ci: add scripts for automated pkg publication

Signed-off-by: Andres Correa Casablanca <[email protected]>

.editorconfig

@@ -10,6 +10,6 @@ indent_style = tab
 indent_size = 2
 trim_trailing_whitespace = true
 
-[*.md]
+[*.md,*.yml,*.yaml]
 indent_style = space
 indent_size = 2

.github/workflows/greetings.yml

@@ -1,14 +1,20 @@
-name: Greetings
+# SPDX-FileCopyrightText: 2024 KindSpells Labs S.L.
+#
+# SPDX-License-Identifier: MIT
 
-on: [pull_request, issues]
+name: "Greetings"
+
+on:
+  - "pull_request"
+  - "issues"
 
 jobs:
   greeting:
-    runs-on: ubuntu-latest
+    runs-on: "ubuntu-latest"
     steps:
-    - name: 'Greeting' # v1.2.0
-      uses: 'actions/first-interaction@1dbfe1ba5525b8257e1f259b09745bee346d62d8'
+    - name: "Greeting" # v1.2.0
+      uses: "actions/first-interaction@1dbfe1ba5525b8257e1f259b09745bee346d62d8"
       with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        issue-message: '🥳 Thank you for opening your first issue for Coder-Spirit/nominal ! 😀'
-        pr-message: '🥳 Thank you for your first PR on Coder-Spirit/nominal ! 😀'
+        repo-token: "${{ secrets.GITHUB_TOKEN }}"
+        issue-message: "🥳 Thank you for opening your first issue for Coder-Spirit/nominal ! 😀"
+        pr-message: "🥳 Thank you for your first PR on Coder-Spirit/nominal ! 😀"

.github/workflows/npm_publish.yml

@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: 2024 KindSpells Labs S.L.
+#
+# SPDX-License-Identifier: MIT
+
+name: "Publish Package to NPMJS"
+on:
+  release:
+    types: ["created"]
+jobs:
+  build:
+    strategy:
+      matrix:
+        node-version: [ 22 ]
+        os: [ "ubuntu-latest" ]
+        pnpm: [ "9.7.0" ]
+
+    runs-on: "${{ matrix.os }}"
+
+    permissions:
+      contents: "read"
+      id-token: "write"
+
+    steps:
+    - name: "Checkout repository" # v4.1.1
+      uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11"
+    - name: "Install PNPM" # v3.0.0
+      uses: "pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d"
+      with:
+        version: "${{ matrix.pnpm }}"
+    - name: "Use Node.js ${{ matrix.node-version }}" # v4.0.2
+      uses: "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
+      with:
+          node-version: "${{ matrix.node-version }}"
+          cache: "pnpm"
+          registry-url: "https://registry.npmjs.org"
+    - name: "Install dependencies"
+      run: "pnpm install --recursive --frozen-lockfile"
+    - name: "Publish to NPM registry"
+      run: "pnpm turbo publish:safe"
+      working-directory: "."
+      env:
+        NPM_CONFIG_PROVENANCE: "true"
+        NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}"

.github/workflows/tests.yml

@@ -1,46 +1,50 @@
-name: Tests
+# SPDX-FileCopyrightText: 2024 KindSpells Labs S.L.
+#
+# SPDX-License-Identifier: MIT
+
+name: "Tests"
 
 on:
   push:
-    branches: [ main ]
+    branches: [ "main" ]
   pull_request:
-    branches: [ main ]
+    branches: [ "main" ]
   merge_group:
-    branches: [ main]
+    branches: [ "main" ]
 
 defaults:
   run:
-    working-directory: .
+    working-directory: "."
 
 jobs:
   build:
     strategy:
       matrix:
         node-version: [ 18, 20, 22 ]
-        os: [ubuntu-latest, windows-latest, macos-latest]
-        pnpm: ['9.7.0']
+        os: ["ubuntu-latest", "windows-latest", "macos-latest"]
+        pnpm: ["9.7.0"]
 
-    runs-on: ${{ matrix.os }}
+    runs-on: "${{ matrix.os }}"
 
     env:
-      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+      TURBO_TOKEN: "${{ secrets.TURBO_TOKEN }}"
+      TURBO_TEAM: "${{ vars.TURBO_TEAM }}"
 
     steps:
-    - name: Checkout repository # v4.1.1
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-    - name: Install PNPM # v3.0.0
-      uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d
+    - name: "Checkout repository" # v4.1.1
+      uses: "actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11"
+    - name: "Install PNPM" # v3.0.0
+      uses: "pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d"
       with:
-        version: ${{ matrix.pnpm }}
-    - name: Use Node.js ${{ matrix.node-version }} # v4.0.2
-      uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8
+        version: "${{ matrix.pnpm }}"
+    - name: "Use Node.js ${{ matrix.node-version }}" # v4.0.2
+      uses: "actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8"
       with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'pnpm'
+        node-version: "${{ matrix.node-version }}"
+        cache: "pnpm"
 
     # All
-    - name: (All) Install dependencies
-      run: pnpm install --frozen-lockfile
-    - name: (All) Run All Tasks
-      run: pnpm turbo all
+    - name: "(All) Install dependencies"
+      run: "pnpm install --frozen-lockfile"
+    - name: "(All) Run All Tasks"
+      run: "pnpm turbo all"

@coderspirit/dev-configs/biome.jsonc

@@ -64,5 +64,23 @@
 		"clientKind": "git",
 		"defaultBranch": "main",
 		"useIgnoreFile": true
-	}
+	},
+	"overrides": [
+		{
+			"include": ["*.ts", "*.mts", "*.cts", "*.tsx"],
+			"linter": {
+				"rules": {
+					"complexity": { "useLiteralKeys": "off" }
+				}
+			}
+		},
+		{
+			"include": ["rollup.config.mjs", "vitest.config.mts"],
+			"linter": {
+				"rules": {
+					"style": { "noDefaultExport": "off" }
+				}
+			}
+		}
+	]
 }

@coderspirit/internal-tools/package.json

@@ -3,15 +3,21 @@
 	"private": true,
 	"type": "module",
 	"bin": {
-		"biome-check-staged": "./src/biome-check-staged.ts"
+		"biome-check-staged": "./src/biome-check-staged.sh",
+		"safe-publish": "./src/safe-publish.sh"
+	},
+	"scripts": {
+		"format": "pnpm biome check --write --files-ignore-unknown=true .",
+		"format-staged": "biome-check-staged",
+		"lint": "pnpm lint:biome",
+		"lint:biome": "pnpm biome check --files-ignore-unknown=true .",
+		"typecheck": "tsc --incremental true --tsBuildInfoFile .tsbuildinfo --noEmit -p ./tsconfig.json"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^1.8.3",
 		"@coderspirit/dev-configs": "workspace:*"
 	},
-	"scripts": {
-		"format": "pnpm biome check --write --files-ignore-unknown=true .",
-		"format-staged": "biome-check-staged",
-		"lint": "pnpm biome check --files-ignore-unknown=true ."
+	"dependencies": {
+		"zx": "^8.1.4"
 	}
 }

@coderspirit/internal-tools/src/biome-check-staged.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -eu;
+
+unset CDPATH; # For safety
+SCRIPT_DIR="$( cd -- "$( dirname -- "$0" )" &> /dev/null && pwd )";
+SCRIPT_DIR="$(realpath "${SCRIPT_DIR}")";
+
+DENO_FUTURE=1 "${SCRIPT_DIR}/biome-check-staged.ts" $@;

@coderspirit/internal-tools/src/biome-check-staged.ts

@@ -1,6 +1,7 @@
-#!/usr/bin/env -S deno run --no-config --allow-env --allow-read --allow-sys --allow-run
+#!/usr/bin/env -S deno run --node-modules-dir --unstable-byonm --allow-env --allow-read --allow-sys --allow-run
+
 import process from 'node:process'
-import { $ } from 'npm:[email protected]'
+import { $ } from 'zx'
 
 const JSON_EXT = 'json|jsonc'
 const JS_EXT = 'js|mjs|cjs|jsx'
@@ -16,7 +17,7 @@ const runGitDiffStaged = async (): Promise<string[]> => {
 	).lines()
 }
 
-export const main = async () => {
+const main = async () => {
 	const stagedFiles = (await runGitDiffStaged()).filter(file =>
 		extsRegex.test(file),
 	)

@coderspirit/internal-tools/src/safe-publish.sh

@@ -0,0 +1,9 @@
+#!/bin/sh
+
+set -eu;
+
+unset CDPATH; # For safety
+SCRIPT_DIR="$( cd -- "$( dirname -- "$0" )" &> /dev/null && pwd )";
+SCRIPT_DIR="$(realpath "${SCRIPT_DIR}")";
+
+DENO_FUTURE=1 "${SCRIPT_DIR}/safe-publish.ts" $@;

@coderspirit/internal-tools/src/safe-publish.ts

@@ -0,0 +1,74 @@
+#!/usr/bin/env -S deno run --node-modules-dir --unstable-byonm --allow-env --allow-read --allow-sys --allow-run
+
+import { readFile } from 'node:fs/promises'
+import process from 'node:process'
+
+import { $ } from 'zx'
+
+type PackageJson = {
+	name: string
+	version: string
+}
+
+const isPackageJson = (value: unknown): value is PackageJson => {
+	if (typeof value !== 'object' || value === null) {
+		throw new Error('Invalid package.json: not an object')
+	}
+
+	if (!('name' in value)) {
+		throw new Error('Invalid package.json: missing "name" field')
+	}
+	if (typeof value['name'] !== 'string') {
+		throw new Error('Invalid package.json: "name" field is not a string')
+	}
+
+	if (!('version' in value)) {
+		throw new Error('Invalid package.json: missing "version" field')
+	}
+	if (typeof value['version'] !== 'string') {
+		throw new Error('Invalid package.json: "version" field is not a string')
+	}
+
+	return true
+}
+
+const getPackageJson = async (): Promise<PackageJson> => {
+	const packageJsonStr = await readFile('package.json', 'utf-8')
+	const packageJson = JSON.parse(packageJsonStr) as unknown
+
+	if (!isPackageJson(packageJson)) {
+		throw new Error('Invalid package.json') // Never thrown
+	}
+
+	return packageJson
+}
+
+const getCurrentPublishedVersion = async (pkgName: string): Promise<string> => {
+	return (await $`npm view --workspaces false --json ${pkgName} version`)
+		.text()
+		.trim()
+		.replaceAll('"', '')
+}
+
+const main = async (): Promise<void> => {
+	const packageJson = await getPackageJson()
+	const publishedVersion = await getCurrentPublishedVersion(packageJson.name)
+
+	// TODO: improve checks, to ensure that versions grow monotonically
+	if (packageJson.version === publishedVersion) {
+		return // Nothing to publish
+	}
+
+	await $`pnpm publish --provenance --no-git-checks --access public`.stdio(
+		'inherit',
+		'inherit',
+		'inherit',
+	)
+}
+
+try {
+	await main()
+} catch (err) {
+	console.error(err)
+	process.exit(1)
+}

@coderspirit/internal-tools/tsconfig.json

@@ -0,0 +1,13 @@
+{
+	"extends": "@coderspirit/dev-configs/tsconfig",
+	"compilerOptions": {
+		"target": "es2022",
+		"lib": ["es2022"],
+		"module": "es2022",
+
+		"rootDir": ".",
+		"baseUrl": "./src/"
+	},
+	"include": ["src/**/*"],
+	"exclude": ["dist/**/*", "node_modules/**/*"]
+}

@coderspirit/lambda-ioc/package.json

@@ -27,7 +27,8 @@
 		"lint": "pnpm lint:biome",
 		"lint:biome": "pnpm biome check --files-ignore-unknown=true .",
 		"lint:publint": "publint",
-		"prepublishOnly": "turbo lint && turbo build",
+		"prepublishOnly": "turbo all",
+		"publish:safe": "safe-publish",
 		"test": "vitest -c vitest.config.mts run",
 		"test:cov": "vitest -c vitest.config.mts run --coverage",
 		"typecheck": "tsc --incremental true --tsBuildInfoFile .tsbuildinfo --noEmit -p ./tsconfig.json"

@coderspirit/nominal-inputs/package.json

@@ -27,7 +27,8 @@
 		"lint": "pnpm lint:biome",
 		"lint:biome": "pnpm biome check --files-ignore-unknown=true .",
 		"lint:publint": "publint",
-		"prepublishOnly": "turbo lint && turbo build",
+		"prepublishOnly": "turbo all",
+		"publish:safe": "safe-publish",
 		"typecheck": "tsc --incremental true --tsBuildInfoFile .tsbuildinfo --noEmit -p ./tsconfig.json"
 	},
 	"dependencies": {

@coderspirit/nominal-symbols/package.json

@@ -27,7 +27,8 @@
 		"lint": "pnpm lint:biome",
 		"lint:biome": "pnpm biome check --files-ignore-unknown=true .",
 		"lint:publint": "publint",
-		"prepublishOnly": "turbo lint && turbo build",
+		"prepublishOnly": "turbo all",
+		"publish:safe": "safe-publish",
 		"typecheck": "tsc --incremental true --tsBuildInfoFile .tsbuildinfo --noEmit -p ./tsconfig.json"
 	},
 	"peerDependencies": {

@coderspirit/nominal/package.json

@@ -27,7 +27,8 @@
 		"lint": "pnpm lint:biome",
 		"lint:biome": "pnpm biome check --files-ignore-unknown=true .",
 		"lint:publint": "publint",
-		"prepublishOnly": "turbo lint && turbo build",
+		"prepublishOnly": "turbo all",
+		"publish:safe": "safe-publish",
 		"test": "vitest -c vitest.config.mts run",
 		"test:cov": "vitest -c vitest.config.mts run --coverage",
 		"typecheck": "tsc --incremental true --tsBuildInfoFile .tsbuildinfo --noEmit -p ./tsconfig.json"

@coderspirit/safe-env/package.json

@@ -27,7 +27,8 @@
 		"lint": "pnpm lint:biome",
 		"lint:biome": "pnpm biome check --files-ignore-unknown=true .",
 		"lint:publint": "publint",
-		"prepublishOnly": "turbo lint && turbo build",
+		"prepublishOnly": "turbo all",
+		"publish:safe": "safe-publish",
 		"test": "vitest -c vitest.config.mts run",
 		"test:cov": "vitest -c vitest.config.mts run --coverage",
 		"typecheck": "tsc --incremental true --tsBuildInfoFile .tsbuildinfo --noEmit -p ./tsconfig.json"