@sasjs/sas-language 0.1.0 → 0.1.1

package/README.md

@@ -21,17 +21,17 @@ something cheap to load, and keep it current with a scheduled job.
 npm install @sasjs/sas-language
 ```
 
-Until the package is on the registry it can be taken from git, pinned to a
-commit:
+The registry tarball ships the compiled output, so nothing is built on install.
+
+A git install also works, but needs lifecycle scripts enabled, because the build
+output is not committed and `prepare` compiles it:
 
 ```
 npm install git+https://github.com/sasjs/sas-language.git#<commit>
 ```
 
-That works because `dist/` is committed, not built on install. It has to be: a
-consumer that sets `ignore-scripts=true` - as sasjs/server does - never runs the
-package's `prepare` script, so a git install would otherwise arrive with no
-compiled API at all.
+Note that npm rewrites a github git dependency to an ssh URL in the lockfile,
+which a CI without an ssh key cannot fetch, so prefer the registry.
 
 ## Use
 
@@ -116,6 +116,47 @@ not degrade somebody's editor.
     npm run build     # transform into data/ and compile
     npm test          # validate the data and the transforms
 
+## Repository hardening
+
+`.npmrc` installs without running lifecycle scripts, writes exact versions, enforces the `engines` field, and keeps the lockfile honest.
+
+`.git-hooks/` carries the org's checks: a `pre-commit` that scans the staged diff with gitleaks and refuses a commit over 2MB, and a `commit-msg` that enforces Conventional Commits. `npm run prepare` wires them up, but `.npmrc` sets `ignore-scripts=true`, which suppresses it - so after a fresh clone:
+
+```
+git config core.hooksPath ./.git-hooks
+```
+
+A hook is best-effort, so CI enforces the same things from the other side: a full-history `gitleaks detect`, `npm audit --omit=dev --audit-level=low` for the shipped surface, and `npm run audit` for everything else, dev dependencies included. That last one fails on any advisory outside two documented exemptions - see `scripts/audit.mjs` - so a new advisory anywhere else cannot land quietly.
+
+## Releasing
+
+`.github/workflows/publish.yml` publishes on every push to `main`.
+
+Versioning is semantic-release's job: it reads the conventional commits since the
+last tag, bumps the version, tags the release and writes the release notes.
+Publishing is a separate step, and it uses the npm trusted publisher, so no token
+is stored anywhere.
+
+Setup, once: on npmjs.com, add a trusted publisher for `@sasjs/sas-language` -
+repository `sasjs/sas-language`, workflow `publish.yml`, environment blank.
+
+semantic-release is configured **not** to push to `main`: `@semantic-release/git`
+is deliberately absent, so the version commit is never made and nothing needs to
+bypass branch protection. The release notes and the semantic versioning are
+unaffected - `@semantic-release/github` still publishes the grouped notes as the
+release body, and `@semantic-release/commit-analyzer` still maps `fix:` to a
+patch, `feat:` to a minor and a breaking change to a major. The one consequence
+is that `package.json` on `main` keeps the last committed version rather than the
+released one.
+
+Which commits cut a release follows the usual convention: `fix:` and `feat:` on
+`main` do, `chore:` and `ci:` do not. The refresh workflow opens a pull request,
+so merging it with a `fix:` or `feat:` subject is what cuts the next release.
+
+The publish step asks the registry first, so a push that produces no release
+reports that the version is already published and stays green, rather than
+failing with E403.
+
 ## Licence
 
 The package is MIT. The data is derived from the SAS extension for Visual Studio

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sasjs/sas-language",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "SAS language data for editors: completions, hover documentation and signatures, resolved from the SAS extension for VS Code",
   "license": "MIT",
   "type": "module",
@@ -25,6 +25,26 @@
     "README.md"
   ],
   "sideEffects": false,
+  "overrides": {
+    "ip-address": "^10.5.1",
+    "undici": "^6.28.1"
+  },
+  "release": {
+    "branches": [
+      "main"
+    ],
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      [
+        "@semantic-release/exec",
+        {
+          "prepareCmd": "npm version ${nextRelease.version} --no-git-tag-version"
+        }
+      ],
+      "@semantic-release/github"
+    ]
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -38,14 +58,19 @@
     "build:ts": "tsc -p ./tsconfig.json",
     "build": "npm run build:data && npm run build:ts",
     "refresh": "npm run fetch && npm run build:data",
-    "prepare": "npm run build:ts",
-    "test": "node --test ./test/*.test.mjs",
+    "audit": "node ./scripts/audit.mjs",
+    "prepare": "npm run build:ts && (git rev-parse --git-dir >/dev/null 2>&1 && git config core.hooksPath ./.git-hooks || true)",
+    "prepack": "npm run build:ts",
+    "test": "npm run build:ts && node --test ./test/*.test.mjs",
     "lint": "prettier --check .",
     "lint:fix": "prettier --write ."
   },
   "devDependencies": {
-    "prettier": "^3.9.0",
-    "typescript": "^5.6.0"
+    "@nogoo9/gitleaks": "8.30.1-post.2",
+    "@semantic-release/exec": "7.1.0",
+    "prettier": "3.9.9",
+    "semantic-release": "25.0.9",
+    "typescript": "5.9.3"
   },
   "engines": {
     "node": ">=20"