Skip to content

Github Actions, auto versioning, avoid submitting internal files - #24

Open
erikn69 wants to merge 4 commits into
arnab:masterfrom
erikn69:actions
Open

erikn69 wants to merge 4 commits into
arnab:masterfrom
erikn69:actions

Conversation

@erikn69

@erikn69 erikn69 commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

This would further streamline the process, as taxpayers would not need to manually modify the files containing the versions.

  1. Added a release script to bump the version,
  2. automatically update the relevant files with version(package.json, jquery.pretty-text-diff.*),
  3. automatically create the github tag
  4. added github actions for cake and release

It supports:

  • npm version patch: bug fixes (1.0.41.0.5)
  • npm version minor: new backward-compatible features (1.0.41.1.0)
  • npm version major: breaking changes (1.0.42.0.0)

for npm publish: secrets.NPM_TOKEN is necessary
bug fixed: uglifyjs --o(double --) doesn't work anymore, it must be -o or --output

@arnab

arnab commented Sep 11, 2026

Copy link
Copy Markdown
Owner

for npm publish: secrets.NPM_TOKEN is necessary

Hmmm I will have to look into setting this up...

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Unresolved security, CI permission, reproducibility, packaging, and release-integrity findings remain.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR automates versioning, generated-file updates, CI builds, tagging, and npm releases while excluding internal files from distributions.

Changes:

  • Adds automated version synchronization and release hooks.
  • Updates build commands, documentation, and generated metadata.
  • Adds CI and release workflows.
  • Configures package and archive exclusions.
File summaries
File Summary and review findings
scripts/bump-coffee-version.js Synchronizes package and CoffeeScript versions.
README.md Documents automated versioning.
package.json Adds release configuration. Moderate (1 vote): git add -A may stage unrelated files; stage only intended release files.
jquery.pretty-text-diff.js Updates generated metadata.
Cakefile Fixes the UglifyJS output option.
.github/workflows/release.yml Builds and publishes tagged releases. Critical (1 vote): job-scoped npm credentials are exposed during install/build. Moderate (1 vote): rebuilt artifacts may differ from tagged files. Moderate (3 votes): build tools are not pinned.
.github/workflows/ci.yml Builds and commits generated artifacts. Moderate (2 votes): push commits lack explicit write permissions. Moderate (2 votes): build tools are unpinned. Moderate (1 vote): commit logic also runs on detached tag pushes.
.gitattributes Excludes internal files from archives. Moderate (1 vote): trailing-slash patterns are not recursive.
Review details

Suppressed comments (4)

.gitattributes:2

  • Trailing-slash directory patterns are not recursive in .gitattributes, so these entries do not apply export-ignore to the contents of .github or scripts. Those internal files can still be included in git archive source tarballs; use recursive patterns such as path/** instead.
.github/       export-ignore
scripts/       export-ignore

.github/workflows/ci.yml:36

  • This condition is also true for tag pushes, including the vX.Y.Z tag created by npm version. A tag checkout is detached, so if the rebuild changes an artifact, git-auto-commit-action will try to commit/push from the tag and can fail; restrict this step to branch pushes.
        if: github.event_name == 'push'

.github/workflows/release.yml:28

  • This rebuilds the tag checkout and then publishes the working tree, but the only post-build check compares version strings. If generated output differs from the tagged files, npm will publish artifacts that are not represented by the tag; fail when the distributable files change or publish only the checked-in artifacts.
      - name: Build (cake build)
        run: cake build

package.json:34

  • git add -A stages every modified and untracked path during npm's version hook, so unrelated internal files can be included in the release commit and tag. Stage only package.json and the generated/versioned project files instead.
    "version": "node scripts/bump-coffee-version.js && cake build && git add -A"
  • Files reviewed: 8/8 changed files
  • Comments generated: 4
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread .github/workflows/release.yml Outdated
Comment thread .github/workflows/ci.yml Outdated
Comment thread .github/workflows/ci.yml
Comment thread .github/workflows/release.yml Outdated
@erikn69

erikn69 commented Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

The Copilot reviews were applied.

for npm publish: secrets.NPM_TOKEN is necessary

Hmmm I will have to look into setting this up...

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants