chore(ci): refactor build and release workflows #195

sapientpants · 2025-10-12T04:40:42Z

Summary

Major refactoring of GitHub Actions workflows to improve build consistency, security, and release automation. This PR consolidates the build process, adds Docker support, enhances security scanning, and improves overall workflow efficiency.

Key Changes

Build & Release Improvements

Unified Build Process: Consolidated build into single job that creates reusable artifacts
Build Artifacts: Build artifacts are now generated once and reused throughout the workflow
Build Manifest: Added manifest generation to track build metadata (SHA, timestamp, dependencies)
Tag Creation: Tags are now created BEFORE building artifacts for better traceability
Artifact Naming: Artifacts now include commit SHA for consistent naming with publish workflow

Docker Support

New Docker Workflow: Added reusable-docker.yml for multi-platform image builds (linux/amd64, linux/arm64)
Docker Artifacts: Docker images can be saved as artifacts for release
Configuration: Docker builds controlled via ENABLE_DOCKER_RELEASE variable

NPM Package Preparation

NPM Packaging: Added dedicated NPM package preparation job
Package Attestations: Generate SLSA provenance attestations for NPM packages
Package Manifest: Track all files included in NPM packages

Security Enhancements

CodeQL Integration: Added dedicated CodeQL workflow for security scanning
Consolidated Security: Unified security scanning in reusable-security.yml
SonarQube: Replaced DeepSource with SonarQube for code quality analysis
Dependency Scanning: Enhanced vulnerability scanning with better reporting

Developer Experience

Issue Templates: Added bug report and feature request templates
PR Template: Added comprehensive pull request template
Artifact Script: Added determine-artifact.sh for artifact resolution
Improved Documentation: Enhanced workflow comments for better maintainability

Workflow Optimization

Removed Redundancy: Deleted reusable-setup.yml (functionality merged into other workflows)
Better Job Dependencies: Clearer job dependency graph for parallel execution
Improved Permissions: Updated permissions for container registry access
Enhanced Validation: Better changeset validation in PR workflow

Files Changed

.github/workflows/main.yml - Major refactoring of main release workflow
.github/workflows/pr.yml - Updated PR validation workflow
.github/workflows/publish.yml - Enhanced publish workflow
.github/workflows/reusable-docker.yml - New Docker build workflow
.github/workflows/reusable-security.yml - Consolidated security scanning
.github/workflows/reusable-validate.yml - Enhanced validation workflow
.github/workflows/codeql.yml - New CodeQL security scanning
.github/ISSUE_TEMPLATE/ - New issue templates
.github/pull_request_template.md - New PR template
.github/scripts/determine-artifact.sh - New artifact resolution script
Deleted .github/workflows/reusable-setup.yml

Testing

All pre-commit hooks passed (tests, linting, formatting)
Type checking passed
All test suites passed with coverage

Benefits

Consistency: Single build artifact reused throughout workflow
Traceability: Build manifest and SHA-based naming improve artifact tracking
Security: Enhanced scanning with CodeQL and SonarQube
Flexibility: Docker and NPM releases can be enabled/disabled via configuration
Maintainability: Better structured workflows with clearer dependencies
Developer Experience: Templates guide contributors through issues and PRs

Migration Notes

Workflows now require SONAR_TOKEN secret (replaces DEEPSOURCE_DSN)
Docker releases require ENABLE_DOCKER_RELEASE variable set to true
NPM releases require ENABLE_NPM_RELEASE variable set to true
New permissions required: packages: write for container registry

🤖 Generated with Claude Code

- Consolidate build process with unified artifact generation - Add Docker image build support with multi-platform capability - Implement NPM package preparation workflow - Enhance security scanning with CodeQL integration - Replace DeepSource with SonarQube for code quality analysis - Add comprehensive issue templates and PR template - Improve artifact naming with commit SHA for traceability - Add build manifest generation for transparency - Update release process to create tag before artifacts - Add reusable Docker workflow for modularity 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

deepsource-io · 2025-10-12T04:41:06Z

Here's the code health analysis summary for commits d72e366..d97005e. View details on DeepSource ↗.

Analysis Summary

Analyzer	Status	Summary	Link
Test coverage	✅ Success		View Check ↗
JavaScript	✅ Success		View Check ↗

Code Coverage Report

Metric	Aggregate	Javascript
Branch Coverage	88.5%	88.5%
Composite Coverage	88.7%	88.7%
Line Coverage	88.7%	88.7%

💡 If you’re a repository administrator, you can configure the quality gates from the settings.

Copilot

Pull Request Overview

This PR performs a major refactoring of GitHub Actions workflows to consolidate build processes, enhance security scanning, and improve release automation. The changes separate concerns between validation, security scanning, artifact building, and publishing while adding Docker support and switching from DeepSource to SonarQube for code quality analysis.

Key changes include:

Unified build process with reusable artifacts and build manifests for better traceability
Separation of test execution from linting with dedicated security scanning workflow
Addition of Docker multi-platform builds and container security scanning with Trivy
Enhanced NPM package preparation with SLSA provenance attestations

Reviewed Changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`.github/workflows/reusable-validate.yml`	Split validation into separate test and lint jobs, replaced DeepSource with SonarQube, added changeset validation
`.github/workflows/reusable-setup.yml`	Deleted - functionality merged into other workflows
`.github/workflows/reusable-security.yml`	Consolidated security scanning with dependency audit and OSV scanner
`.github/workflows/reusable-docker.yml`	New Docker workflow with multi-platform builds and Trivy security scanning
`.github/workflows/publish.yml`	Enhanced to use pre-built artifacts with attestations and improved Docker publishing
`.github/workflows/pr.yml`	Updated to use new validation structure with optional Docker builds
`.github/workflows/main.yml`	Major refactor with unified build phase and separate artifact preparation jobs
`.github/workflows/codeql.yml`	New dedicated CodeQL security scanning workflow
`.github/scripts/determine-artifact.sh`	New script for resolving build artifacts from GitHub releases
`.github/pull_request_template.md`	New PR template for contributor guidance
`.github/ISSUE_TEMPLATE/feature_request.md`	New feature request issue template
`.github/ISSUE_TEMPLATE/bug_report.md`	New bug report issue template

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

.github/workflows/reusable-validate.yml

.github/workflows/reusable-docker.yml

.github/workflows/publish.yml

.github/workflows/main.yml

.github/scripts/determine-artifact.sh

github-advanced-security · 2025-10-12T04:43:06Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

- revert sonarqube changes to use deepsource for test coverage - update main.yml to pass DEEPSOURCE_DSN secret - update pr.yml to pass DEEPSOURCE_DSN secret - update reusable-validate.yml to expect DEEPSOURCE_DSN - preserve existing deepsource test coverage workflow integration 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

- add nodejs user with UID 1001 and GID 1001 (DS002 HIGH) - change ownership of /app directory to nodejs user - switch to non-root user before starting application - add HEALTHCHECK instruction for container monitoring (DS026 LOW) - resolves Trivy security scan failures 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

- remove HEALTHCHECK instruction as it doesn't provide meaningful verification for stdio-based MCP servers - DS026 (LOW severity) will be flagged but won't block builds - only HIGH/CRITICAL severities cause build failures 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

- document workflow improvements and consolidation - highlight docker security enhancements - note developer experience improvements - patch version bump for infrastructure changes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

- add HEALTHCHECK instruction for container monitoring - resolves DS026 (LOW severity) Trivy finding - ensures clean security scan with no findings 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings October 12, 2025 04:40

Copilot AI reviewed Oct 12, 2025

View reviewed changes

sapientpants and others added 5 commits October 12, 2025 06:53

sapientpants enabled auto-merge (squash) October 12, 2025 05:13

sapientpants merged commit 5c32dad into main Oct 12, 2025
12 checks passed

sapientpants deleted the chore/update-build-workflows branch October 12, 2025 05:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(ci): refactor build and release workflows #195

chore(ci): refactor build and release workflows #195

Uh oh!

sapientpants commented Oct 12, 2025

Uh oh!

deepsource-io bot commented Oct 12, 2025 •

edited

Loading

Analysis Summary

Code Coverage Report

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security bot commented Oct 12, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(ci): refactor build and release workflows #195

chore(ci): refactor build and release workflows #195

Uh oh!

Conversation

sapientpants commented Oct 12, 2025

Summary

Key Changes

Build & Release Improvements

Docker Support

NPM Package Preparation

Security Enhancements

Developer Experience

Workflow Optimization

Files Changed

Testing

Benefits

Migration Notes

Uh oh!

deepsource-io bot commented Oct 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Analysis Summary

Code Coverage Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security bot commented Oct 12, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

deepsource-io bot commented Oct 12, 2025 •

edited

Loading