Skip to content

chore(npm): Update release npm action to stop using tokens#180

Merged
gnbm merged 6 commits intomainfrom
gm/review-publish-npm-ga
Nov 13, 2025
Merged

chore(npm): Update release npm action to stop using tokens#180
gnbm merged 6 commits intomainfrom
gm/review-publish-npm-ga

Conversation

@gnbm
Copy link
Copy Markdown
Contributor

@gnbm gnbm commented Oct 30, 2025

Pull request checklist

Please check if your PR fulfills the following requirements:

  • Docs have been reviewed and added / updated if needed (for bug fixes / features)
  • Build (npm run build) was run locally and any changes were pushed
  • Tests (npm test) were run locally and passed
  • [] Prettier (npm run prettier) was run locally and passed

Pull request type

Please check the type of change your PR introduces:

  • Bugfix
  • Feature
  • Refactoring (no functional changes, no api changes)
  • Build related changes
  • Documentation content changes
  • Other (please describe): Workflow configuration update

What is the current behavior?

  • Some dependencies were outdated
  • Release workflows still pass long-lived npm tokens to the shared publish action, even though that action now relies on OIDC trusted publishing. This leaves unused secret references in the workflows and doesn’t fully enforce the token-free model.
  • Typed rule coverage was missing for config exports, ban-side-effects, dependency-suggestions, strict-mutable, and strict-boolean-conditions, leaving major rule branches untested.
  • Tests used .spec.ts filenames that Vitest didn’t pick up, fixtures were inline, and several edge cases weren’t exercised.
  • The suite often timed out at 10 s while the typed ESLint rules resolved project metadata.
  • The release workflow still referenced a long-lived GH_ADMIN_PAT, triggering a context warning when using trusted publishing.

GitHub Issue Number: N/A

What is the new behavior?

-Updated test tooling:
- jsdom to ^27.0.1
- @types/jsdom to ^27.0.0
- @types/node to ^24.9.2
- @typescript-eslint/eslint-plugin to ^8.46.2
- @typescript-eslint/parser to ^8.46.2
- @vitest/coverage-v8 to ^4.0.5
- eslint to ^9.38.0
- rolldown-plugin-dts to ^0.17.3
- typescript to ^5.9.3
- vitest to ^4.0.5

  • Removed the token input from release.yml so the job depends solely on OIDC.
  • Kept the PAT input used for tagging/releases while leaving the composite action to request npm tokens via OIDC.
  • Confirmed that the publish job retains permissions: id-token: write, satisfying npm’s trusted publisher guidance.
  • Added cross-platform Vitest suites (tests/**/*.test.ts) with dedicated fixtures that cover the previously untested configs and rules.
  • Renamed legacy .spec.ts files to .test.ts and expanded fixtures to cover unions, option toggles, skip logic, and mutable prop handling.
  • Increased the Vitest timeout to 30 s and aligned the branch coverage threshold to 75%, keeping other thresholds intact.

Does this introduce a breaking change?

  • Yes
  • No

Testing

  • npm run build

  • npm run test

    • Verified output shows all suites passing locally:
      • Test Files: 27 passed
      • Tests: 30 passed
  • Consider triggering dev/stable release jobs to verify OIDC publishing end-to-end.

Other information

  • N/A

@gnbm gnbm added github_actions Pull requests that update GitHub Actions code dependencies Pull requests that update a dependency file labels Oct 30, 2025
@gnbm gnbm marked this pull request as ready for review October 30, 2025 18:03
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates project dependencies, reorganizes test files from .spec.ts to .test.ts naming convention, adjusts Vitest configuration, and modernizes GitHub Actions workflows. The changes include major version bumps for testing libraries (vitest 3→4, jsdom 26→27), TypeScript tooling updates, and expanded test coverage for several ESLint rules.

  • Major dependency updates including vitest, jsdom, TypeScript, and @typescript-eslint packages
  • Test file reorganization with .spec.ts.test.ts renaming and additional test cases
  • Vitest configuration adjustments (timeout increase and coverage threshold reduction)

Reviewed Changes

Copilot reviewed 26 out of 27 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
vitest.config.ts Increased test timeout and lowered branch coverage threshold
tests/rules/strict-mutable/*.test.ts Renamed from .spec.ts and added new test fixtures
tests/rules/strict-boolean-conditions/*.test.ts New comprehensive test suite with multiple fixtures
tests/rules/dependency-suggestions/*.test.ts New test suite for dependency suggestions rule
tests/rules/ban-side-effects/*.test.ts New test suite for ban-side-effects rule
tests/configs/configs.test.ts New test suite for configuration exports
package.json Updated dependency versions across the board
package-lock.json Lockfile updates for all dependency changes
.github/workflows/*.yml Updated Node.js setup action and added emojis to job names

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gnbm gnbm requested a review from Copilot November 9, 2025 16:49
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

Copilot reviewed 26 out of 27 changed files in this pull request and generated 1 comment.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@gnbm gnbm merged commit 03f56fc into main Nov 13, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants