👷 ASL-4247: Publish to GitHub repo instead of private HomeOffice repo. (

#12)

* ASL-4247: Add Dependabot

* ASL-4247: Add Codeql

* ASL-4247: Add sas test workflow

* ASL-4247: Publish to GitHub repo to avoid private HomeOffice repo.
This is a public repo so there is no need to publish this to the private Artifactory repo. This allows us to simplify CI pipelines and let developers access with credentials they already have.

* ASL-4247 - Corrected env var reference in .npmrc

---------

Co-authored-by: Tom Rowsell <[email protected]>

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "⬆️ "
+    pull-request-branch-name:
+      separator: "-"
+    reviewers:
+      - "UKHomeOffice/asl-devs"
+    labels:
+      - "skip-release"
+      - "dependencies"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "⬆️ "
+    pull-request-branch-name:
+      separator: "-"
+    reviewers:
+      - "UKHomeOffice/asl-devs"
+    labels:
+      - "patch"
+      - "dependencies"

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,39 @@
+name: "CodeQL Scan"
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '45 12 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/publish-npm.yml

@@ -0,0 +1,9 @@
+name: 'Publish - npm'
+on:
+  pull_request:
+    types: [ closed ]
+
+jobs:
+  publish:
+    uses: UKHomeOffice/sas-github-workflows/.github/workflows/publish-npm.yml@v1
+    secrets: inherit

.github/workflows/semver-check-increment-npm.yml

@@ -0,0 +1,8 @@
+name: 'Increment Version - npm'
+on:
+  pull_request:
+    types: [ labeled, unlabeled, opened, reopened, synchronize ]
+
+jobs:
+  version:
+    uses: UKHomeOffice/sas-github-workflows/.github/workflows/semver-check-increment-npm.yml@v1

.github/workflows/test.yml

@@ -0,0 +1,9 @@
+name: 'Test'
+on:
+  pull_request:
+    types: [ opened, reopened, synchronize ]
+
+jobs:
+  test:
+    uses: UKHomeOffice/sas-github-workflows/.github/workflows/test-npm.yml@v1
+    secrets: inherit

.npmrc

@@ -1,6 +1,2 @@
-@asl:registry = https://artifactory.digital.homeoffice.gov.uk/artifactory/api/npm/npm-virtual/
-
-//artifactory.digital.homeoffice.gov.uk/artifactory/api/npm/npm-virtual/:username=${NPM_AUTH_USERNAME}
-//artifactory.digital.homeoffice.gov.uk/artifactory/api/npm/npm-virtual/:_password=${NPM_AUTH_TOKEN}
-//artifactory.digital.homeoffice.gov.uk/artifactory/api/npm/npm-virtual/:email=[email protected]
-//artifactory.digital.homeoffice.gov.uk/artifactory/api/npm/npm-virtual/:always-auth=true
+@ukhomeoffice:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

README.md

@@ -2,23 +2,32 @@
 
 Expansions of acronyms commonly used in ASL projects
 
-
 ## Usage
 
+[Authenticate with GitHub packages](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-npm-registry#authenticating-with-a-personal-access-token)
+
 Install the package:
 
 ```bash
-npm install @asl/dictionary --save-prod
+npm install @ukhomeoffice/asl-dictionary --save-prod
 ```
 
 Import as necessary:
 
 ```js
-const dictionary = require('@asl/dictionary');
+const dictionary = require('@ukhomeoffice/asl-dictionary');
 console.log(dictionary.NACWO);
 ```
 
 result:
 ```bash
 Named Animal Care and Welfare Officer
 ```
+
+## Publishing
+
+This is automatically published to the GitHub packages npm repository using GitHub Actions.
+
+When opening a pull request add a label `major`, `minor` or `patch` (or `skip-release`) and the version field in package.json will be updated by the pipeline using `npm version`.
+
+It is published once the pull request is merged if there is no `skip-release` label on the pull request, the SHA is also tagged with the SemVer value at that point.

package.json

@@ -1,10 +1,13 @@
 {
-  "name": "@asl/dictionary",
-  "version": "1.1.5",
+  "name": "@ukhomeoffice/asl-dictionary",
+  "version": "2.0.0",
   "description": "Expansions of acronyms commonly used in ASL projects",
   "main": "index.js",
   "scripts": {
-    "test": "eslint ."
+    "build": "exit 0",
+    "test": "exit 0",
+    "lint": "eslint .",
+    "audit": "npm audit"
   },
   "repository": {
     "type": "git",
@@ -18,7 +21,7 @@
   },
   "homepage": "https://github.com/UKHomeOffice/asl-dictionary#readme",
   "publishConfig": {
-    "registry": "https://artifactory.digital.homeoffice.gov.uk/artifactory/api/npm/npm-virtual/"
+    "@ukhomeoffice:registry": "https://npm.pkg.github.com"
   },
   "devDependencies": {
     "eslint": "^8.27.0"