+            - Updated documentation
+            
+            ### Pre-release checklist:
+            - [ ] All tests passing
+            - [ ] Documentation updated
+            - [ ] Security audit clean
+            - [ ] Breaking changes documented
+            
+            **Auto-generated by Release Management workflow**
+          branch: release/prepare-${{ github.event.inputs.release_type }}
+          delete-branch: true
+
+      - name: Release with semantic-release
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx semantic-release
+
+      - name: Manual publish for workflow dispatch
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          # For manual releases, update version first
+          npm version ${{ github.event.inputs.release_type }} --no-git-tag-version
+          npm publish --access public --provenance
+
+      - name: Update GitHub Pages
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./docs
+          publish_branch: gh-pages
+          enable_jekyll: false
+
+      - name: Create GitHub Release
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/**
+            docs/**
+            *.tgz
+          generate_release_notes: true
+          draft: false
+          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
+
+  post-release:
+    name: Post Release Tasks
+    runs-on: ubuntu-latest
+    needs: release
+    if: always() && (needs.release.result == 'success')
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Update repository topics
+        # Best-effort: GITHUB_TOKEN cannot replaceAllTopics without admin.
+        continue-on-error: true
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const packageJson = require('./package.json');
+            const topics = [
+              'cli',
+              'ai',
+              'developer-tools',
+              'ollama',
+              'typescript',
+              `version-${packageJson.version.replace(/\./g, '-')}`
+            ];
+            
+            await github.rest.repos.replaceAllTopics({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              names: topics
+            });
+
+      - name: Notify stakeholders
+        uses: 8398a7/action-slack@v3
+        continue-on-error: true
+        with:
+          status: 'success'
+          channel: '#releases'
+          text: |
+            🎉 New release published!
+            
+            **Repository:** ${{ github.repository }}
+            **Version:** ${{ github.ref_name }}
+            **Release Notes:** ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ github.ref_name }}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}