From 6d81438b496bfffbf7124936723a5f1eb783cdca Mon Sep 17 00:00:00 2001 From: Sebastian Leidig Date: Tue, 13 Oct 2026 22:44:06 +0200 Subject: [PATCH 1/6] ci: build, release and clean up images with the shared org workflows - Images: the local _build.yml is replaced by the shared docker-image.yml. Releases (on `published`) are tagged ``, plus `stable` and `latest` for full releases; PR images `pr-` are amd64 only, and a PR's superseded image is deleted on each push. - PR image cleanup: the shared pr-image-cleanup.yml (manifest-aware, cancels a still running PR build first) with the job token instead of the GH_TOKEN PAT. - Releases: the local semantic-release job is replaced by the shared release.yml (type: release on main). - Node: .node-version (`v24`) becomes .nvmrc with the exact version 24.21.0 (as in the Dockerfile), read by all workflows via node-version-file. - renovate.json extends the shared org presets (default, node, docker). - New callers of the shared pr-title-lint and actionlint workflows. The required check `Test` keeps its name. Part of Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 --- .github/workflows/_build.yml | 58 ---------------- .github/workflows/actionlint.yml | 15 ++++ .github/workflows/on-push.yml | 25 +++---- .github/workflows/on-release.yml | 17 +++-- .github/workflows/pr-cleanup.yml | 36 +++------- .github/workflows/pr-release.yml | 17 +++-- .github/workflows/pr-title-lint.yml | 16 +++++ .node-version | 1 - .nvmrc | 1 + renovate.json | 103 +++------------------------- 10 files changed, 82 insertions(+), 207 deletions(-) delete mode 100644 .github/workflows/_build.yml create mode 100644 .github/workflows/actionlint.yml create mode 100644 .github/workflows/pr-title-lint.yml delete mode 100644 .node-version create mode 100644 .nvmrc diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml deleted file mode 100644 index 78fbc1c..0000000 --- a/.github/workflows/_build.yml +++ /dev/null @@ -1,58 +0,0 @@ -name: Build and publish container image - -on: - workflow_call: - inputs: - docker_tags: - type: string - required: true - description: Docker tags configuration for docker/metadata-action (multiline string) - -permissions: - contents: read - packages: write - -env: - GHCR_IMAGE: ghcr.io/${{ github.repository }} - -jobs: - build-image: - name: Build and publish container image - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - persist-credentials: false - - - name: Docker meta - id: meta - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 - with: - images: | - ${{ env.GHCR_IMAGE }} - tags: ${{ inputs.docker_tags }} - - - name: Set up QEMU - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1 - - - name: Login to GitHub Container Registry - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and push multi-platform image - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0 - with: - platforms: linux/amd64,linux/arm64 - context: ./ - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - push: true - cache-from: type=gha - cache-to: type=gha,mode=min,ignore-error=true diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml new file mode 100644 index 0000000..c637340 --- /dev/null +++ b/.github/workflows/actionlint.yml @@ -0,0 +1,15 @@ +name: actionlint + +on: + pull_request: + push: + branches: [main] + +permissions: {} + +jobs: + # Check name: `actionlint / actionlint` + actionlint: + uses: Aam-Digital/.github/.github/workflows/actionlint.yml@feat/reusable-workflows # TODO switch to @v1 + permissions: + contents: read diff --git a/.github/workflows/on-push.yml b/.github/workflows/on-push.yml index 8611b86..52e661a 100644 --- a/.github/workflows/on-push.yml +++ b/.github/workflows/on-push.yml @@ -20,7 +20,7 @@ jobs: - uses: actions/setup-node@v7 with: - node-version-file: .node-version + node-version-file: .nvmrc - name: Install dependencies run: npm ci @@ -39,25 +39,16 @@ jobs: - name: Run e2e tests run: npm run test:e2e + # Check name: `Create Release / release`. Auto release mode: every releasable push to main becomes a full release. release: name: Create Release if: github.ref == 'refs/heads/main' - runs-on: ubuntu-latest needs: - test + uses: Aam-Digital/.github/.github/workflows/release.yml@feat/reusable-workflows # TODO switch to @v1 permissions: - contents: write - issues: write - pull-requests: write - steps: - - name: Checkout repository - uses: actions/checkout@v7 - - - uses: actions/setup-node@v7 - with: - node-version-file: .node-version - - - name: Semantic Release - env: - GITHUB_TOKEN: ${{ secrets.GH_TOKEN }} - run: npx semantic-release + contents: read # everything that writes uses the GH_TOKEN PAT (its releases trigger the image build) + with: + type: release + secrets: + token: ${{ secrets.GH_TOKEN }} diff --git a/.github/workflows/on-release.yml b/.github/workflows/on-release.yml index 912d613..fdb340d 100644 --- a/.github/workflows/on-release.yml +++ b/.github/workflows/on-release.yml @@ -2,15 +2,20 @@ name: On Semantic Release (build & publish image) on: release: - types: [released] + types: [published] # created with the GH_TOKEN PAT, releases by the GITHUB_TOKEN trigger no workflows + +permissions: {} jobs: + # Check name: `build / build` build: - uses: ./.github/workflows/_build.yml - with: - docker_tags: | - type=raw,value=${{ github.event.release.tag_name }} - type=raw,value=latest + uses: Aam-Digital/.github/.github/workflows/docker-image.yml@feat/reusable-workflows # TODO switch to @v1 permissions: contents: read packages: write + with: + images: ghcr.io/aam-digital/platform-admin-services + # Tag `` (e.g. `v1.7.4`, also the `org.opencontainers.image.version` label); + # full releases also `stable` and `latest` + version: ${{ github.event.release.tag_name }} + stable: ${{ !github.event.release.prerelease }} diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-cleanup.yml index 2f04d95..165bf6b 100644 --- a/.github/workflows/pr-cleanup.yml +++ b/.github/workflows/pr-cleanup.yml @@ -4,32 +4,16 @@ on: pull_request: types: [closed] -permissions: - contents: read +permissions: {} jobs: + # Check name: `cleanup / cleanup` cleanup: - name: Delete pr- package version - runs-on: ubuntu-latest - steps: - - name: Delete GHCR image tagged pr-${{ github.event.number }} - env: - GH_TOKEN: ${{ secrets.GH_TOKEN }} - run: | - set -euo pipefail - TAG="pr-${{ github.event.number }}" - OWNER="${{ github.repository_owner }}" - PACKAGE="${{ github.event.repository.name }}" - - version_ids=$(gh api "/orgs/$OWNER/packages/container/$PACKAGE/versions" --paginate \ - --jq ".[] | select(.metadata.container.tags | index(\"$TAG\")) | .id") - - if [ -z "$version_ids" ]; then - echo "No package version tagged $TAG found, nothing to delete" - exit 0 - fi - - for id in $version_ids; do - echo "Deleting package version $id (tag $TAG)" - gh api --method DELETE "/orgs/$OWNER/packages/container/$PACKAGE/versions/$id" - done + # PRs from forks have no image + if: github.event.pull_request.head.repo.full_name == github.repository + uses: Aam-Digital/.github/.github/workflows/pr-image-cleanup.yml@feat/reusable-workflows # TODO switch to @v1 + permissions: + actions: write # cancel a still running PR image build, which would otherwise push pr- after the cleanup + packages: write # the package is linked to this repository, so the job token can delete its versions + with: + build-workflows: pr-release.yml diff --git a/.github/workflows/pr-release.yml b/.github/workflows/pr-release.yml index 83627f9..59107e2 100644 --- a/.github/workflows/pr-release.yml +++ b/.github/workflows/pr-release.yml @@ -3,6 +3,9 @@ name: On PR (build & publish pre-release image) on: pull_request: +permissions: + contents: read + jobs: test: name: Test @@ -13,7 +16,7 @@ jobs: - uses: actions/setup-node@v7 with: - node-version-file: .node-version + node-version-file: .nvmrc - name: Install dependencies run: npm ci @@ -27,12 +30,16 @@ jobs: - name: Run e2e tests run: npm run test:e2e + # Check name: `build / build` build: needs: test - uses: ./.github/workflows/_build.yml - with: - docker_tags: | - type=raw,value=pr-${{ github.event.number }} + uses: Aam-Digital/.github/.github/workflows/docker-image.yml@feat/reusable-workflows # TODO switch to @v1 permissions: contents: read packages: write + with: + images: ghcr.io/aam-digital/platform-admin-services + tags: pr-${{ github.event.number }} + platforms: linux/amd64 + # PRs from forks cannot push; only check that the image builds + push: ${{ github.event.pull_request.head.repo.full_name == github.repository }} diff --git a/.github/workflows/pr-title-lint.yml b/.github/workflows/pr-title-lint.yml new file mode 100644 index 0000000..204ecfe --- /dev/null +++ b/.github/workflows/pr-title-lint.yml @@ -0,0 +1,16 @@ +name: PR title lint + +on: + # pull_request_target so that it also runs for PRs from forks. Safe here: the shared workflow never checks out PR code + # and only reads the PR title from the event payload. + pull_request_target: # zizmor: ignore[dangerous-triggers] never checks out PR code, only reads the PR title from the event payload + types: [opened, edited, synchronize, reopened] + +permissions: {} + +jobs: + # Check name: `pr-title / Validate PR title` + pr-title: + uses: Aam-Digital/.github/.github/workflows/pr-title-lint.yml@feat/reusable-workflows # TODO switch to @v1 + permissions: + pull-requests: read diff --git a/.node-version b/.node-version deleted file mode 100644 index 54c6511..0000000 --- a/.node-version +++ /dev/null @@ -1 +0,0 @@ -v24 diff --git a/.nvmrc b/.nvmrc new file mode 100644 index 0000000..df6ae33 --- /dev/null +++ b/.nvmrc @@ -0,0 +1 @@ +24.21.0 diff --git a/renovate.json b/renovate.json index 10ddfb9..93f1cbe 100644 --- a/renovate.json +++ b/renovate.json @@ -1,95 +1,10 @@ { - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:recommended", - "group:allNonMajor", - ":maintainLockFilesMonthly" - ], - "enabledManagers": [ - "npm", - "dockerfile", - "docker-compose", - "github-actions" - ], - "timezone": "Etc/UTC", - "schedule": [ - "* * * * 0" - ], - "dependencyDashboard": false, - "prConcurrentLimit": 5, - "prHourlyLimit": 2, - "labels": [ - "dependencies" - ], - "vulnerabilityAlerts": { - "enabled": true, - "schedule": [ - "at any time" - ], - "labels": [ - "dependencies", - "security" - ] - }, - "osvVulnerabilityAlerts": true, - "reviewers": [ - "sleidig", - "Abhinegi2" - ], - "rangeStrategy": "bump", - "constraints": { - "npm": ">=11.0.0" - }, - "packageRules": [ - { - "matchManagers": [ - "npm" - ], - "rangeStrategy": "bump" - }, - { - "matchUpdateTypes": [ - "major" - ], - "draftPR": true, - "labels": [ - "dependencies" - ] - }, - { - "matchDepTypes": [ - "dependencies", - "devDependencies" - ], - "matchUpdateTypes": [ - "minor", - "patch" - ], - "groupName": "weekly-non-major-updates", - "automerge": false - }, - { - "matchManagers": [ - "dockerfile", - "docker-compose" - ], - "matchUpdateTypes": [ - "minor", - "patch" - ], - "groupName": "docker-base-image", - "automerge": false - }, - { - "matchManagers": [ - "github-actions" - ], - "matchUpdateTypes": [ - "minor", - "patch" - ], - "groupName": "github-actions", - "automerge": false - } - ] -} \ No newline at end of file + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "local>Aam-Digital/.github//renovate/default", + "local>Aam-Digital/.github//renovate/node", + "local>Aam-Digital/.github//renovate/docker" + ], + "enabledManagers": ["npm", "nvm", "dockerfile", "docker-compose", "github-actions"], + "additionalReviewers": ["Abhinegi2"] +} From 5f20f041599f3373d6e1ad03568c6394b2d73641 Mon Sep 17 00:00:00 2001 From: Sebastian Leidig Date: Tue, 13 Oct 2026 22:48:21 +0200 Subject: [PATCH 2/6] ci: push again to check that the replaced PR image is deleted Co-Authored-By: Claude Opus 5.5 From 6e62d29517695922ffe87b956362edb36758ceea Mon Sep 17 00:00:00 2001 From: Sebastian Leidig Date: Fri, 16 Oct 2026 17:23:56 +0200 Subject: [PATCH 3/6] ci: build an edge image on every push to the default branch, without prereleases Uses the shared edge-version workflow (Aam-Digital/.github#1): version -edge., tagged `edge` too while it is the newest commit. Edge images of a finished cycle are pruned after the next full release. The shared release workflow no longer takes `type`. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/on-push.yml | 28 ++++++++++++++++++++++++++-- .github/workflows/on-release.yml | 9 +++++++++ 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/.github/workflows/on-push.yml b/.github/workflows/on-push.yml index 52e661a..cd77b3e 100644 --- a/.github/workflows/on-push.yml +++ b/.github/workflows/on-push.yml @@ -48,7 +48,31 @@ jobs: uses: Aam-Digital/.github/.github/workflows/release.yml@feat/reusable-workflows # TODO switch to @v1 permissions: contents: read # everything that writes uses the GH_TOKEN PAT (its releases trigger the image build) - with: - type: release secrets: token: ${{ secrets.GH_TOKEN }} + + # Edge build of every main push (see Aam-Digital/.github): version `vX.Y.Z-edge.N` (the last release with the patch + # number bumped, plus the commits since), no tag and no GitHub release. + edge-version: + if: github.ref == 'refs/heads/main' + needs: + - test + uses: Aam-Digital/.github/.github/workflows/edge-version.yml@feat/reusable-workflows # TODO switch to @v1 + permissions: + contents: read + + # Check name: `edge-build / build`. Image `vX.Y.Z-edge.N`, plus `edge` if this is still the newest main commit. + # A newer push cancels an older edge build, so that `edge` never moves back. + edge-build: + needs: edge-version + concurrency: + group: edge-build + cancel-in-progress: true + uses: Aam-Digital/.github/.github/workflows/docker-image.yml@feat/reusable-workflows # TODO switch to @v1 + permissions: + contents: read + packages: write + with: + images: ghcr.io/aam-digital/platform-admin-services + version: ${{ needs.edge-version.outputs.version }} + tags: ${{ needs.edge-version.outputs.is-head == 'true' && 'edge' || '' }} diff --git a/.github/workflows/on-release.yml b/.github/workflows/on-release.yml index fdb340d..dd94638 100644 --- a/.github/workflows/on-release.yml +++ b/.github/workflows/on-release.yml @@ -19,3 +19,12 @@ jobs: # full releases also `stable` and `latest` version: ${{ github.event.release.tag_name }} stable: ${{ !github.event.release.prerelease }} + + # After a full release, the edge images (`*-edge.*`) of the finished cycle are no longer needed. The image `edge` + # points to is kept. + prune-edge-images: + if: ${{ !github.event.release.prerelease }} + needs: build + uses: Aam-Digital/.github/.github/workflows/image-prune.yml@feat/reusable-workflows # TODO switch to @v1 + permissions: + packages: write From 21b4db3666cd062819e6672ce8f81bcaf5f0dec2 Mon Sep 17 00:00:00 2001 From: Sebastian Leidig Date: Tue, 20 Oct 2026 09:22:34 +0200 Subject: [PATCH 4/6] ci: follow the shared workflow changes (native-runner image builds, combined image-cleanup.yml) - image-prune.yml and pr-image-cleanup.yml are now one image-cleanup.yml (`tags` instead of `tag-patterns`; callers grant `actions: write` too). - docker-image.yml builds every platform on a native runner: check names are now ` / build ()` and ` / merge`, and the `native-runners` input is gone. - The `org.opencontainers.image.version` label of PR images is set by the shared workflow from the first tag. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/on-push.yml | 2 +- .github/workflows/on-release.yml | 7 +++++-- .github/workflows/pr-cleanup.yml | 2 +- .github/workflows/pr-release.yml | 2 +- 4 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/on-push.yml b/.github/workflows/on-push.yml index cd77b3e..9537f7d 100644 --- a/.github/workflows/on-push.yml +++ b/.github/workflows/on-push.yml @@ -61,7 +61,7 @@ jobs: permissions: contents: read - # Check name: `edge-build / build`. Image `vX.Y.Z-edge.N`, plus `edge` if this is still the newest main commit. + # Check names: `edge-build / build ()`, `edge-build / merge`. Image `vX.Y.Z-edge.N`, plus `edge` if this is still the newest main commit. # A newer push cancels an older edge build, so that `edge` never moves back. edge-build: needs: edge-version diff --git a/.github/workflows/on-release.yml b/.github/workflows/on-release.yml index dd94638..d9088c0 100644 --- a/.github/workflows/on-release.yml +++ b/.github/workflows/on-release.yml @@ -7,7 +7,7 @@ on: permissions: {} jobs: - # Check name: `build / build` + # Check names: `build / build (linux/amd64)`, `build / build (linux/arm64)`, `build / merge` build: uses: Aam-Digital/.github/.github/workflows/docker-image.yml@feat/reusable-workflows # TODO switch to @v1 permissions: @@ -25,6 +25,9 @@ jobs: prune-edge-images: if: ${{ !github.event.release.prerelease }} needs: build - uses: Aam-Digital/.github/.github/workflows/image-prune.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@feat/reusable-workflows # TODO switch to @v1 permissions: + actions: write packages: write + with: + tags: "*-edge.*" diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-cleanup.yml index 165bf6b..fc5904b 100644 --- a/.github/workflows/pr-cleanup.yml +++ b/.github/workflows/pr-cleanup.yml @@ -11,7 +11,7 @@ jobs: cleanup: # PRs from forks have no image if: github.event.pull_request.head.repo.full_name == github.repository - uses: Aam-Digital/.github/.github/workflows/pr-image-cleanup.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@feat/reusable-workflows # TODO switch to @v1 permissions: actions: write # cancel a still running PR image build, which would otherwise push pr- after the cleanup packages: write # the package is linked to this repository, so the job token can delete its versions diff --git a/.github/workflows/pr-release.yml b/.github/workflows/pr-release.yml index 59107e2..90b702b 100644 --- a/.github/workflows/pr-release.yml +++ b/.github/workflows/pr-release.yml @@ -30,7 +30,7 @@ jobs: - name: Run e2e tests run: npm run test:e2e - # Check name: `build / build` + # Check names: `build / build (linux/amd64)`, `build / merge` build: needs: test uses: Aam-Digital/.github/.github/workflows/docker-image.yml@feat/reusable-workflows # TODO switch to @v1 From 88cf204c96a3cfcaecc8c47b114cbbba1f2959f2 Mon Sep 17 00:00:00 2001 From: Sebastian Leidig Date: Tue, 20 Oct 2026 11:07:42 +0200 Subject: [PATCH 5/6] ci: release and tag without "v", report the version to Sentry, align with replication-backend - .releaserc.json: `tagFormat: "${version}"`, so releases, release tags and images are `1.7.7` instead of `v1.7.7` (edge images `1.7.7-edge.N`), as in the other repositories. Same plugins as replication-backend: no npm plugin (the package is private), no success/fail comments or labels on issues and PRs. - Every image build sets package.json's version (release, edge or `0.0.0-pr.`), and Sentry reports it as `release`. - pr-cleanup.yml -> pr-closed.yml with the job `cleanup-image`, as in replication-backend and aam-services. - .nvmrc follows the Dockerfile to Node.js 24.22.0 (merged from main). Requires the tag `1.7.6` on the commit of `v1.7.6` before merging, otherwise semantic-release finds no previous release and starts at 1.0.0. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/on-push.yml | 6 ++++-- .github/workflows/on-release.yml | 4 +++- .../workflows/{pr-cleanup.yml => pr-closed.yml} | 6 +++--- .github/workflows/pr-release.yml | 3 +++ .nvmrc | 2 +- .releaserc.json | 15 +++++++++++++++ src/instrument.ts | 3 +++ tsconfig.json | 1 + 8 files changed, 33 insertions(+), 7 deletions(-) rename .github/workflows/{pr-cleanup.yml => pr-closed.yml} (84%) create mode 100644 .releaserc.json diff --git a/.github/workflows/on-push.yml b/.github/workflows/on-push.yml index 9537f7d..af08ad1 100644 --- a/.github/workflows/on-push.yml +++ b/.github/workflows/on-push.yml @@ -51,7 +51,7 @@ jobs: secrets: token: ${{ secrets.GH_TOKEN }} - # Edge build of every main push (see Aam-Digital/.github): version `vX.Y.Z-edge.N` (the last release with the patch + # Edge build of every main push (see Aam-Digital/.github): version `X.Y.Z-edge.N` (the last release with the patch # number bumped, plus the commits since), no tag and no GitHub release. edge-version: if: github.ref == 'refs/heads/main' @@ -61,7 +61,7 @@ jobs: permissions: contents: read - # Check names: `edge-build / build ()`, `edge-build / merge`. Image `vX.Y.Z-edge.N`, plus `edge` if this is still the newest main commit. + # Check names: `edge-build / build ()`, `edge-build / merge`. Image `X.Y.Z-edge.N`, plus `edge` if this is still the newest main commit. # A newer push cancels an older edge build, so that `edge` never moves back. edge-build: needs: edge-version @@ -76,3 +76,5 @@ jobs: images: ghcr.io/aam-digital/platform-admin-services version: ${{ needs.edge-version.outputs.version }} tags: ${{ needs.edge-version.outputs.is-head == 'true' && 'edge' || '' }} + # package.json's version is what the app reports to Sentry + prepare: npm version "$VERSION" --no-git-tag-version --allow-same-version diff --git a/.github/workflows/on-release.yml b/.github/workflows/on-release.yml index d9088c0..2fa6b23 100644 --- a/.github/workflows/on-release.yml +++ b/.github/workflows/on-release.yml @@ -15,10 +15,12 @@ jobs: packages: write with: images: ghcr.io/aam-digital/platform-admin-services - # Tag `` (e.g. `v1.7.4`, also the `org.opencontainers.image.version` label); + # Tag `` (e.g. `1.7.7`, also the `org.opencontainers.image.version` label); # full releases also `stable` and `latest` version: ${{ github.event.release.tag_name }} stable: ${{ !github.event.release.prerelease }} + # package.json's version is what the app reports to Sentry + prepare: npm version "$VERSION" --no-git-tag-version --allow-same-version # After a full release, the edge images (`*-edge.*`) of the finished cycle are no longer needed. The image `edge` # points to is kept. diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-closed.yml similarity index 84% rename from .github/workflows/pr-cleanup.yml rename to .github/workflows/pr-closed.yml index fc5904b..2e47289 100644 --- a/.github/workflows/pr-cleanup.yml +++ b/.github/workflows/pr-closed.yml @@ -1,4 +1,4 @@ -name: On PR Closed (cleanup pre-release image) +name: On PR closed (delete pre-release image) on: pull_request: @@ -7,8 +7,8 @@ on: permissions: {} jobs: - # Check name: `cleanup / cleanup` - cleanup: + # Check name: `cleanup-image / cleanup` + cleanup-image: # PRs from forks have no image if: github.event.pull_request.head.repo.full_name == github.repository uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@feat/reusable-workflows # TODO switch to @v1 diff --git a/.github/workflows/pr-release.yml b/.github/workflows/pr-release.yml index 90b702b..e042e4b 100644 --- a/.github/workflows/pr-release.yml +++ b/.github/workflows/pr-release.yml @@ -43,3 +43,6 @@ jobs: platforms: linux/amd64 # PRs from forks cannot push; only check that the image builds push: ${{ github.event.pull_request.head.repo.full_name == github.repository }} + # package.json's version is what the app reports to Sentry. npm only accepts semver, hence `0.0.0-pr.`; + # the image's version label is its tag `pr-`. + prepare: npm version "0.0.0-pr.${{ github.event.number }}" --no-git-tag-version --allow-same-version diff --git a/.nvmrc b/.nvmrc index df6ae33..a43a5b9 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -24.21.0 +24.22.0 diff --git a/.releaserc.json b/.releaserc.json new file mode 100644 index 0000000..765f069 --- /dev/null +++ b/.releaserc.json @@ -0,0 +1,15 @@ +{ + "tagFormat": "${version}", + "plugins": [ + "@semantic-release/commit-analyzer", + "@semantic-release/release-notes-generator", + [ + "@semantic-release/github", + { + "successComment": false, + "failComment": false, + "labels": false + } + ] + ] +} diff --git a/src/instrument.ts b/src/instrument.ts index 75cfb7c..302e5ba 100644 --- a/src/instrument.ts +++ b/src/instrument.ts @@ -1,11 +1,14 @@ import * as Sentry from "@sentry/nestjs"; import { nodeProfilingIntegration } from "@sentry/profiling-node"; +import { version } from "../package.json"; /** * Sentry must be initialised before anything else is imported. * This file is imported at the very top of main.ts. */ Sentry.init({ + // set by CI for each image build (release, edge or `0.0.0-pr.`) + release: version, dsn: process.env.SENTRY_DSN, environment: process.env.SENTRY_ENVIRONMENT ?? "development", integrations: [nodeProfilingIntegration()], diff --git a/tsconfig.json b/tsconfig.json index 399b42b..bfdfc30 100644 --- a/tsconfig.json +++ b/tsconfig.json @@ -6,6 +6,7 @@ "emitDecoratorMetadata": true, "experimentalDecorators": true, "allowSyntheticDefaultImports": true, + "resolveJsonModule": true, "target": "ES2021", "lib": ["ESNext"], "sourceMap": true, From ebabd17fa39fc05bb781f82e8bdb2bc27b306435 Mon Sep 17 00:00:00 2001 From: Sebastian Leidig Date: Tue, 20 Oct 2026 11:28:17 +0200 Subject: [PATCH 6/6] ci: call the shared workflows at @v1 Aam-Digital/.github#1 is merged and tagged `v1`; its branch is deleted. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/actionlint.yml | 2 +- .github/workflows/on-push.yml | 6 +++--- .github/workflows/on-release.yml | 4 ++-- .github/workflows/pr-closed.yml | 2 +- .github/workflows/pr-release.yml | 2 +- .github/workflows/pr-title-lint.yml | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml index c637340..6407e71 100644 --- a/.github/workflows/actionlint.yml +++ b/.github/workflows/actionlint.yml @@ -10,6 +10,6 @@ permissions: {} jobs: # Check name: `actionlint / actionlint` actionlint: - uses: Aam-Digital/.github/.github/workflows/actionlint.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/actionlint.yml@v1 permissions: contents: read diff --git a/.github/workflows/on-push.yml b/.github/workflows/on-push.yml index af08ad1..932198b 100644 --- a/.github/workflows/on-push.yml +++ b/.github/workflows/on-push.yml @@ -45,7 +45,7 @@ jobs: if: github.ref == 'refs/heads/main' needs: - test - uses: Aam-Digital/.github/.github/workflows/release.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/release.yml@v1 permissions: contents: read # everything that writes uses the GH_TOKEN PAT (its releases trigger the image build) secrets: @@ -57,7 +57,7 @@ jobs: if: github.ref == 'refs/heads/main' needs: - test - uses: Aam-Digital/.github/.github/workflows/edge-version.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/edge-version.yml@v1 permissions: contents: read @@ -68,7 +68,7 @@ jobs: concurrency: group: edge-build cancel-in-progress: true - uses: Aam-Digital/.github/.github/workflows/docker-image.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/docker-image.yml@v1 permissions: contents: read packages: write diff --git a/.github/workflows/on-release.yml b/.github/workflows/on-release.yml index 2fa6b23..a8fda51 100644 --- a/.github/workflows/on-release.yml +++ b/.github/workflows/on-release.yml @@ -9,7 +9,7 @@ permissions: {} jobs: # Check names: `build / build (linux/amd64)`, `build / build (linux/arm64)`, `build / merge` build: - uses: Aam-Digital/.github/.github/workflows/docker-image.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/docker-image.yml@v1 permissions: contents: read packages: write @@ -27,7 +27,7 @@ jobs: prune-edge-images: if: ${{ !github.event.release.prerelease }} needs: build - uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@v1 permissions: actions: write packages: write diff --git a/.github/workflows/pr-closed.yml b/.github/workflows/pr-closed.yml index 2e47289..e678549 100644 --- a/.github/workflows/pr-closed.yml +++ b/.github/workflows/pr-closed.yml @@ -11,7 +11,7 @@ jobs: cleanup-image: # PRs from forks have no image if: github.event.pull_request.head.repo.full_name == github.repository - uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/image-cleanup.yml@v1 permissions: actions: write # cancel a still running PR image build, which would otherwise push pr- after the cleanup packages: write # the package is linked to this repository, so the job token can delete its versions diff --git a/.github/workflows/pr-release.yml b/.github/workflows/pr-release.yml index e042e4b..eea2058 100644 --- a/.github/workflows/pr-release.yml +++ b/.github/workflows/pr-release.yml @@ -33,7 +33,7 @@ jobs: # Check names: `build / build (linux/amd64)`, `build / merge` build: needs: test - uses: Aam-Digital/.github/.github/workflows/docker-image.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/docker-image.yml@v1 permissions: contents: read packages: write diff --git a/.github/workflows/pr-title-lint.yml b/.github/workflows/pr-title-lint.yml index 204ecfe..5eb2adc 100644 --- a/.github/workflows/pr-title-lint.yml +++ b/.github/workflows/pr-title-lint.yml @@ -11,6 +11,6 @@ permissions: {} jobs: # Check name: `pr-title / Validate PR title` pr-title: - uses: Aam-Digital/.github/.github/workflows/pr-title-lint.yml@feat/reusable-workflows # TODO switch to @v1 + uses: Aam-Digital/.github/.github/workflows/pr-title-lint.yml@v1 permissions: pull-requests: read