Merge pull request #771 from vinayakkulkarni/refactor/bundle-with-vite

.eslintrc.js → .eslintrc.cjs

@@ -4,13 +4,12 @@ module.exports = {
     browser: true,
     es6: true,
   },
+  parser: '@typescript-eslint/parser', // add the TypeScript parser
   parserOptions: {
-    parser: '@typescript-eslint/parser',
     ecmaVersion: 2020,
     sourceType: 'module',
     lib: ['es2020'],
     tsconfigRootDir: __dirname,
-    project: ['./tsconfig.json'],
     extraFileExtensions: ['.svelte'],
   },
   overrides: [
@@ -19,13 +18,12 @@ module.exports = {
       processor: 'svelte3/svelte3',
     },
   ],
-  plugins: ['svelte3', 'jsdoc', '@typescript-eslint'],
+  plugins: ['svelte3', 'security', 'jsdoc', '@typescript-eslint'],
   extends: [
-    'eslint:recommended',
     'plugin:@typescript-eslint/recommended',
     'plugin:@typescript-eslint/eslint-recommended',
-    'plugin:@typescript-eslint/recommended-requiring-type-checking',
     'plugin:jsdoc/recommended',
+    'plugin:security/recommended',
     'prettier',
   ],
   // add your custom rules here
@@ -34,6 +32,6 @@ module.exports = {
     'no-debugger': process.env.NODE_ENV === 'production' ? 'error' : 'off',
   },
   settings: {
-    'svelte3/typescript': true,
+    'svelte3/typescript': () => require('typescript'), // pass the TypeScript package to the Svelte plugin
   },
 };

.github/workflows/ci.yml

@@ -26,35 +26,42 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        node: [16]
 
     steps:
-      - name: Check out repository (push)
-        if: ${{ github.event_name == 'push' || github.event_name == 'pull_request_target' || github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }}
+      - name: Check out repository ✨
+        if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' || github.event_name == 'pull_request_target' && github.actor != 'dependabot[bot]' }}
         uses: actions/checkout@v3
 
-      - name: Check out repository (pull_request_target)
+      - name: Check out repository 🎉 (dependabot)
         if: ${{ github.event_name == 'pull_request_target' }}
         uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Setup node env 📦
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v3.4.1
         with:
-          node-version: ${{ matrix.node }}
+          node-version-file: '.nvmrc'
+          registry-url: https://registry.npmjs.org
           check-latest: true
-          registry-url: 'https://registry.npmjs.org'
           cache: 'npm'
 
-      - name: Upgrade npm ✨
-        run: npm i -g npm@latest
-
       - name: Install dependencies 🚀
-        run: npm ci --prefer-offline --no-audit --no-optional
+        run: npm ci --prefer-offline --no-audit
 
       - name: Run linter(s) 👀
-        run: npm run lint
+        uses: wearerequired/lint-action@v2
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          continue_on_error: true
+          git_name: github-actions[bot]
+          git_email: github-actions[bot]@users.noreply.github.com
+          auto_fix: false
+          eslint: true
+          eslint_extensions: js,ts,svelte
+          prettier: true
+          prettier_extensions: js,ts,svelte
+          neutral_check_on_warning: true
 
-      - name: Check build 🎉
-        run: npm run build
+      - name: Run build 🏁
+        run: npm run build

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,59 @@
+name: 'CodeQL'
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [main]
+  schedule:
+    - cron: '45 23 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript']
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
+        # Learn more about CodeQL language support at https://git.io/codeql-language-support
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
+
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
+
+      #- run: |
+      #   make bootstrap
+      #   make release
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/lint-pr.yml

@@ -0,0 +1,29 @@
+name: 'Lint PR'
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+jobs:
+  check-sign-off:
+    if: startsWith(github.head_ref, 'releases/v') == false
+    name: Write comment if unsigned commits found
+    env:
+      FORCE_COLOR: 1
+    runs-on: ubuntu-latest
+    steps:
+      - uses: live627/check-pr-signoff-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  semantic-pull-request:
+    name: Validate PR title
+    needs: [check-sign-off]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@v4
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/shipjs-trigger.yml

@@ -9,27 +9,24 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'releases/v')
     steps:
-      - name: Checkout 🛎️
+      - name: Checkout code 🛎
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
           ref: main
 
-      - name: Setup node env 📦
-        uses: actions/setup-node@v3
+      - name: Setup node env 🏗
+        uses: actions/setup-node@v3.4.1
         with:
-          node-version: 16
+          node-version-file: '.nvmrc'
+          registry-url: https://registry.npmjs.org
           check-latest: true
-          registry-url: 'https://npm.pkg.github.com'
           cache: 'npm'
-
-      - name: Upgrade npm 🎉
-        run: npm install -g npm@latest
 
       - name: Install dependencies 🚀
-        run: npm ci --prefer-offline --no-audit --no-optional
+        run: npm ci --prefer-offline --no-audit
 
-      - name: Perform a new release 🚨
+      - name: Release new version to registry 🎉
         run: npx shipjs trigger
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.husky/commit-msg

@@ -1,4 +1,21 @@
 #!/bin/sh
 . "$(dirname "$0")/_/husky.sh"
 
-npx --no-install commitlint --edit $1
+NAME=$(git config user.name)
+EMAIL=$(git config user.email)
+
+if [ -z "$NAME" ]; then
+    echo "empty git config user.name"
+    exit 1
+fi
+
+if [ -z "$EMAIL" ]; then
+    echo "empty git config user.email"
+    exit 1
+fi
+
+git interpret-trailers --if-exists doNothing --trailer \
+    "Signed-off-by: $NAME <$EMAIL>" \
+    --in-place "$1"
+
+npm exec --no -- commitlint --edit $1

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/bin/sh
 . "$(dirname "$0")/_/husky.sh"
 
-npm run lint-staged
+npm exec --no -- lint-staged --no-stash

.nvmrc

@@ -0,0 +1 @@
+18.8.0

.vscode/settings.json

@@ -3,5 +3,4 @@
     "editor.defaultFormatter": "svelte.svelte-vscode"
   },
   "files.eol": "\n",
-  "typescript.tsdk": "node_modules/typescript/lib"
 }