build: add attest provenance with lint and release workflow (#29)

.github/dependabot.yml

@@ -5,7 +5,7 @@
 
 version: 2
 updates:
-  - package-ecosystem: "npm" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: 'npm' # See documentation for possible values
+    directory: '/' # Location of package manifests
     schedule:
-      interval: "monthly"
+      interval: 'monthly'

.github/workflows/android.yml

@@ -1,35 +1,35 @@
 name: Android
 on:
   push:
-    branches: [ "main" ]
+    branches: ['main']
   pull_request:
-    branches: [ "main" ]
+    branches: ['main']
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-    - name: Set up JDK 17
-      uses: actions/setup-java@v3
-      with:
-        java-version: '17'
-        distribution: 'temurin'
+      - name: Set up JDK 17
+        uses: actions/setup-java@v3
+        with:
+          java-version: '17'
+          distribution: 'temurin'
 
-    - name: Setup Android SDK
-      uses: android-actions/setup-android@v3
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v3
 
-    - name: Setup Nodejs
-      uses: actions/setup-node@v4
-      with:
-        node-version: '22'
-    - run: |
-        corepack yarn
-        cd example && yarn install
+      - name: Setup Nodejs
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - run: |
+          corepack yarn
+          cd example && yarn install
 
-    - name: Build android example app
-      run: yarn build:android
-      env:
-        GH_USERNAME: ${{ vars.USERNAME }}
-        # PAT has read:packages permissions
-        GH_TOKEN: ${{ secrets.TOKEN }}
+      - name: Build android example app
+        run: yarn build:android
+        env:
+          GH_USERNAME: ${{ vars.USERNAME }}
+          # PAT has read:packages permissions
+          GH_TOKEN: ${{ secrets.TOKEN }}

.github/workflows/lint.yml

@@ -3,23 +3,35 @@
 name: Node.js lint
 on:
   push:
-    branches: [ "main" ]
+    branches: ['main']
   pull_request:
-    branches: [ "main" ]
+    branches: ['main']
+permissions:
+  id-token: write
+  attestations: write
 jobs:
   lint_typecheck:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [lts/*]
-        # See supported Node.js release schedule at https://nodejs.org/en/about/previous-releases
+    permissions:
+      id-token: write
+      attestations: write
     steps:
-    - uses: actions/checkout@v3
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'yarn'
-    - run: yarn
-    - run: yarn lint
-    - run: yarn typecheck
+      - uses: actions/checkout@v3
+      - name: Setup nodejs
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          cache: 'yarn'
+      - run: yarn
+      - run: yarn lint
+      - run: yarn typecheck
+      - run: yarn pack --out '%s_%v.tgz'
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: package
+          path: '${{ github.workspace }}/*.tgz'
+      - name: Attest
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: '${{ github.workspace }}/*.tgz'

.github/workflows/release.yml

@@ -6,11 +6,11 @@ on:
         type: choice
         description: What type of release?
         options:
-        - patch
-        - minor
-        - major
+          - patch
+          - minor
+          - major
 
-concurrency : ${{ github.workflow }}-${{ github.ref }}
+concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
   publish:
@@ -19,6 +19,7 @@ jobs:
       contents: write
       packages: write
       id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -66,3 +67,8 @@ jobs:
         run: npx release-it ${{ github.event.inputs.input_version }} --ci
         env:
           BOT_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+
+      - name: Attest
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: '${{ github.workspace }}/*.tgz'

.github/workflows/semantic-pr.yml

@@ -1,4 +1,4 @@
-name: "Semantic PR Title"
+name: 'Semantic PR Title'
 
 on:
   pull_request_target:

.github/workflows/test.yml

@@ -3,48 +3,40 @@
 name: Test
 on:
   push:
-    branches: [ "main" ]
+    branches: ['main']
   pull_request:
-    branches: [ "main" ]
+    branches: ['main']
 jobs:
   test-web:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [lts/*]
-        # See supported Node.js release schedule at https://nodejs.org/en/about/previous-releases
     steps:
-    - uses: actions/checkout@v3
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'yarn'
-    - run: yarn
-    - run: yarn test
+      - uses: actions/checkout@v3
+      - name: Setup NodeJS
+        uses: actions/setup-node@v4
+        with:
+          node-version: lts/*
+          cache: 'yarn'
+      - run: yarn
+      - run: yarn test
 
   test-ios:
     runs-on: macos-latest
-    strategy:
-      matrix:
-        node-version: [lts/*]
-        # See supported Node.js release schedule at https://nodejs.org/en/about/previous-releases
     steps:
       - uses: actions/checkout@v3
-      - name: Use Node.js ${{ matrix.node-version }}
+      - name: Setup NodeJS
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version: lts/*
           cache: 'yarn'
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: '3.3'
           bundler-cache: true
-      - name: "Get Ruby Version"
+      - name: 'Get Ruby Version'
         run: ruby --version
       - uses: SwiftyLab/setup-swift@latest
         with:
-          swift-version: "5.10.0"
+          swift-version: '5.10.0'
       - name: Get Swift Version
         run: swift --version
       - name: Get Xcode version
@@ -115,7 +107,7 @@ jobs:
           corepack enable
           yarn
       - name: Run Gradle
-        if: steps.cache-gradle.outputs.cache-hit != 'true'
+        if: steps.cache-test-android-gradle.outputs.cache-hit != 'true'
         run: example/android/gradlew
       - name: Run Tests
         run: make test-android