docs: add GitHub downloads badge #45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build | |
| on: | |
| push: | |
| branches: | |
| - master | |
| # Least-privilege token. | |
| permissions: | |
| contents: write # push the release commit/tag and create the GitHub release | |
| id-token: write # OIDC token for build-provenance attestation (Sigstore signing) | |
| attestations: write # publish the artifact attestation | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| # Supply-chain gate: block the deploy on HIGH/CRITICAL vulnerabilities, | |
| # leaked secrets, or misconfigurations before anything is built or released. | |
| - name: Trivy security scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| scanners: vuln,secret,misconfig | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| env: | |
| # Also scan the build/CI dependency tree, not just runtime deps. | |
| TRIVY_INCLUDE_DEV_DEPS: "true" | |
| - name: Setup pnpm | |
| uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: "22" | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Create new version & CHANGELOG.md | |
| id: chkVersion | |
| run: pnpm run semantic-release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Print next version | |
| run: | | |
| echo ${{ steps.chkVersion.outputs.NEXT_RELEASE_VERSION }} | |
| echo ${{ steps.chkVersion.outputs.NEXT_RELEASE_NOTES }} | |
| echo "The next version is ${{ steps.chkVersion.outputs.NEXT_RELEASE_VERSION && steps.chkVersion.outputs.NEXT_RELEASE_VERSION || 'N/A' }}" >> $GITHUB_STEP_SUMMARY | |
| - name: Update version files and create tag | |
| # Only when semantic-release actually cut a version. Docs/chore/ci pushes | |
| # produce no release, so these steps are skipped and the run stays green. | |
| if: steps.chkVersion.outputs.NEXT_RELEASE_VERSION != '' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| pnpm run version | |
| # Stage only tracked changes (package.json, manifest.json, versions.json, | |
| # CHANGELOG.md). Never `git add .` here: the Trivy scan writes its multi-GB | |
| # vuln DB into ./.cache, which would otherwise be staged and blow past | |
| # GitHub's 100 MB push limit. | |
| git add -u | |
| - name: Build plugin | |
| run: pnpm run build | |
| - name: Create release | |
| if: steps.chkVersion.outputs.NEXT_RELEASE_VERSION != '' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| VERSION=$(node -p "require('./package.json').version") | |
| gh release create "$VERSION" \ | |
| --title="Release v$VERSION" \ | |
| main.js manifest.json styles.css | |
| # Build provenance: cryptographically attest (via Sigstore) that these exact | |
| # artifacts were produced by this workflow from this commit. Lets users verify | |
| # the release with `gh attestation verify main.js --repo <owner>/<repo>`. | |
| - name: Attest build provenance | |
| if: steps.chkVersion.outputs.NEXT_RELEASE_VERSION != '' | |
| uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 | |
| with: | |
| subject-path: | | |
| main.js | |
| manifest.json | |
| styles.css | |
| - name: Push Tag and staged Files | |
| if: steps.chkVersion.outputs.NEXT_RELEASE_VERSION != '' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| VERSION=$(node -p "require('./package.json').version") | |
| echo "Updating version files to $VERSION" | |
| git config user.name github-actions | |
| git config user.email github-actions@github.com | |
| git commit -am "chore(release): v${{ steps.chkVersion.outputs.NEXT_RELEASE_VERSION }} [skip ci] ${{ steps.chkVersion.outputs.NEXT_RELEASE_NOTES }}" | |
| git tag -a $VERSION -m "$VERSION" | |
| git push --follow-tags |