create-raredays-app 0.1.5 → 0.1.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/bin/index.js +10 -51
- package/package.json +1 -1
- package/templates/client/_github/actions/setup/action.yml +37 -0
- package/templates/client/_github/workflows/ci.yml +21 -28
- package/templates/client/_github/workflows/coverage.yml +3 -4
- package/templates/client/_github/workflows/security.yml +3 -4
- package/templates/full-stack/_github/actions/setup/action.yml +37 -0
- package/templates/full-stack/_github/workflows/ci.yml +21 -28
- package/templates/full-stack/_github/workflows/coverage.yml +3 -4
- package/templates/full-stack/_github/workflows/db-check.yml +2 -5
- package/templates/full-stack/_github/workflows/db-migrate.yml +2 -5
- package/templates/full-stack/_github/workflows/security.yml +3 -4
- package/templates/static/_github/actions/setup/action.yml +37 -0
- package/templates/static/_github/workflows/ci.yml +18 -24
- package/templates/static/_github/workflows/security.yml +3 -4
package/README.md
CHANGED
|
@@ -49,7 +49,7 @@ Presets set the template, modules, and brand color. You can still customise disp
|
|
|
49
49
|
## What it does
|
|
50
50
|
|
|
51
51
|
1. Copies `templates/<name>/` into the target directory.
|
|
52
|
-
2. Renames stub files (`_gitignore` -> `.gitignore`, `
|
|
52
|
+
2. Renames stub files (`_gitignore` -> `.gitignore`, `_github` -> `.github`).
|
|
53
53
|
3. Sets `package.json:name` to the project slug.
|
|
54
54
|
4. Substitutes `__SLUG__` in `site.spec.ts` and applies display name, domain, and brand color.
|
|
55
55
|
5. Loads scaffold fragments for selected modules (imports, config, ports, file overlays).
|
package/bin/index.js
CHANGED
|
@@ -110,8 +110,7 @@ Options:
|
|
|
110
110
|
config file pointing at the local install.
|
|
111
111
|
--deploy <target> Scaffold deploy config for a target host.
|
|
112
112
|
One of: vercel, none (default).
|
|
113
|
-
Writes vercel.json, .env.example, docs/DEPLOY.md
|
|
114
|
-
(full-stack only) .github/workflows/deploy-migrations.yml.
|
|
113
|
+
Writes vercel.json, .env.example, and docs/DEPLOY.md.
|
|
115
114
|
-h, --help Show this help
|
|
116
115
|
|
|
117
116
|
Presets:
|
|
@@ -724,14 +723,12 @@ async function applyDeploy(targetDir, opts) {
|
|
|
724
723
|
if (!existsSync(docsDir)) await mkdir(docsDir, { recursive: true });
|
|
725
724
|
await writeFile(resolve(docsDir, "DEPLOY.md"), buildDeployMd(opts));
|
|
726
725
|
|
|
727
|
-
//
|
|
728
|
-
|
|
729
|
-
|
|
730
|
-
|
|
731
|
-
await writeFile(resolve(workflowsDir, "deploy-migrations.yml"), buildMigrationsWorkflow());
|
|
732
|
-
}
|
|
726
|
+
// The full-stack template already ships .github/workflows/db-migrate.yml
|
|
727
|
+
// (production migrate on push to main, path-filtered, with a concurrency
|
|
728
|
+
// lock). We must NOT generate a second deploy-migrations.yml — that would run
|
|
729
|
+
// prod migrations twice and drift on Node/pnpm versions. See docs/DEPLOY.md.
|
|
733
730
|
|
|
734
|
-
//
|
|
731
|
+
// 4. scripts/setup-vercel.sh — interactive linker.
|
|
735
732
|
const scriptsDir = resolve(targetDir, "scripts");
|
|
736
733
|
if (!existsSync(scriptsDir)) await mkdir(scriptsDir, { recursive: true });
|
|
737
734
|
const scriptPath = resolve(scriptsDir, "setup-vercel.sh");
|
|
@@ -739,7 +736,7 @@ async function applyDeploy(targetDir, opts) {
|
|
|
739
736
|
const { chmod } = await import("node:fs/promises");
|
|
740
737
|
await chmod(scriptPath, 0o755);
|
|
741
738
|
|
|
742
|
-
//
|
|
739
|
+
// 5. Return the extra env-vars deploy implies.
|
|
743
740
|
const extra = [];
|
|
744
741
|
if (isFullStack) extra.push("DATABASE_URL");
|
|
745
742
|
for (const m of opts.selectedModules ?? []) {
|
|
@@ -772,8 +769,9 @@ pairs well with Vercel.
|
|
|
772
769
|
? `
|
|
773
770
|
## 6. Run migrations
|
|
774
771
|
|
|
775
|
-
The
|
|
776
|
-
runs \`pnpm db:migrate\` on push to \`main
|
|
772
|
+
The full-stack template ships a workflow at \`.github/workflows/db-migrate.yml\`
|
|
773
|
+
that runs \`pnpm db:migrate\` on push to \`main\` when files under
|
|
774
|
+
\`db/migrations/**\` change, gated behind the \`production\` environment.
|
|
777
775
|
|
|
778
776
|
To enable it:
|
|
779
777
|
|
|
@@ -864,45 +862,6 @@ This app is plain Next.js — it'll also run on:
|
|
|
864
862
|
`;
|
|
865
863
|
}
|
|
866
864
|
|
|
867
|
-
function buildMigrationsWorkflow() {
|
|
868
|
-
return `# Runs database migrations against the production database after a manual
|
|
869
|
-
# approval. Requires a GitHub Environment named "production" with DATABASE_URL
|
|
870
|
-
# as a secret and a required reviewer.
|
|
871
|
-
#
|
|
872
|
-
# See docs/DEPLOY.md for setup instructions.
|
|
873
|
-
name: Deploy migrations
|
|
874
|
-
|
|
875
|
-
on:
|
|
876
|
-
push:
|
|
877
|
-
branches: [main]
|
|
878
|
-
workflow_dispatch:
|
|
879
|
-
|
|
880
|
-
jobs:
|
|
881
|
-
migrate:
|
|
882
|
-
name: Apply pending migrations
|
|
883
|
-
runs-on: ubuntu-latest
|
|
884
|
-
environment: production
|
|
885
|
-
steps:
|
|
886
|
-
- uses: actions/checkout@v4
|
|
887
|
-
|
|
888
|
-
- uses: pnpm/action-setup@v4
|
|
889
|
-
with:
|
|
890
|
-
version: 9
|
|
891
|
-
|
|
892
|
-
- uses: actions/setup-node@v4
|
|
893
|
-
with:
|
|
894
|
-
node-version: 20
|
|
895
|
-
cache: pnpm
|
|
896
|
-
|
|
897
|
-
- run: pnpm install --frozen-lockfile
|
|
898
|
-
|
|
899
|
-
- name: Run migrations
|
|
900
|
-
env:
|
|
901
|
-
DATABASE_URL: \${{ secrets.DATABASE_URL }}
|
|
902
|
-
run: pnpm db:migrate
|
|
903
|
-
`;
|
|
904
|
-
}
|
|
905
|
-
|
|
906
865
|
function buildSetupVercelScript() {
|
|
907
866
|
return `#!/usr/bin/env bash
|
|
908
867
|
# Interactive helper: links this repo to a new Vercel project.
|
package/package.json
CHANGED
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
name: Setup
|
|
2
|
+
description: >-
|
|
3
|
+
Install pnpm and Node, authenticate to the private @raredays npm registry, then
|
|
4
|
+
install dependencies. The @raredays/* packages are published with restricted
|
|
5
|
+
access, so the registry token must be present before install. pnpm ignores
|
|
6
|
+
${VAR} interpolation in a committed project .npmrc (it could leak the token to
|
|
7
|
+
an attacker-controlled registry), so the token is written to the user-level
|
|
8
|
+
~/.npmrc at runtime instead.
|
|
9
|
+
|
|
10
|
+
inputs:
|
|
11
|
+
node-auth-token:
|
|
12
|
+
description: >-
|
|
13
|
+
npm token with read access to the private @raredays registry. Pass it from
|
|
14
|
+
the NODE_AUTH_TOKEN repository secret.
|
|
15
|
+
required: true
|
|
16
|
+
|
|
17
|
+
runs:
|
|
18
|
+
using: composite
|
|
19
|
+
steps:
|
|
20
|
+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
|
|
21
|
+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
22
|
+
with:
|
|
23
|
+
node-version: 24
|
|
24
|
+
cache: pnpm
|
|
25
|
+
- name: Authenticate to the npm registry
|
|
26
|
+
shell: bash
|
|
27
|
+
env:
|
|
28
|
+
NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}
|
|
29
|
+
run: |
|
|
30
|
+
if [ -z "$NODE_AUTH_TOKEN" ]; then
|
|
31
|
+
echo "::error::NODE_AUTH_TOKEN is empty. Add a repository secret with an npm token that has read access to the private @raredays registry."
|
|
32
|
+
exit 1
|
|
33
|
+
fi
|
|
34
|
+
echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
|
|
35
|
+
- name: Install dependencies
|
|
36
|
+
shell: bash
|
|
37
|
+
run: pnpm install --frozen-lockfile
|
|
@@ -26,10 +26,9 @@ jobs:
|
|
|
26
26
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
27
27
|
with:
|
|
28
28
|
persist-credentials: false
|
|
29
|
-
- uses:
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
- run: pnpm install --frozen-lockfile
|
|
29
|
+
- uses: ./.github/actions/setup
|
|
30
|
+
with:
|
|
31
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
33
32
|
- run: pnpm lint
|
|
34
33
|
|
|
35
34
|
format-check:
|
|
@@ -40,10 +39,9 @@ jobs:
|
|
|
40
39
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
41
40
|
with:
|
|
42
41
|
persist-credentials: false
|
|
43
|
-
- uses:
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
- run: pnpm install --frozen-lockfile
|
|
42
|
+
- uses: ./.github/actions/setup
|
|
43
|
+
with:
|
|
44
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
47
45
|
- run: pnpm format:check
|
|
48
46
|
|
|
49
47
|
style:
|
|
@@ -54,10 +52,9 @@ jobs:
|
|
|
54
52
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
55
53
|
with:
|
|
56
54
|
persist-credentials: false
|
|
57
|
-
- uses:
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
- run: pnpm install --frozen-lockfile
|
|
55
|
+
- uses: ./.github/actions/setup
|
|
56
|
+
with:
|
|
57
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
61
58
|
- run: pnpm style
|
|
62
59
|
|
|
63
60
|
typecheck:
|
|
@@ -68,10 +65,9 @@ jobs:
|
|
|
68
65
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
69
66
|
with:
|
|
70
67
|
persist-credentials: false
|
|
71
|
-
- uses:
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
- run: pnpm install --frozen-lockfile
|
|
68
|
+
- uses: ./.github/actions/setup
|
|
69
|
+
with:
|
|
70
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
75
71
|
- run: pnpm theme:build
|
|
76
72
|
- run: pnpm typecheck
|
|
77
73
|
|
|
@@ -83,10 +79,9 @@ jobs:
|
|
|
83
79
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
84
80
|
with:
|
|
85
81
|
persist-credentials: false
|
|
86
|
-
- uses:
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
- run: pnpm install --frozen-lockfile
|
|
82
|
+
- uses: ./.github/actions/setup
|
|
83
|
+
with:
|
|
84
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
90
85
|
- run: pnpm theme:build
|
|
91
86
|
- run: pnpm test
|
|
92
87
|
|
|
@@ -98,10 +93,9 @@ jobs:
|
|
|
98
93
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
99
94
|
with:
|
|
100
95
|
persist-credentials: false
|
|
101
|
-
- uses:
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
- run: pnpm install --frozen-lockfile
|
|
96
|
+
- uses: ./.github/actions/setup
|
|
97
|
+
with:
|
|
98
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
105
99
|
- run: pnpm build
|
|
106
100
|
|
|
107
101
|
storybook:
|
|
@@ -112,10 +106,9 @@ jobs:
|
|
|
112
106
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
113
107
|
with:
|
|
114
108
|
persist-credentials: false
|
|
115
|
-
- uses:
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
- run: pnpm install --frozen-lockfile
|
|
109
|
+
- uses: ./.github/actions/setup
|
|
110
|
+
with:
|
|
111
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
119
112
|
- run: pnpm theme:build
|
|
120
113
|
- run: pnpm storybook:build
|
|
121
114
|
|
|
@@ -26,10 +26,9 @@ jobs:
|
|
|
26
26
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
27
27
|
with:
|
|
28
28
|
persist-credentials: false
|
|
29
|
-
- uses:
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
- run: pnpm install --frozen-lockfile
|
|
29
|
+
- uses: ./.github/actions/setup
|
|
30
|
+
with:
|
|
31
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
33
32
|
- run: pnpm theme:build
|
|
34
33
|
- run: pnpm coverage
|
|
35
34
|
- name: Upload coverage report
|
|
@@ -26,9 +26,8 @@ jobs:
|
|
|
26
26
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
27
27
|
with:
|
|
28
28
|
persist-credentials: false
|
|
29
|
-
- uses:
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
- run: pnpm install --frozen-lockfile
|
|
29
|
+
- uses: ./.github/actions/setup
|
|
30
|
+
with:
|
|
31
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
33
32
|
- name: Audit production dependencies
|
|
34
33
|
run: pnpm audit --audit-level=high --prod
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
name: Setup
|
|
2
|
+
description: >-
|
|
3
|
+
Install pnpm and Node, authenticate to the private @raredays npm registry, then
|
|
4
|
+
install dependencies. The @raredays/* packages are published with restricted
|
|
5
|
+
access, so the registry token must be present before install. pnpm ignores
|
|
6
|
+
${VAR} interpolation in a committed project .npmrc (it could leak the token to
|
|
7
|
+
an attacker-controlled registry), so the token is written to the user-level
|
|
8
|
+
~/.npmrc at runtime instead.
|
|
9
|
+
|
|
10
|
+
inputs:
|
|
11
|
+
node-auth-token:
|
|
12
|
+
description: >-
|
|
13
|
+
npm token with read access to the private @raredays registry. Pass it from
|
|
14
|
+
the NODE_AUTH_TOKEN repository secret.
|
|
15
|
+
required: true
|
|
16
|
+
|
|
17
|
+
runs:
|
|
18
|
+
using: composite
|
|
19
|
+
steps:
|
|
20
|
+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
|
|
21
|
+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
22
|
+
with:
|
|
23
|
+
node-version: 24
|
|
24
|
+
cache: pnpm
|
|
25
|
+
- name: Authenticate to the npm registry
|
|
26
|
+
shell: bash
|
|
27
|
+
env:
|
|
28
|
+
NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}
|
|
29
|
+
run: |
|
|
30
|
+
if [ -z "$NODE_AUTH_TOKEN" ]; then
|
|
31
|
+
echo "::error::NODE_AUTH_TOKEN is empty. Add a repository secret with an npm token that has read access to the private @raredays registry."
|
|
32
|
+
exit 1
|
|
33
|
+
fi
|
|
34
|
+
echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
|
|
35
|
+
- name: Install dependencies
|
|
36
|
+
shell: bash
|
|
37
|
+
run: pnpm install --frozen-lockfile
|
|
@@ -30,10 +30,9 @@ jobs:
|
|
|
30
30
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
31
31
|
with:
|
|
32
32
|
persist-credentials: false
|
|
33
|
-
- uses:
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
- run: pnpm install --frozen-lockfile
|
|
33
|
+
- uses: ./.github/actions/setup
|
|
34
|
+
with:
|
|
35
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
37
36
|
- run: pnpm lint
|
|
38
37
|
|
|
39
38
|
format-check:
|
|
@@ -44,10 +43,9 @@ jobs:
|
|
|
44
43
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
45
44
|
with:
|
|
46
45
|
persist-credentials: false
|
|
47
|
-
- uses:
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
- run: pnpm install --frozen-lockfile
|
|
46
|
+
- uses: ./.github/actions/setup
|
|
47
|
+
with:
|
|
48
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
51
49
|
- run: pnpm format:check
|
|
52
50
|
|
|
53
51
|
style:
|
|
@@ -58,10 +56,9 @@ jobs:
|
|
|
58
56
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
59
57
|
with:
|
|
60
58
|
persist-credentials: false
|
|
61
|
-
- uses:
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
- run: pnpm install --frozen-lockfile
|
|
59
|
+
- uses: ./.github/actions/setup
|
|
60
|
+
with:
|
|
61
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
65
62
|
- run: pnpm style
|
|
66
63
|
|
|
67
64
|
typecheck:
|
|
@@ -72,10 +69,9 @@ jobs:
|
|
|
72
69
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
73
70
|
with:
|
|
74
71
|
persist-credentials: false
|
|
75
|
-
- uses:
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
- run: pnpm install --frozen-lockfile
|
|
72
|
+
- uses: ./.github/actions/setup
|
|
73
|
+
with:
|
|
74
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
79
75
|
- run: pnpm theme:build
|
|
80
76
|
- run: pnpm typecheck
|
|
81
77
|
|
|
@@ -87,10 +83,9 @@ jobs:
|
|
|
87
83
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
88
84
|
with:
|
|
89
85
|
persist-credentials: false
|
|
90
|
-
- uses:
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
- run: pnpm install --frozen-lockfile
|
|
86
|
+
- uses: ./.github/actions/setup
|
|
87
|
+
with:
|
|
88
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
94
89
|
- run: pnpm theme:build
|
|
95
90
|
- run: pnpm test
|
|
96
91
|
|
|
@@ -102,10 +97,9 @@ jobs:
|
|
|
102
97
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
103
98
|
with:
|
|
104
99
|
persist-credentials: false
|
|
105
|
-
- uses:
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
- run: pnpm install --frozen-lockfile
|
|
100
|
+
- uses: ./.github/actions/setup
|
|
101
|
+
with:
|
|
102
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
109
103
|
- run: pnpm build
|
|
110
104
|
|
|
111
105
|
storybook:
|
|
@@ -116,10 +110,9 @@ jobs:
|
|
|
116
110
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
117
111
|
with:
|
|
118
112
|
persist-credentials: false
|
|
119
|
-
- uses:
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
- run: pnpm install --frozen-lockfile
|
|
113
|
+
- uses: ./.github/actions/setup
|
|
114
|
+
with:
|
|
115
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
123
116
|
- run: pnpm theme:build
|
|
124
117
|
- run: pnpm storybook:build
|
|
125
118
|
|
|
@@ -26,10 +26,9 @@ jobs:
|
|
|
26
26
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
27
27
|
with:
|
|
28
28
|
persist-credentials: false
|
|
29
|
-
- uses:
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
- run: pnpm install --frozen-lockfile
|
|
29
|
+
- uses: ./.github/actions/setup
|
|
30
|
+
with:
|
|
31
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
33
32
|
- run: pnpm theme:build
|
|
34
33
|
- run: pnpm coverage
|
|
35
34
|
- name: Upload coverage report
|
|
@@ -29,12 +29,9 @@ jobs:
|
|
|
29
29
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
30
30
|
with:
|
|
31
31
|
persist-credentials: false
|
|
32
|
-
- uses:
|
|
33
|
-
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
32
|
+
- uses: ./.github/actions/setup
|
|
34
33
|
with:
|
|
35
|
-
node-
|
|
36
|
-
cache: pnpm
|
|
37
|
-
- run: pnpm install --frozen-lockfile
|
|
34
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
38
35
|
- name: Validate migrations
|
|
39
36
|
env:
|
|
40
37
|
DATABASE_URL: ${{ secrets.DATABASE_URL_STAGING }}
|
|
@@ -32,12 +32,9 @@ jobs:
|
|
|
32
32
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
33
33
|
with:
|
|
34
34
|
persist-credentials: false
|
|
35
|
-
- uses:
|
|
36
|
-
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
35
|
+
- uses: ./.github/actions/setup
|
|
37
36
|
with:
|
|
38
|
-
node-
|
|
39
|
-
cache: pnpm
|
|
40
|
-
- run: pnpm install --frozen-lockfile
|
|
37
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
41
38
|
- name: Apply migrations
|
|
42
39
|
env:
|
|
43
40
|
DATABASE_URL: ${{ secrets.DATABASE_URL }}
|
|
@@ -26,9 +26,8 @@ jobs:
|
|
|
26
26
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
27
27
|
with:
|
|
28
28
|
persist-credentials: false
|
|
29
|
-
- uses:
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
- run: pnpm install --frozen-lockfile
|
|
29
|
+
- uses: ./.github/actions/setup
|
|
30
|
+
with:
|
|
31
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
33
32
|
- name: Audit production dependencies
|
|
34
33
|
run: pnpm audit --audit-level=high --prod
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
name: Setup
|
|
2
|
+
description: >-
|
|
3
|
+
Install pnpm and Node, authenticate to the private @raredays npm registry, then
|
|
4
|
+
install dependencies. The @raredays/* packages are published with restricted
|
|
5
|
+
access, so the registry token must be present before install. pnpm ignores
|
|
6
|
+
${VAR} interpolation in a committed project .npmrc (it could leak the token to
|
|
7
|
+
an attacker-controlled registry), so the token is written to the user-level
|
|
8
|
+
~/.npmrc at runtime instead.
|
|
9
|
+
|
|
10
|
+
inputs:
|
|
11
|
+
node-auth-token:
|
|
12
|
+
description: >-
|
|
13
|
+
npm token with read access to the private @raredays registry. Pass it from
|
|
14
|
+
the NODE_AUTH_TOKEN repository secret.
|
|
15
|
+
required: true
|
|
16
|
+
|
|
17
|
+
runs:
|
|
18
|
+
using: composite
|
|
19
|
+
steps:
|
|
20
|
+
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
|
|
21
|
+
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
22
|
+
with:
|
|
23
|
+
node-version: 24
|
|
24
|
+
cache: pnpm
|
|
25
|
+
- name: Authenticate to the npm registry
|
|
26
|
+
shell: bash
|
|
27
|
+
env:
|
|
28
|
+
NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}
|
|
29
|
+
run: |
|
|
30
|
+
if [ -z "$NODE_AUTH_TOKEN" ]; then
|
|
31
|
+
echo "::error::NODE_AUTH_TOKEN is empty. Add a repository secret with an npm token that has read access to the private @raredays registry."
|
|
32
|
+
exit 1
|
|
33
|
+
fi
|
|
34
|
+
echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
|
|
35
|
+
- name: Install dependencies
|
|
36
|
+
shell: bash
|
|
37
|
+
run: pnpm install --frozen-lockfile
|
|
@@ -26,10 +26,9 @@ jobs:
|
|
|
26
26
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
27
27
|
with:
|
|
28
28
|
persist-credentials: false
|
|
29
|
-
- uses:
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
- run: pnpm install --frozen-lockfile
|
|
29
|
+
- uses: ./.github/actions/setup
|
|
30
|
+
with:
|
|
31
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
33
32
|
- run: pnpm lint
|
|
34
33
|
|
|
35
34
|
format-check:
|
|
@@ -40,10 +39,9 @@ jobs:
|
|
|
40
39
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
41
40
|
with:
|
|
42
41
|
persist-credentials: false
|
|
43
|
-
- uses:
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
- run: pnpm install --frozen-lockfile
|
|
42
|
+
- uses: ./.github/actions/setup
|
|
43
|
+
with:
|
|
44
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
47
45
|
- run: pnpm format:check
|
|
48
46
|
|
|
49
47
|
style:
|
|
@@ -54,10 +52,9 @@ jobs:
|
|
|
54
52
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
55
53
|
with:
|
|
56
54
|
persist-credentials: false
|
|
57
|
-
- uses:
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
- run: pnpm install --frozen-lockfile
|
|
55
|
+
- uses: ./.github/actions/setup
|
|
56
|
+
with:
|
|
57
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
61
58
|
- run: pnpm style
|
|
62
59
|
|
|
63
60
|
typecheck:
|
|
@@ -68,10 +65,9 @@ jobs:
|
|
|
68
65
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
69
66
|
with:
|
|
70
67
|
persist-credentials: false
|
|
71
|
-
- uses:
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
- run: pnpm install --frozen-lockfile
|
|
68
|
+
- uses: ./.github/actions/setup
|
|
69
|
+
with:
|
|
70
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
75
71
|
- run: pnpm theme:build
|
|
76
72
|
- run: pnpm typecheck
|
|
77
73
|
|
|
@@ -83,10 +79,9 @@ jobs:
|
|
|
83
79
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
84
80
|
with:
|
|
85
81
|
persist-credentials: false
|
|
86
|
-
- uses:
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
- run: pnpm install --frozen-lockfile
|
|
82
|
+
- uses: ./.github/actions/setup
|
|
83
|
+
with:
|
|
84
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
90
85
|
- run: pnpm build
|
|
91
86
|
|
|
92
87
|
storybook:
|
|
@@ -97,10 +92,9 @@ jobs:
|
|
|
97
92
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
98
93
|
with:
|
|
99
94
|
persist-credentials: false
|
|
100
|
-
- uses:
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
- run: pnpm install --frozen-lockfile
|
|
95
|
+
- uses: ./.github/actions/setup
|
|
96
|
+
with:
|
|
97
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
104
98
|
- run: pnpm theme:build
|
|
105
99
|
- run: pnpm storybook:build
|
|
106
100
|
|
|
@@ -26,9 +26,8 @@ jobs:
|
|
|
26
26
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
27
27
|
with:
|
|
28
28
|
persist-credentials: false
|
|
29
|
-
- uses:
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
- run: pnpm install --frozen-lockfile
|
|
29
|
+
- uses: ./.github/actions/setup
|
|
30
|
+
with:
|
|
31
|
+
node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
|
|
33
32
|
- name: Audit production dependencies
|
|
34
33
|
run: pnpm audit --audit-level=high --prod
|