@wells-nelson/build-tools 1.1.0 → 1.1.1

package/README.md

@@ -70,6 +70,17 @@ on an origin its own `cachePrefix`: GitHub Pages project sites of one user all s
 
 ## Templates
 
-`templates/deploy-pages.yml` (replace `__REPO__`) and `templates/manifest.webmanifest`.
+Copy them from `node_modules/@wells-nelson/build-tools/templates/` into a new site (see ONBOARDING.md in
+the repository). The workflow templates are a few lines each: triggers, permissions and a call to one of
+the library's reusable workflows (see "Reusable workflows" in the repository README), where the steps live.
+
+- `deploy-pages.yml` → `.github/workflows/deploy.yml` (replace `__REPO__`): type-check, test, build, deploy to
+  Pages, with a version tag reserved before the build and a GitHub release after the deploy.
+- `ci.yml` and `published-packages.yml` → `.github/workflows/` as they are: the pull request check, and the
+  swap from local package tarballs to published versions.
+- `database.yml` → `.github/workflows/` and `supabase-ops/*.sql` → `supabase/ops/` (replace `__SCHEMA__`):
+  nightly encrypted backup with a test restore, keep-alive, security lint and client error digest. The SQL
+  stays in the site, so it can also be pasted into the Supabase SQL editor.
+- `manifest.webmanifest`: for PWAs.
 
 Try the icons, manifest, `basePath` and `postbuild` in the sandbox's Build tools page.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wells-nelson/build-tools",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Build and deployment tooling for Wells Nelson SvelteKit PWAs: postbuild, PWA icon generator, Vite config pieces, service worker, and templates.",
   "license": "MIT",
   "repository": {

package/templates/ci.yml

@@ -0,0 +1,18 @@
+# Template (@wells-nelson/build-tools): copy to .github/workflows/ci.yml as is.
+
+name: CI
+
+# Type-check, unit tests and a production build on every pull request (the shared site-ci.yml).
+# Branch protection requires the check "ci / Check, test and build".
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    uses: bnelson729/wells-nelson-components/.github/workflows/site-ci.yml@main

package/templates/database.yml

@@ -0,0 +1,22 @@
+# Template (@wells-nelson/build-tools): copy to .github/workflows/database.yml and replace __SCHEMA__ with the
+# site's Postgres schema; copy supabase-ops/ to supabase/ops/ too.
+
+name: Database
+
+# Nightly: encrypted backup with a test restore, keep-alive, security lint and client error digest
+# for the __SCHEMA__ schema (the shared site-database.yml, running supabase/ops/). Uses the
+# `database` environment; see CONTRIBUTING.md > Nightly Database workflow.
+
+on:
+  schedule:
+    - cron: '17 6 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  database:
+    uses: bnelson729/wells-nelson-components/.github/workflows/site-database.yml@main
+    with:
+      schema: __SCHEMA__

package/templates/deploy-pages.yml

@@ -1,52 +1,35 @@
-# GitHub Pages deploy for a SvelteKit adapter-static app.
-# Copy to .github/workflows/deploy.yml and replace __REPO__ with the repository name.
+# Template (@wells-nelson/build-tools): copy to .github/workflows/deploy.yml and replace __REPO__ with the
+# repository name (the GitHub Pages project path).
+
 name: Deploy to GitHub Pages
 
+# Every merge to main deploys and releases a new version (the shared site-deploy.yml). Run it by
+# hand to bump the minor or major version. Reads the repository variables SUPABASE_URL,
+# SUPABASE_ANON_KEY and, for a custom domain, BASE_PATH.
+
 on:
   push:
     branches: [main]
   workflow_dispatch:
+    inputs:
+      increment:
+        description: Which part of the version to bump
+        type: choice
+        options: [patch, minor, major]
+        default: patch
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
+# One deploy at a time; a newer push waits for the running one instead of cancelling it halfway.
 concurrency:
   group: pages
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          cache: npm
-      - run: npm ci
-      # Nothing ships unless it type-checks and its tests pass.
-      - run: npm run check --if-present
-      - run: npm test --if-present
-      - run: npm run build
-        env:
-          # Repository variables (Settings > Secrets and variables > Actions > Variables).
-          # Leave the Supabase ones unset to deploy a local-only build.
-          VITE_SUPABASE_URL: ${{ vars.SUPABASE_URL }}
-          VITE_SUPABASE_ANON_KEY: ${{ vars.SUPABASE_ANON_KEY }}
-          # "/__REPO__" for <user>.github.io/__REPO__; set BASE_PATH to "/" for a custom domain.
-          BASE_PATH: ${{ vars.BASE_PATH || '/__REPO__' }}
-      - uses: actions/upload-pages-artifact@v3
-        with:
-          path: build
-
   deploy:
-    needs: build
-    runs-on: ubuntu-latest
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    steps:
-      - id: deployment
-        uses: actions/deploy-pages@v4
+    uses: bnelson729/wells-nelson-components/.github/workflows/site-deploy.yml@main
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
+    with:
+      base-path: /__REPO__
+      increment: ${{ inputs.increment || 'patch' }}

package/templates/published-packages.yml

@@ -0,0 +1,21 @@
+# Template (@wells-nelson/build-tools): copy to .github/workflows/published-packages.yml as is.
+
+name: Use published packages
+
+# While a shared @wells-nelson package is tried out, package.json points at a local tarball. On a
+# pull request this swaps them for the published versions, commits the result to the branch and
+# runs CI again (the shared site-published-packages.yml).
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - package.json
+      - package-lock.json
+
+jobs:
+  packages:
+    uses: bnelson729/wells-nelson-components/.github/workflows/site-published-packages.yml@main
+    permissions:
+      contents: write
+      actions: write

package/templates/supabase-ops/client-errors.sql

@@ -0,0 +1,9 @@
+-- Template (@wells-nelson/build-tools): copy to supabase/ops/client-errors.sql and replace __SCHEMA__ with the app's schema.
+-- What the app reported in the last 24 hours, most frequent first:
+-- count, kind, newest version, message.
+select count(*), kind, max(version), left(replace(message, '|', '/'), 200)
+from __SCHEMA__.client_errors
+where created_at > now() - interval '24 hours'
+group by kind, message
+order by count(*) desc
+limit 25;

package/templates/supabase-ops/row-counts.sql

@@ -0,0 +1,10 @@
+-- Template (@wells-nelson/build-tools): copy to supabase/ops/row-counts.sql and replace __SCHEMA__ with the app's schema.
+-- One line per table of the __SCHEMA__ schema: "<table> <rows>". The Database
+-- workflow compares these before and after a test restore. client_errors is left out: it's a
+-- log that changes while the backup runs. psql only (\gexec); the Supabase SQL editor can't run it.
+select format('select %L || '' '' || count(*) from %I.%I', c.relname, n.nspname, c.relname)
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = '__SCHEMA__' and c.relkind in ('r', 'p') and c.relname <> 'client_errors'
+order by c.relname
+\gexec

package/templates/supabase-ops/scratch-stub.sql

@@ -0,0 +1,20 @@
+-- Template (@wells-nelson/build-tools): copy to supabase/ops/scratch-stub.sql and replace __SCHEMA__ with the app's schema.
+-- The parts of a Supabase database that the app's schema refers to, so its backup can be
+-- restored into a plain Postgres (the Database workflow's restore test, or a local check).
+-- Not for a Supabase project: those have all of this already.
+create role anon nologin;
+create role authenticated nologin;
+create role service_role nologin;
+create role supabase_admin nologin;
+
+create schema auth;
+create table auth.users (
+  id uuid primary key,
+  email text,
+  email_confirmed_at timestamptz,
+  last_sign_in_at timestamptz
+);
+create function auth.uid() returns uuid language sql stable as $$ select null::uuid $$;
+create function auth.jwt() returns jsonb language sql stable as $$ select '{}'::jsonb $$;
+
+create publication supabase_realtime;

package/templates/supabase-ops/security-lint.sql

@@ -0,0 +1,40 @@
+-- Template (@wells-nelson/build-tools): copy to supabase/ops/security-lint.sql and replace __SCHEMA__ with the app's schema.
+-- Prints one line per problem in the __SCHEMA__ schema; no output means it passed. Runs in the
+-- Supabase SQL editor or with psql -f.
+-- Run by the Database workflow every night, and worth running after applying a migration.
+
+-- Every table has row level security.
+select format('Table %I.%I has no row level security', n.nspname, c.relname)
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = '__SCHEMA__' and c.relkind in ('r', 'p') and not c.relrowsecurity
+
+union all
+
+-- Signed-out callers (anon) can't touch any table.
+select format('anon has %s on table %I.%I', p.privilege, n.nspname, c.relname)
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+cross join unnest(array['SELECT', 'INSERT', 'UPDATE', 'DELETE']) as p(privilege)
+where n.nspname = '__SCHEMA__' and c.relkind in ('r', 'p', 'v') and has_table_privilege('anon', c.oid, p.privilege)
+
+union all
+
+-- ... nor call any function but report_client_error (trigger functions can't be called).
+select format('anon can execute %s', p.oid::regprocedure)
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = '__SCHEMA__'
+  and p.prorettype <> 'trigger'::regtype
+  and p.proname <> 'report_client_error'
+  and has_function_privilege('anon', p.oid, 'EXECUTE')
+
+union all
+
+-- Security definer functions pin their search_path.
+select format('Security definer function %s has no search_path', p.oid::regprocedure)
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = '__SCHEMA__'
+  and p.prosecdef
+  and not exists (select 1 from unnest(coalesce(p.proconfig, '{}')) as c(setting) where c.setting like 'search_path=%');