feat: prepare repo for release with sanitized docs, license, pre-commit hook, and CI/CD workflows
This commit is contained in:
@@ -0,0 +1,108 @@
|
||||
name: CI Verification
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ main ]
|
||||
pull_request:
|
||||
branches: [ main ]
|
||||
|
||||
jobs:
|
||||
verify:
|
||||
name: Lint & Extension Integrity Check
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout Code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: '20'
|
||||
|
||||
- name: Validate manifest.json
|
||||
run: |
|
||||
echo "🔍 Validating manifest.json syntax and schema..."
|
||||
node -e "
|
||||
const manifest = JSON.parse(require('fs').readFileSync('manifest.json', 'utf8'));
|
||||
if (manifest.manifest_version !== 3) {
|
||||
console.error('Error: Manifest version must be 3');
|
||||
process.exit(1);
|
||||
}
|
||||
console.log('✅ manifest.json is valid (v' + manifest.version + ')');
|
||||
"
|
||||
|
||||
- name: Verify Referenced Assets & Files
|
||||
run: |
|
||||
echo "🔍 Checking that all files referenced in manifest.json exist..."
|
||||
node -e "
|
||||
const fs = require('fs');
|
||||
const manifest = JSON.parse(fs.readFileSync('manifest.json', 'utf8'));
|
||||
const files = [
|
||||
manifest.background?.service_worker,
|
||||
manifest.action?.default_popup,
|
||||
...(manifest.content_scripts?.flatMap(cs => cs.js) || []),
|
||||
...Object.values(manifest.icons || {})
|
||||
].filter(Boolean);
|
||||
|
||||
let missing = 0;
|
||||
for (const file of files) {
|
||||
if (!fs.existsSync(file)) {
|
||||
console.error('❌ Missing file referenced in manifest:', file);
|
||||
missing++;
|
||||
} else {
|
||||
console.log(' ✓ Found:', file);
|
||||
}
|
||||
}
|
||||
if (missing > 0) process.exit(1);
|
||||
console.log('✅ All manifest files exist!');
|
||||
"
|
||||
|
||||
- name: JavaScript Syntax Check
|
||||
run: |
|
||||
echo "🔍 Checking JavaScript syntax..."
|
||||
find scripts dashboard popup -name "*.js" | while read -r jsfile; do
|
||||
node --check "$jsfile"
|
||||
echo " ✓ Syntax valid: $jsfile"
|
||||
done
|
||||
echo "✅ All JavaScript files passed syntax verification!"
|
||||
|
||||
- name: Run Anti-Data-Leak Audit
|
||||
run: |
|
||||
echo "🔍 Checking repository for sensitive paths and keys..."
|
||||
ERRORS=0
|
||||
|
||||
# Check for forbidden export data or test archives
|
||||
if find . -name "*.zip" -o -name "activities.csv" -o -name "activities.json" | grep -v ".git" | grep -q .; then
|
||||
echo "❌ Forbidden data/archive file found in repository!"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
|
||||
# Check for hardcoded local machine paths
|
||||
if grep -rEn "(/Users/|/home/)[a-zA-Z0-9_\.-]+" --exclude-dir=".git" --exclude-dir=".githooks" --exclude="*.log" .; then
|
||||
echo "❌ Hardcoded local path detected in source code!"
|
||||
ERRORS=$((ERRORS + 1))
|
||||
fi
|
||||
|
||||
if [ "$ERRORS" -gt 0 ]; then
|
||||
echo "🚨 CI Audit failed with $ERRORS issue(s)."
|
||||
exit 1
|
||||
fi
|
||||
echo "✅ Security & data leak check passed!"
|
||||
|
||||
- name: Test Package Build
|
||||
run: |
|
||||
echo "📦 Building test extension package..."
|
||||
zip -r brightwheel-exporter-test.zip . \
|
||||
-x "*.git*" \
|
||||
-x ".githooks/*" \
|
||||
-x ".github/*" \
|
||||
-x "emmy/*" \
|
||||
-x "exports/*" \
|
||||
-x "data/*" \
|
||||
-x "*.md" \
|
||||
-x "LICENSE" \
|
||||
-x "brightwheel-exporter-test.zip"
|
||||
|
||||
echo "✅ Package built successfully:"
|
||||
unzip -l brightwheel-exporter-test.zip
|
||||
@@ -0,0 +1,71 @@
|
||||
name: Build & Package Extension Release
|
||||
|
||||
on:
|
||||
release:
|
||||
types: [published]
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
build-release:
|
||||
name: Build ZIP & Attach to GitHub Release
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout Code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Read Extension Version
|
||||
id: version
|
||||
run: |
|
||||
VERSION=$(node -p "require('./manifest.json').version")
|
||||
echo "EXT_VERSION=$VERSION" >> $GITHUB_ENV
|
||||
echo "Building extension release for version: $VERSION"
|
||||
|
||||
- name: Build Production Extension ZIP
|
||||
run: |
|
||||
ZIP_NAME="brightwheel-exporter-v${{ env.EXT_VERSION }}.zip"
|
||||
echo "📦 Packaging $ZIP_NAME..."
|
||||
zip -r "$ZIP_NAME" . \
|
||||
-x "*.git*" \
|
||||
-x ".githooks/*" \
|
||||
-x ".github/*" \
|
||||
-x "emmy/*" \
|
||||
-x "exports/*" \
|
||||
-x "data/*" \
|
||||
-x "test_data/*" \
|
||||
-x "*.md" \
|
||||
-x "LICENSE" \
|
||||
-x "*.zip"
|
||||
|
||||
echo "ZIP_FILE=$ZIP_NAME" >> $GITHUB_ENV
|
||||
echo "✅ Package contents verified:"
|
||||
unzip -l "$ZIP_NAME"
|
||||
|
||||
- name: Upload ZIP to GitHub Release Assets
|
||||
if: github.event_name == 'release'
|
||||
uses: softprops/action-gh-release@v2
|
||||
with:
|
||||
files: ${{ env.ZIP_FILE }}
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# ------------------------------------------------------------------------
|
||||
# TODO: Auto-Publish to Chrome Web Store
|
||||
# ------------------------------------------------------------------------
|
||||
# Once you create the initial extension item in the Chrome Web Store Developer
|
||||
# Dashboard and generate Google Cloud OAuth credentials, uncomment this step
|
||||
# and configure the following 4 secrets in GitHub (Settings > Secrets > Actions):
|
||||
# - CHROME_EXTENSION_ID
|
||||
# - CHROME_CLIENT_ID
|
||||
# - CHROME_CLIENT_SECRET
|
||||
# - CHROME_REFRESH_TOKEN
|
||||
# ------------------------------------------------------------------------
|
||||
# - name: Upload & Publish to Chrome Web Store
|
||||
# uses: fregante/chrome-web-store-upload-action@v2
|
||||
# with:
|
||||
# file-name: ${{ env.ZIP_FILE }}
|
||||
# extension-id: ${{ secrets.CHROME_EXTENSION_ID }}
|
||||
# client-id: ${{ secrets.CHROME_CLIENT_ID }}
|
||||
# client-secret: ${{ secrets.CHROME_CLIENT_SECRET }}
|
||||
# refresh-token: ${{ secrets.CHROME_REFRESH_TOKEN }}
|
||||
# publish: true
|
||||
Reference in New Issue
Block a user