Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/CODEOWNERS
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
* @splitio/sdk
7 changes: 7 additions & 0 deletions .github/pull_request_template.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# JavaScript Browser SDK

## What did you accomplish?

## How do we test the changes introduced in this PR?

## Extra Notes
142 changes: 142 additions & 0 deletions .github/workflows/ci-cd.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,142 @@
name: ci-cd
on:
pull_request:
branches:
- main
- development
push:
branches:
- '*'

env:
PUPPETEER_SKIP_DOWNLOAD: 'true'

concurrency:
group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.run_number || github.event.pull_request.number }}
cancel-in-progress: true

permissions:
contents: read

Check warning on line 19 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Move this read permission from workflow level to job level.

[S8264] Read permissions should be defined at the job level See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=202b0aab-0aab-4160-ac57-d567c177266e&open=202b0aab-0aab-4160-ac57-d567c177266e
id-token: write

Check warning on line 20 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Move this write permission from workflow level to job level.

[S8233] Write permissions should be defined at the job level See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=fd12fef4-e136-466d-91b6-c5f7de26e3c7&open=fd12fef4-e136-466d-91b6-c5f7de26e3c7

jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v5

- name: Setup Node.js
uses: actions/setup-node@v6
with:
node-version: 'lts/*'
cache: 'npm'

- name: npm ci
run: npm ci

Check warning on line 37 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Omitting "--ignore-scripts" can lead to the execution of shell scripts. Make sure it is safe here.

[S6505] Allowing shell scripts execution during package installation is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=073896ba-8e47-429c-aee6-9d7110620b3f&open=073896ba-8e47-429c-aee6-9d7110620b3f

- name: Setup Chrome
uses: browser-actions/setup-chrome@19ae4b339ee18925ab85cf12c1041150ea4a44c8 # v1
with:
chrome-version: '125'
- name: Set CHROME_BIN
run: echo "CHROME_BIN=$(which chrome)" >> $GITHUB_ENV

- name: npm test-ts-decls
run: npm run test-ts-decls

- name: npm check
run: npm run check

- name: npm test
run: npm run test

- name: npm build
run: BUILD_BRANCH=$(echo "${GITHUB_REF#refs/heads/}") npm run build

- name: Store assets
if: ${{ github.event_name == 'push' && (github.ref == 'refs/heads/development' || github.ref == 'refs/heads/main') }}
uses: actions/upload-artifact@v5
with:
name: assets
path: umd/
retention-days: 1

upload-stage:
name: Upload assets
runs-on: ubuntu-latest
needs: build
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/development' }}
strategy:
matrix:
environment:
- stage
include:
- environment: stage
account_id: "079419646996"
bucket: split-public-stage

steps:
- name: Download assets
uses: actions/download-artifact@v6
with:
name: assets
path: umd

- name: Display structure of assets
run: ls -R
working-directory: umd

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4

Check warning on line 92 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=5e7d0364-05cf-48ba-a5f8-01ab47031b9d&open=5e7d0364-05cf-48ba-a5f8-01ab47031b9d
with:
role-to-assume: arn:aws:iam::${{ matrix.account_id }}:role/gha-public-assets-role
aws-region: us-east-1

- name: Upload to S3
run: aws s3 sync $SOURCE_DIR s3://$BUCKET/$DEST_DIR $ARGS
env:
BUCKET: ${{ matrix.bucket }}
SOURCE_DIR: ./umd
DEST_DIR: sdk
ARGS: --acl public-read --follow-symlinks --cache-control max-age=31536000,public

upload-prod:
name: Upload assets
runs-on: ubuntu-latest
needs: build
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
strategy:
matrix:
environment:
- prod
include:
- environment: prod
account_id: "825951051969"
bucket: split-public

steps:
- name: Download assets
uses: actions/download-artifact@v6
with:
name: assets
path: umd

- name: Display structure of assets
run: ls -R
working-directory: umd

- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v4

Check warning on line 131 in .github/workflows/ci-cd.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=f24501bf-095c-48f4-8720-a92855556be8&open=f24501bf-095c-48f4-8720-a92855556be8
with:
role-to-assume: arn:aws:iam::${{ matrix.account_id }}:role/gha-public-assets-role
aws-region: us-east-1

- name: Upload to S3
run: aws s3 sync $SOURCE_DIR s3://$BUCKET/$DEST_DIR $ARGS
env:
BUCKET: ${{ matrix.bucket }}
SOURCE_DIR: ./umd
DEST_DIR: sdk
ARGS: --acl public-read --follow-symlinks --cache-control max-age=31536000,public
66 changes: 66 additions & 0 deletions .github/workflows/sonar-scan.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
name: sonar-scan
on:
pull_request:
branches:
- main
- development
push:
branches:
- main
- development

jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v5
with:
fetch-depth: 0

- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: 'lts/*'
cache: 'npm'

- name: npm CI
run: npm ci

Check warning on line 29 in .github/workflows/sonar-scan.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Omitting "--ignore-scripts" can lead to the execution of shell scripts. Make sure it is safe here.

[S6505] Allowing shell scripts execution during package installation is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=dded4b87-aac3-45ec-a25a-a034952ee9b0&open=dded4b87-aac3-45ec-a25a-a034952ee9b0

- name: npm Check
run: npm run check

- name: npm Build
run: BUILD_BRANCH=$(echo "${GITHUB_REF#refs/heads/}") npm run build

- name: SonarQube Scan (Push)
if: github.event_name == 'push'
uses: SonarSource/sonarqube-scan-action@v6

Check warning on line 39 in .github/workflows/sonar-scan.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=12437986-85d9-4b94-b929-e57b83bdbece&open=12437986-85d9-4b94-b929-e57b83bdbece
env:
SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
with:
projectBaseDir: .
args: >
-Dsonar.host.url=${{ secrets.SONARQUBE_HOST }}
-Dsonar.projectName=${{ github.event.repository.name }}
-Dsonar.projectKey=${{ github.event.repository.name }}
-Dsonar.links.ci="https://github.com/splitio/${{ github.event.repository.name }}/actions"
-Dsonar.links.scm="https://github.com/splitio/${{ github.event.repository.name }}"

- name: SonarQube Scan (Pull Request)
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
uses: SonarSource/sonarqube-scan-action@v6

Check warning on line 53 in .github/workflows/sonar-scan.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=e0d1dcac-485d-4931-a7c0-bcb06e5e6ece&open=e0d1dcac-485d-4931-a7c0-bcb06e5e6ece
env:
SONAR_TOKEN: ${{ secrets.SONARQUBE_TOKEN }}
with:
projectBaseDir: .
args: >
-Dsonar.host.url=${{ secrets.SONARQUBE_HOST }}
-Dsonar.projectName=${{ github.event.repository.name }}
-Dsonar.projectKey=${{ github.event.repository.name }}
-Dsonar.links.ci="https://github.com/splitio/${{ github.event.repository.name }}/actions"
-Dsonar.links.scm="https://github.com/splitio/${{ github.event.repository.name }}"
-Dsonar.pullrequest.key=${{ github.event.pull_request.number }}
-Dsonar.pullrequest.branch=${{ github.event.pull_request.head.ref }}
-Dsonar.pullrequest.base=${{ github.event.pull_request.base.ref }}
45 changes: 45 additions & 0 deletions .github/workflows/update-notice-year.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
name: Update Notice Year

on:
schedule:
- cron: "0 3 1 1 *" # 03:00 AM on January 1

permissions:
contents: write
pull-requests: write

jobs:
test:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Set Current year
run: "echo CURRENT=$(date +%Y) >> $GITHUB_ENV"

- name: Set Previous Year
run: "echo PREVIOUS=$(($CURRENT-1)) >> $GITHUB_ENV"

- name: Update NOTICE
uses: jacobtomlinson/gha-find-replace@v3

Check warning on line 27 in .github/workflows/update-notice-year.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=0d5df086-912e-4eca-9db9-a973f098ca72&open=0d5df086-912e-4eca-9db9-a973f098ca72
with:
find: ${{ env.PREVIOUS }}
replace: ${{ env.CURRENT }}
include: "NOTICE"
regex: false

- name: Commit files
run: |
git config user.name 'github-actions[bot]'
git config user.email 'github-actions[bot]@users.noreply.github.com'
git commit -m "Updated Notice Year" -a

- name: Create Pull Request
uses: peter-evans/create-pull-request@v5

Check warning on line 41 in .github/workflows/update-notice-year.yml

View check run for this annotation

SonarQube Pull Requests / SonarQube Code Analysis

Use full commit SHA hash for this dependency.

[S7637] Using external GitHub actions and workflows without a commit reference is security-sensitive See more on https://sonar.harness.io/project/issues?id=javascript-browser-client&pullRequest=185&issues=a5c392a5-db40-48d2-a4be-810daa671cd9&open=a5c392a5-db40-48d2-a4be-810daa671cd9
with:
token: ${{ secrets.GITHUB_TOKEN }}
title: Update Notice Year
branch: update-notice
Loading
Loading