Merge pull request #48 from oxidecomputer/hardening

Release / npm / repo hardening

Author: benjaminleonard

.github/workflows/check-release.yml

@@ -1,30 +1,73 @@
 name: Release
 
-on: [push]
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+# Enabled permissions on GITHUB_TOKEN
+permissions:
+  # To be able to push to the repo
+  contents: write
+  # To update the pr description with canary info
+  pull-requests: write
+  # For pr-check to create a status
+  statuses: write
+  # Needed to create PR statuses/checks
+  checks: write
+  # To post comments on PRs
+  issues: write
+  # For trusted publishing
+  id-token: write
 
 jobs:
-  release:
+  install:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22.x
+      - run: npm install
+      - run: npm run tsc
+
+  validate-labels:
     runs-on: ubuntu-latest
     if:
       "!contains(github.event.head_commit.message, 'ci skip') &&
       !contains(github.event.head_commit.message, 'skip ci')"
     steps:
-      - uses: actions/checkout@v2
-
-      - name: Prepare repository
-        run: git fetch --unshallow --tags
-
-      - name: Use Node.js 16.x
-        uses: actions/setup-node@v1
+      - uses: actions/checkout@v5
+      - run: git fetch --unshallow --tags
+      - uses: actions/setup-node@v5
         with:
-          node-version: 16.x
-
-      - name: Install dependencies
-        uses: bahmutov/npm-install@v1
+          node-version: 22.x
+      - run: npm install
+      - name: Verify Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run:
+          npx auto pr-check
+          --url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID
 
+  release:
+    runs-on: ubuntu-latest
+    environment: production
+    if:
+      "!contains(github.event.head_commit.message, 'ci skip') &&
+      !contains(github.event.head_commit.message, 'skip ci')"
+    steps:
+      - uses: actions/checkout@v5
+      - run: git fetch --unshallow --tags
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22.x
+          cache: 'npm'
+      - run: npm install
+      - run: npm install -g npm@latest
       - name: Create Release
+        run: npm run build && npm run release
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          npm run build && npm run release
+          # auto expects GH_TOKEN in the environment
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}