@vixoniccom/bitly-news-internal 0.0.3-dev.2 → 0.0.3

package/.github/workflows/release.yml

@@ -1,30 +1,26 @@
-name: Publish to NPM on Release
+name: Publish to NPM
 
 on:
-  workflow_dispatch:
-  push:
+  pull_request:
     branches:
       - development
+      - master
+      - main
+  workflow_dispatch:
 
 jobs:
   publish:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
-
-      - name: Configure git
-        run: |
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
+          persist-credentials: false
 
       - name: Setup Node.js 20
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
@@ -37,7 +33,7 @@ jobs:
           echo "registry=https://registry.npmjs.org/" >> ~/.npmrc
 
       - name: Cache node modules
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -49,8 +45,18 @@ jobs:
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Configure Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Create release version
+        run: npm run release
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
       - name: Build package
-        run: npm run prepublish
+        run: npm run prepublishOnly
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
@@ -63,20 +69,41 @@ jobs:
           echo "✅ build.zip found successfully"
           ls -la build.zip
 
-      - name: Bump version and create release
+      - name: Check if version already exists on npm
+        id: check-version
+        run: |
+          PACKAGE_NAME=$(node -p "require('./package.json').name")
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+
+          echo "Checking if $PACKAGE_NAME@$PACKAGE_VERSION exists on npm..."
+
+          if npm view "$PACKAGE_NAME@$PACKAGE_VERSION" version 2>/dev/null; then
+            echo "version-exists=true" >> $GITHUB_OUTPUT
+            echo "⚠️  Version $PACKAGE_VERSION already exists on npm"
+          else
+            echo "version-exists=false" >> $GITHUB_OUTPUT
+            echo "✅ Version $PACKAGE_VERSION does not exist on npm - ready to publish"
+          fi
+
+      - name: Publish to npm
+        if: steps.check-version.outputs.version-exists == 'false'
         run: |
-          echo "🔄 Running release..."
-          npm run release
-          git push --follow-tags
+          echo "Publishing to npm..."
+          npm publish --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-      - name: Publish to npm
+      - name: Publication success
+        if: steps.check-version.outputs.version-exists == 'false'
         run: |
           PACKAGE_NAME=$(node -p "require('./package.json').name")
           PACKAGE_VERSION=$(node -p "require('./package.json').version")
-          echo "📦 Publishing $PACKAGE_NAME@$PACKAGE_VERSION to npm..."
-          npm publish --access public
           echo "🎉 Successfully published $PACKAGE_NAME@$PACKAGE_VERSION to npm!"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          echo "📦 Package includes build.zip with the compiled application"
+
+      - name: Skip publication
+        if: steps.check-version.outputs.version-exists == 'true'
+        run: |
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          echo "⏭️  Skipping publication - version $PACKAGE_VERSION already exists on npm"
+          echo "💡 To publish a new version, update the version in package.json or run 'npm run release'"

package/.github/workflows/sonarqube.yml

@@ -11,19 +11,20 @@ jobs:
   sonarqube:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           # Disabling shallow clone is recommended for improving relevancy of reporting.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: SonarQube Scan
-        uses: sonarsource/sonarqube-scan-action@master
+        uses: sonarsource/sonarqube-scan-action@299e4b793aaa83bf2aba7c9c14bedbb485688ec4 # v7.1.0
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
       
       - name: SonarQube Quality Gate Check
-        uses: sonarsource/sonarqube-quality-gate-action@master
+        uses: sonarsource/sonarqube-quality-gate-action@cf038b0e0cdecfa9e56c198bbb7d21d751d62c3b # v1.2.0
         timeout-minutes: 5
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.3](https://github.com/Vixonic/store-bitly-news-internal/compare/v0.0.3-dev.2...v0.0.3) (2026-09-17)
+
+
+### Bug Fixes
+
+* **ci:** call the build script that actually exists in the release workflow ([8dadef7](https://github.com/Vixonic/store-bitly-news-internal/commit/8dadef7cd505babfbf5f55755a12a3bc594feaee))
+* **ci:** pin 3rd party GitHub Actions and harden checkout credentials ([42208c9](https://github.com/Vixonic/store-bitly-news-internal/commit/42208c9135ccbebdab8bb928ebdcc0e43c367384))
+* remove react-quill dependency from package.json and package-lock.json ([1b4848f](https://github.com/Vixonic/store-bitly-news-internal/commit/1b4848f3d860683e9c0934c0310f1424b7b822cf))
+* updated release ([55255ce](https://github.com/Vixonic/store-bitly-news-internal/commit/55255ce0c930b0b44fb1094d81a6065e4f7ea9a0))
+* VXD-820  address SonarQube suggestions ([2fe070a](https://github.com/Vixonic/store-bitly-news-internal/commit/2fe070a84abc771ed076e7b2d20b710d5c3cc027))
+* VXD-820 Update release workflow to handle version checks and streamline npm publishing ([bd8c6f9](https://github.com/Vixonic/store-bitly-news-internal/commit/bd8c6f92a7b57be8f0fdad11db883971c24751e6))
+
 ### [0.0.3-dev.2](https://github.com/Vixonic/store-bitly-news-internal/compare/v0.0.3-dev.1...v0.0.3-dev.2) (2026-01-21)
 
 

package/package.json

@@ -8,7 +8,7 @@
   "author": {
     "name": ""
   },
-  "version": "0.0.3-dev.2",
+  "version": "0.0.3",
   "scripts": {
     "prepublishOnly": "vixonic-module-packager --mode=build",
     "watch": "vixonic-module-packager --mode=watch",
@@ -25,7 +25,6 @@
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-qr-code": "^2.0.2",
-    "react-quill": "^1.3.5",
     "react-transition-group": "^4.4.2",
     "uuid": "^8.3.2"
   },