raygun4node/.github/workflows/node.js.yml at develop · MindscapeHQ/raygun4node · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
# This workflow will do a clean installation of node dependencies, cache/restore them, build the source code and run tests across different versions of node
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-nodejs

name: Node.js CI

on:
  push:
    branches: [ "master", "develop" ]
  pull_request:
    branches: [ "master", "develop" ]

permissions:
  contents: read

jobs:
  build:

    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [20.x, 22.x, 24.x]
        # See supported Node.js release schedule at https://nodejs.org/en/about/releases/

    steps:
    - uses: actions/checkout@v7
    - name: Use Node.js ${{ matrix.node-version }}
      uses: actions/setup-node@v7
      with:
        node-version: ${{ matrix.node-version }}
        cache: 'npm'
    - run: npm ci --ignore-scripts
    - run: npm run prepare
    - run: npm test
    # Run CommonJS compatibility test
    - run: npm run test:cjs
    # Run static analysis on JS files
    - run: npm run eslint
    # Run static analysis on TS files
    - run: npm run tseslint

  # Checks code formatting using the version pinned in package-lock.json.
  prettier:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Use Node.js 24.x
        uses: actions/setup-node@v7
        with:
          node-version: 24.x
          cache: 'npm'
      - run: npm ci --ignore-scripts
      - run: npm exec -- prettier --check "lib/*.ts" "test/*.js" "examples/**/*.js"

  supply-chain:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24.x
          cache: 'npm'
      - name: Reject known malicious package versions
        run: |
          node <<'NODE'
          const fs = require('node:fs')
          const blocked = new Map([
            ['keyv', '6.0.0'],
            ['flat-cache', '6.1.24'],
            ['file-entry-cache', '11.1.6']
          ])
          const lockfiles = [
            'package-lock.json',
            'examples/express-sample/package-lock.json',
            'examples/using-domains/package-lock.json'
          ]

          for (const lockfile of lockfiles) {
            const lock = JSON.parse(fs.readFileSync(lockfile, 'utf8'))
            for (const [path, metadata] of Object.entries(lock.packages)) {
              for (const [name, version] of blocked) {
                if ((path === `node_modules/${name}` || path.endsWith(`/node_modules/${name}`)) && metadata.version === version) {
                  throw new Error(`${lockfile} contains known malicious package ${name}@${version}`)
                }
              }
            }
          }
          NODE
      - run: npm ci --ignore-scripts
      - run: npm audit --omit=dev
      - run: npm audit signatures

  examples:
    runs-on: ubuntu-latest

    strategy:
      matrix:
        example: [express-sample, using-domains]

    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: 24.x
          cache: 'npm'
          cache-dependency-path: |
            package-lock.json
            examples/${{ matrix.example }}/package-lock.json
      - run: npm ci --ignore-scripts
      - run: npm run prepare
      - run: npm ci --ignore-scripts
        working-directory: examples/${{ matrix.example }}
      - run: npm audit --omit=dev
        working-directory: examples/${{ matrix.example }}
      - run: npm audit signatures
        working-directory: examples/${{ matrix.example }}
      - name: Smoke test Express example
        if: matrix.example == 'express-sample'
        working-directory: examples/express-sample
        env:
          NODE_ENV: production
        run: node -e "require('./app')"
      - name: Smoke test domains example
        if: matrix.example == 'using-domains'
        working-directory: examples/using-domains
        run: |
          node --check app.js
          node -e "require('config'); require('raygun')"