fastypest 3.0.39 → 3.0.41
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,141 @@
|
|
|
1
|
+
# Event-driven release pipeline
|
|
2
|
+
|
|
3
|
+
## Request
|
|
4
|
+
|
|
5
|
+
Split Fastypest release automation into independent event-driven workflows:
|
|
6
|
+
|
|
7
|
+
1. After each update to the default branch, count commits since the latest published release and create a version pull request once the configured threshold is reached.
|
|
8
|
+
2. After a default-branch update changes `package.json` version, create the corresponding immutable tag and GitHub Release with generated notes.
|
|
9
|
+
3. After a GitHub Release is published, publish the matching package version to npm through the existing trusted-publisher workflow.
|
|
10
|
+
4. Automatically validate, approve, and queue trusted release pull requests for squash auto-merge.
|
|
11
|
+
5. Preserve the exact `.github/workflows/auto-release.workflow.yml` filename required by npm OIDC.
|
|
12
|
+
|
|
13
|
+
Only `fastypest` is in scope. `typeorm-test-db` and DevBar are excluded.
|
|
14
|
+
|
|
15
|
+
## Evidence
|
|
16
|
+
|
|
17
|
+
- GitHub suppresses most follow-up workflow runs for events emitted with the repository `GITHUB_TOKEN`.
|
|
18
|
+
- Pull requests created with `GITHUB_TOKEN` require explicit workflow approval before their pull-request workflows run.
|
|
19
|
+
- A personal access token or GitHub App token can create the release branch and pull request while allowing normal pull-request checks to run.
|
|
20
|
+
- The `release.published` event supports both manually and automatically published GitHub Releases.
|
|
21
|
+
- npm trusted publishing binds the package to an exact workflow filename and requires OIDC.
|
|
22
|
+
- The previous implementation combined npm publication, tag creation, and GitHub Release creation after a pull-request state transition.
|
|
23
|
+
- Review found and the implementation corrected exact-release-commit targeting, shell template expansion, persisted checkout credentials, label validation under `pipefail`, and missing approval-workflow ownership documentation.
|
|
24
|
+
|
|
25
|
+
## Scope
|
|
26
|
+
|
|
27
|
+
- Refactor `prepare-release.workflow.yml` to run on default-branch pushes and manual dispatch.
|
|
28
|
+
- Add `create-github-release.workflow.yml`.
|
|
29
|
+
- Change `auto-release.workflow.yml` to publish npm only from `release.published`.
|
|
30
|
+
- Harden the existing trusted release approval job.
|
|
31
|
+
- Add scoped GitHub automation guidance.
|
|
32
|
+
- Preserve manual release recovery, manual release-to-npm delivery, dry-run release calculation, release strategies, breaking-change notes, build checks, and package installation smoke tests.
|
|
33
|
+
|
|
34
|
+
## Decision
|
|
35
|
+
|
|
36
|
+
Use event boundaries as the orchestration contract:
|
|
37
|
+
|
|
38
|
+
```text
|
|
39
|
+
push default branch
|
|
40
|
+
├─ prepare release PR when threshold is reached
|
|
41
|
+
└─ create GitHub Release when package.json version changes
|
|
42
|
+
|
|
43
|
+
release pull request
|
|
44
|
+
└─ validate exact contract → bot approval → PAT-backed auto-merge
|
|
45
|
+
|
|
46
|
+
release.published
|
|
47
|
+
└─ validate tag and package → build/package smoke → npm OIDC publish
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
`PAT_FINE` is used only in the protected `admin` environment where an operation must emit a follow-up event: release branch push, release pull-request creation, auto-merge enablement, immutable tag creation, and GitHub Release publication. GitHub Actions bot approval continues to use `github.token`. npm publication uses OIDC only.
|
|
51
|
+
|
|
52
|
+
## Acceptance
|
|
53
|
+
|
|
54
|
+
- A default-branch push below the threshold does not create a release pull request.
|
|
55
|
+
- A default-branch push at or above the threshold creates at most one owner-authored `release/v<version>` pull request.
|
|
56
|
+
- Release preparation is attached to the exact default-branch event SHA and does not drift to a newer branch head.
|
|
57
|
+
- The generated pull request changes exactly `package.json` and `CHANGELOG.md`.
|
|
58
|
+
- The trusted workflow validates the current head, title, exact branch, author, repository, base, label, package name, monotonic version, changelog entry, destination tag/release state, and changed files before approving.
|
|
59
|
+
- The approval is submitted through the reviews API against the validated commit SHA with body `Approved by the trusted release workflow contract.`
|
|
60
|
+
- Auto-merge is enabled only for the validated current head and repository rules remain the merge authority.
|
|
61
|
+
- A release pull-request merge does not immediately create another version pull request while the new package version lacks its GitHub Release.
|
|
62
|
+
- The release baseline tag must target a commit whose `package.json` contains the current version and whose release metadata matches stable or prerelease state.
|
|
63
|
+
- A changed package version creates an immutable tag and GitHub Release targeting the exact first-parent commit that introduced that version, including multi-commit push cases.
|
|
64
|
+
- Existing releases are accepted as idempotent only when tag target, draft state, and prerelease state match the resolved contract.
|
|
65
|
+
- Existing wrong-target tags or releases fail without force-updating or deleting them.
|
|
66
|
+
- Generated GitHub Releases use `PAT_FINE`, so `release.published` can trigger the npm workflow.
|
|
67
|
+
- Manually published owner releases trigger the same npm workflow.
|
|
68
|
+
- npm publication validates package name, semantic version, tag, prerelease state, default-branch ancestry, build, package archive, and existing npm state.
|
|
69
|
+
- Stable versions publish to `latest`; prereleases publish to `next`.
|
|
70
|
+
- Reruns are idempotent.
|
|
71
|
+
- No workflow polls check runs, directly merges a pull request, force-pushes a tag, or deletes release evidence on failure.
|
|
72
|
+
- The npm trusted-publisher workflow filename remains unchanged.
|
|
73
|
+
|
|
74
|
+
## Risks
|
|
75
|
+
|
|
76
|
+
- A broad or leaked PAT could create repository objects outside the intended release flow.
|
|
77
|
+
- A privileged `pull_request_target` workflow could execute untrusted pull-request code.
|
|
78
|
+
- Concurrent default-branch pushes could create duplicate release pull requests.
|
|
79
|
+
- Release creation can partially complete after tag creation.
|
|
80
|
+
- Manual releases could target an untrusted commit or mismatched package version.
|
|
81
|
+
- A prerelease could accidentally replace npm `latest`.
|
|
82
|
+
- A multi-commit default-branch push could place commits after the version change and accidentally expand the release target.
|
|
83
|
+
|
|
84
|
+
## Controls
|
|
85
|
+
|
|
86
|
+
- Restrict `PAT_FINE` to this repository and the minimum Contents/Pull requests permissions.
|
|
87
|
+
- Keep PAT-backed jobs behind the `admin` environment and verify the authenticated actor is the repository owner.
|
|
88
|
+
- Never checkout or execute pull-request code in the privileged approval job.
|
|
89
|
+
- Serialize release preparation and GitHub Release creation with repository-scoped concurrency.
|
|
90
|
+
- Attach release preparation to the event SHA before creating the release commit and branch.
|
|
91
|
+
- Treat an open trusted release pull request as a preparation barrier.
|
|
92
|
+
- Treat a package version without a GitHub Release as a preparation barrier.
|
|
93
|
+
- Bind approval and auto-merge to the live head SHA.
|
|
94
|
+
- Validate exact changed files, monotonic versioning, changelog content, and package metadata through the GitHub API.
|
|
95
|
+
- Resolve the exact first-parent commit that introduced the package version.
|
|
96
|
+
- Reject tag/release collisions and verify tag targets and release metadata after creation.
|
|
97
|
+
- Require release tags to be reachable from the default branch before npm publication.
|
|
98
|
+
- Pass event and action values into shell blocks through explicit environment variables.
|
|
99
|
+
- Use npm OIDC without a token fallback.
|
|
100
|
+
|
|
101
|
+
## Tests
|
|
102
|
+
|
|
103
|
+
- Parsed every changed workflow as YAML.
|
|
104
|
+
- Checked every changed shell block with `bash -n` after neutralizing GitHub expressions.
|
|
105
|
+
- Checked every changed `actions/github-script` program by parsing it inside an async function wrapper.
|
|
106
|
+
- Asserted every third-party action reference is pinned to a full commit SHA.
|
|
107
|
+
- Asserted the preparation workflow contains no check polling, direct merge, npm publish, GitHub Release creation, force push, or destructive cleanup.
|
|
108
|
+
- Asserted the release creator uses a package-version-change gate, exact tag target validation, generated notes, and `PAT_FINE`.
|
|
109
|
+
- Asserted the npm publisher is triggered only by `release.published`, retains its filename, has `id-token: write`, and contains no npm token fallback.
|
|
110
|
+
- Asserted the trusted approval validates branch, title, monotonic package metadata, changelog, changed files, destination collisions, and current head before bot approval and PAT-backed auto-merge.
|
|
111
|
+
- Exercised the exact release-SHA resolver with synthetic histories covering a multi-commit push, manual recovery, and a later `package.json` edit that retained the same version.
|
|
112
|
+
- Exercised the strict semantic-version parser and comparator for patch, minor, major, prerelease, stable-versus-prerelease, numeric-versus-string identifiers, and invalid leading-zero identifiers.
|
|
113
|
+
- Ran the repository pull-request build, format, package-install smoke, and database matrix on implementation heads.
|
|
114
|
+
- Resolved all initial review findings and confirmed no unresolved review threads before final delivery validation.
|
|
115
|
+
|
|
116
|
+
## Checks
|
|
117
|
+
|
|
118
|
+
- YAML syntax: passed.
|
|
119
|
+
- Shell syntax: passed.
|
|
120
|
+
- GitHub-script syntax: passed.
|
|
121
|
+
- Static workflow contract assertions: passed.
|
|
122
|
+
- Exact release-SHA synthetic cases: passed.
|
|
123
|
+
- Semantic-version parser/comparator cases: passed.
|
|
124
|
+
- Pull-request build, format, package smoke, and database matrix: passed on hardened implementation heads; the final documentation head remains subject to the normal pull-request CI gate.
|
|
125
|
+
- Initial review findings: resolved.
|
|
126
|
+
- Final diff inspection: no secret values, mutable release tags, privileged execution of pull-request code, duplicate release ownership, or destructive failure cleanup found.
|
|
127
|
+
|
|
128
|
+
## Rollback
|
|
129
|
+
|
|
130
|
+
Revert the implementation pull request. Existing tags, releases, packages, and generated release branches are not deleted. The previous merged-pull-request publication workflow is restored by the revert.
|
|
131
|
+
|
|
132
|
+
## Delivery
|
|
133
|
+
|
|
134
|
+
- Branch: `agent/refactor-event-driven-release`
|
|
135
|
+
- Pull request: `https://github.com/juanjoGonDev/fastypest/pull/1681`
|
|
136
|
+
- Merge: requires explicit owner approval
|
|
137
|
+
- Release/publication: not permitted from this implementation branch
|
|
138
|
+
|
|
139
|
+
## Status
|
|
140
|
+
|
|
141
|
+
Implementation, review hardening, and static validation are complete. Delivery remains gated by pull-request CI and explicit owner merge approval; no merge, GitHub Release, tag, or npm publication has been performed.
|
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
# Release pull request auto-merge architecture
|
|
2
|
+
|
|
3
|
+
## Request
|
|
4
|
+
Replace the auto-release workflow's direct check polling and merge logic with repository-native auto-merge. Publish only after the release pull request has been merged by the configured branch requirements.
|
|
5
|
+
|
|
6
|
+
## Evidence
|
|
7
|
+
- Run `30620987564` created release PR `#1679`, then treated every check run as mandatory and aborted when an additional check failed.
|
|
8
|
+
- The package build, package installation smoke test, and project CI passed.
|
|
9
|
+
- The failure cleanup deleted the release branch and tag before the external check could be diagnosed.
|
|
10
|
+
- Code scanning can add or rename checks without changing the repository's required-check contract.
|
|
11
|
+
|
|
12
|
+
## Scope
|
|
13
|
+
- Prepare release metadata in a same-repository `release/<run-number>` pull request.
|
|
14
|
+
- Approve the exact release head and enable squash auto-merge.
|
|
15
|
+
- Publish npm, create the immutable tag, and create the GitHub Release only after the pull request merges.
|
|
16
|
+
- Preserve scheduled releases, manual strategies, dry runs, breaking-change metadata, package build, and package installation smoke tests.
|
|
17
|
+
|
|
18
|
+
## Decision
|
|
19
|
+
GitHub branch requirements are the source of truth for release eligibility. A dedicated preparation workflow does not enumerate check runs, wait for checks, merge directly, publish, or delete release evidence. The trusted pull-request workflow enables auto-merge for the exact head SHA. The existing `auto-release.workflow.yml` remains the owner of npm publication so its trusted-publisher identity is preserved; its merged-release job validates the pull-request contract before checking out the merge commit and publishing.
|
|
20
|
+
|
|
21
|
+
## Risks
|
|
22
|
+
- A malformed release pull request could trigger privileged publication.
|
|
23
|
+
- npm publication can succeed before tag or GitHub Release creation.
|
|
24
|
+
- A rerun can encounter an existing branch, tag, package version, or release.
|
|
25
|
+
- Missing workflow approval settings or `PAT_FINE` prevents release auto-merge.
|
|
26
|
+
|
|
27
|
+
## Controls
|
|
28
|
+
- Require a merged, same-repository, owner-authored, `auto-release` pull request targeting the default branch from `release/`.
|
|
29
|
+
- Require exactly `package.json` and `CHANGELOG.md` changes.
|
|
30
|
+
- Match the pull-request title to the package version.
|
|
31
|
+
- Bind approval and auto-merge to the current head SHA.
|
|
32
|
+
- Make npm, tag, and GitHub Release delivery idempotent and reject tag collisions.
|
|
33
|
+
- Keep privileged publication behind the `admin` environment.
|
|
34
|
+
|
|
35
|
+
## Acceptance
|
|
36
|
+
- A prepared release pull request exits without polling checks or merging directly.
|
|
37
|
+
- Auto-merge waits for the repository's configured requirements.
|
|
38
|
+
- Failed or pending checks leave the pull request and branch available for diagnosis.
|
|
39
|
+
- Publication cannot run before a trusted release pull request is merged.
|
|
40
|
+
- A successful merged release publishes the exact package version, tags the merge commit, creates a GitHub Release, and verifies all three outputs.
|
|
41
|
+
- Dry-run and breaking-change behavior remains available.
|
|
42
|
+
|
|
43
|
+
## Tests
|
|
44
|
+
- Parse all changed workflow YAML files.
|
|
45
|
+
- Assert the preparation workflow contains no check-run polling, direct merge API call, npm publication, release creation, forced tag update, or failure cleanup.
|
|
46
|
+
- Assert release approval enables auto-merge with an exact head match.
|
|
47
|
+
- Assert merged publication validates actor, repository, base, head prefix, label, changed files, title, package version, tag target, npm state, and GitHub Release state.
|
|
48
|
+
- Run the repository pull-request workflow on the resulting branch.
|
|
49
|
+
|
|
50
|
+
## Checks
|
|
51
|
+
- YAML syntax validation.
|
|
52
|
+
- Workflow contract inspection.
|
|
53
|
+
- Pull-request CI and CodeQL.
|
|
54
|
+
- Review final diff for secrets, mutable privileged behavior, and destructive cleanup.
|
|
55
|
+
|
|
56
|
+
## Rollback
|
|
57
|
+
Revert the pull request. Existing failed release PRs remain closed and no package or tag is recreated automatically. A later scheduled or manual release can create a fresh release pull request.
|
|
58
|
+
|
|
59
|
+
## Delivery
|
|
60
|
+
- Branch: `agent/fix-release-auto-merge`
|
|
61
|
+
- Pull request: #1680
|
|
62
|
+
- Merge: requires explicit owner approval
|
|
63
|
+
- Publication: not triggered by this implementation pull request
|
|
64
|
+
|
|
65
|
+
## Status
|
|
66
|
+
Implementation, review hardening, and static validation are complete. Delivery remains gated by pull-request CI and explicit owner merge approval; no merge or publication has been performed.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "fastypest",
|
|
3
|
-
"version": "3.0.
|
|
3
|
+
"version": "3.0.41",
|
|
4
4
|
"description": "Restores the database automatically after each test. Allows serial execution of tests without having to delete and restore the database having to stop the application",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -58,26 +58,26 @@
|
|
|
58
58
|
"@eslint/js": "^10.0.1",
|
|
59
59
|
"@swc-node/jest": "^1.10.1",
|
|
60
60
|
"@swc/cli": "^0.8.1",
|
|
61
|
-
"@swc/core": "^1.15.
|
|
61
|
+
"@swc/core": "^1.15.47",
|
|
62
62
|
"@swc/helpers": "^0.5.23",
|
|
63
63
|
"@types/jest": "^30.0.0",
|
|
64
|
-
"@types/node": "^26.1.
|
|
64
|
+
"@types/node": "^26.1.2",
|
|
65
65
|
"@types/winston": "^2.4.4",
|
|
66
66
|
"@typescript-eslint/eslint-plugin": "^8.65.0",
|
|
67
67
|
"@typescript-eslint/parser": "^8.65.0",
|
|
68
68
|
"@typescript-eslint/types": "8.65.0",
|
|
69
69
|
"cpy-cli": "^6.0.0",
|
|
70
|
-
"eslint": "^10.
|
|
70
|
+
"eslint": "^10.8.0",
|
|
71
71
|
"eslint-config-standard-with-typescript": "^43.0.1",
|
|
72
72
|
"eslint-plugin-import": "^2.32.0",
|
|
73
73
|
"eslint-plugin-n": "^18.2.2",
|
|
74
74
|
"eslint-plugin-prettier": "^5.5.6",
|
|
75
75
|
"eslint-plugin-promise": "^7.3.0",
|
|
76
|
-
"execa": "^10.0.
|
|
77
|
-
"globals": "^17.
|
|
76
|
+
"execa": "^10.0.1",
|
|
77
|
+
"globals": "^17.9.0",
|
|
78
78
|
"jest": "^30.4.2",
|
|
79
79
|
"lefthook": "^2.1.10",
|
|
80
|
-
"lint-staged": "^17.
|
|
80
|
+
"lint-staged": "^17.3.0",
|
|
81
81
|
"mariadb": "^3.5.3",
|
|
82
82
|
"mysql": "^2.18.1",
|
|
83
83
|
"pg": "^8.22.0",
|