ci: remove legacy manual-release.yml workflow #442
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Node CI | |
| on: | |
| push: | |
| branches: [ master ] | |
| pull_request: | |
| branches: [ master ] | |
| jobs: | |
| # Security audit - quick check for critical vulnerabilities | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Use Node.js 24 | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Security audit (runtime deps only) | |
| # The published package only ships @aws-sdk/client-s3 as a | |
| # runtime dep — dev-tree vulns (artillery's transitive uuid, | |
| # vitest's vite, etc.) don't reach consumers. Gate on runtime | |
| # exposure only; track dev-tree vulns separately via Dependabot. | |
| run: npm audit --audit-level critical --omit=dev | |
| # Core tests - build, lint, type-check, unit tests | |
| test: | |
| name: "Core Tests" | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| node-version: [22, 24, 26] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Type check | |
| run: npm run type-check | |
| - name: Build | |
| run: npm run build | |
| - name: Unit tests | |
| run: npm run test:unit | |
| - name: Coverage | |
| run: npm run test:coverage | |
| if: matrix.node-version == 24 | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v7 | |
| if: matrix.node-version == 24 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| fail_ci_if_error: false | |
| # Examples smoke test - boots each example on a free port and asserts | |
| # health/200/404 paths. Catches example regressions (route syntax, | |
| # error handler shape) that unit tests can't see. | |
| smoke-tests: | |
| name: "Examples Smoke" | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| # Dependabot PRs don't receive repo secrets, so configure-aws-credentials | |
| # fails with "aws-region not supplied". Skip AWS-integration jobs for them; | |
| # they still run on push to master and on non-Dependabot PRs. | |
| if: github.actor != 'dependabot[bot]' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| - name: Use Node.js 24 | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Run smoke tests | |
| run: npm run test:smoke | |
| # Validation tests - comprehensive functionality testing | |
| validation-tests: | |
| name: "Validation Tests" | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| # See "Examples Smoke": skip on Dependabot PRs (no AWS secrets). | |
| if: github.actor != 'dependabot[bot]' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| - name: Use Node.js 24 | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run validation tests | |
| run: make validation-local | |
| - name: Upload validation test results | |
| uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: validation-test-results | |
| path: | | |
| test-results-*.json | |
| load-test-results-*.json | |
| *.log | |
| if-no-files-found: ignore | |
| # Performance tests - load testing with Artillery | |
| performance-tests: | |
| name: "Performance Tests" | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| # See "Examples Smoke": skip on Dependabot PRs (no AWS secrets). | |
| if: github.actor != 'dependabot[bot]' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Configure AWS Credentials | |
| uses: aws-actions/configure-aws-credentials@v4 | |
| with: | |
| aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| aws-region: ${{ secrets.AWS_REGION }} | |
| - name: Use Node.js 24 | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run conformance gate | |
| run: make conformance-local | |
| - name: Run load tests | |
| run: make artillery-local | |
| - name: Upload performance test results | |
| uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: performance-test-results | |
| path: | | |
| load-test-results-*.json | |
| *.log | |
| if-no-files-found: ignore | |
| # Create version tag and draft release on merge to master | |
| create-tag-and-draft-release: | |
| name: "Create Tag and Draft Release" | |
| runs-on: ubuntu-latest | |
| if: github.ref == 'refs/heads/master' && github.event_name == 'push' | |
| needs: [test, smoke-tests, validation-tests, performance-tests] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Get package version | |
| id: package-version | |
| run: echo "version=v$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT | |
| - name: Check if tag exists | |
| id: check-tag | |
| run: | | |
| if git rev-parse "${{ steps.package-version.outputs.version }}" >/dev/null 2>&1; then | |
| echo "exists=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "exists=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Create and push tag | |
| if: steps.check-tag.outputs.exists == 'false' | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| git tag -a "${{ steps.package-version.outputs.version }}" -m "Release ${{ steps.package-version.outputs.version }}" | |
| git push origin "${{ steps.package-version.outputs.version }}" | |
| - name: Get merge commit message | |
| id: commit-message | |
| run: | | |
| # Get the commit message and escape it for JSON | |
| COMMIT_MSG=$(git log -1 --pretty=format:"%B" | sed 's/"/\\"/g' | sed ':a;N;$!ba;s/\n/\\n/g') | |
| echo "message=$COMMIT_MSG" >> $GITHUB_OUTPUT | |
| - name: Create draft release | |
| if: steps.check-tag.outputs.exists == 'false' | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # The tag was created and pushed in the previous step, so the | |
| # release attaches to it directly. Do not pass --target: that sets | |
| # target_commitish, which must be a branch or commit SHA (a tag name | |
| # is rejected with "target_commitish is invalid"). | |
| gh release create "${{ steps.package-version.outputs.version }}" \ | |
| --title "Release ${{ steps.package-version.outputs.version }}" \ | |
| --notes "${{ steps.commit-message.outputs.message }}" \ | |
| --draft | |
| # Package verification - ensure package contents are correct | |
| package-verification: | |
| name: "Package Verification" | |
| runs-on: ubuntu-latest | |
| needs: [test] | |
| # Run across the full matrix: packaging is version-sensitive (ESM | |
| # resolution and install/import behavior differ between Node versions), | |
| # and this job needs no AWS credentials, so the extra coverage is cheap. | |
| strategy: | |
| matrix: | |
| node-version: [22, 24, 26] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Build | |
| run: npm run build | |
| - name: Create package (verification only) | |
| run: npm pack | |
| - name: Verify package contents | |
| run: | | |
| echo "📦 Package contents:" | |
| tar -tzf s3proxy-*.tgz | sort | |
| echo "" | |
| echo "📊 Package size:" | |
| ls -lh s3proxy-*.tgz | |
| echo "" | |
| echo "🔍 Verifying required files are present:" | |
| tar -tzf s3proxy-*.tgz | grep -E "(package\.json|README\.md|LICENSE|dist/)" || exit 1 | |
| - name: Test package installation | |
| run: | | |
| mkdir test-install | |
| cd test-install | |
| npm init -y | |
| npm install ../s3proxy-*.tgz | |
| node -e "import('s3proxy').then(pkg => { console.log('✅ Package installs correctly:', Object.keys(pkg)); }).catch(err => { console.error('❌ Package import failed:', err); process.exit(1); })" | |
| - name: Cleanup verification artifacts | |
| run: rm -f s3proxy-*.tgz |