chore: setup mise, pkg-pr-new, OIDC for publication

.chachalog/.version

@@ -0,0 +1 @@
+1.2.0

.chachalog/config.mjs

@@ -0,0 +1,21 @@
+/// @ts-check
+/// <reference types="@chachalog/types" />
+import fs from "node:fs";
+import { defineConfig } from "chachalog";
+import github from "chachalog/github";
+
+export default defineConfig(() => ({
+  allowedBumps: ["patch", "minor", "major"],
+  platform: github(),
+  managers: {
+    packages: {
+      name: "javascript-modules",
+      path: process.cwd(),
+      version: fs.readFileSync(".chachalog/.version", "utf-8").trim(),
+    },
+    setVersion(_pkg, version) {
+      fs.writeFileSync(".chachalog/.version", version);
+      return true;
+    },
+  },
+}));

.github/workflows/on-code-change.yml

@@ -1,6 +1,6 @@
 # This workflow is triggered every time a change is pushed to any branches
 # Github actions command reference: https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions
-name: On Code Change (PR)
+name: On Code Change
 
 # The workflow could also be triggered on PRs
 on:
@@ -17,7 +17,6 @@ jobs:
     uses: Jahia/jahia-modules-action/.github/workflows/reusable-on-code-change.yml@v2
     secrets: inherit
     with:
-      static_analysis_node_version: 20
       static_analysis_auditci_level: critical
       build_container_image: ghcr.io/jahia/jahia-docker-mvn-cache:17-jdk-noble-mvn-loaded
       module_branch: ${{ github.ref }}
@@ -42,13 +41,10 @@ jobs:
           git config --global core.eol lf
 
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: latest
-          check-latest: true
+      - name: Set up the toolchain
+        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
 
       - name: Install and build dependencies
         run: yarn && yarn workspace "@jahia/vite-plugin" build

.github/workflows/on-merge.yml

@@ -15,7 +15,6 @@ permissions:
   actions: read
   checks: write
   contents: read
-  id-token: write
 
 concurrency:
   # ensure there is at most one execution of this workflow at any time
@@ -27,7 +26,7 @@ jobs:
     name: Update module signature
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: jahia/jahia-modules-action/update-signature@v2
         with:
           nexus_username: ${{ secrets.NEXUS_USERNAME }}
@@ -45,7 +44,7 @@ jobs:
         username: ${{ secrets.GH_PACKAGES_USERNAME }}
         password: ${{ secrets.GH_PACKAGES_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: jahia/jahia-modules-action/build@v2
         with:
           # the test module is built as part of the Maven build
@@ -90,11 +89,7 @@ jobs:
         username: ${{ secrets.GH_PACKAGES_USERNAME }}
         password: ${{ secrets.GH_PACKAGES_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
-      - name: Setup .yarnrc.yml file to allow publication to https://registry.npmjs.org with a 'yarn npm publish'
-        shell: bash
-        run: |
-          echo "npmAuthToken: ${{ secrets.NPMJS_PUBLISH_TOKEN }}" >> ~/.yarnrc.yml
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: jahia/jahia-modules-action/publish@v2
         with:
           # the test module is built as part of the Maven build

.github/workflows/on-release.yml

@@ -34,13 +34,13 @@ jobs:
           git config --global --add safe.directory $GITHUB_WORKSPACE
       # Providing the SSH PRIVATE of a user part of an admin group
       # is necessary to bypass PR checks
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ssh-key: ${{ secrets.GH_SSH_PRIVATE_KEY_JAHIACI }}
 
       # Setting up the SSH agent to be able to commit back to the repository
       # https://github.com/webfactory/ssh-agent
-      - uses: webfactory/ssh-agent@v0.7.0
+      - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
         with:
           ssh-private-key: ${{ secrets.GH_SSH_PRIVATE_KEY_JAHIACI }}
 
@@ -56,7 +56,6 @@ jobs:
           nexus_password: ${{ secrets.NEXUS_PASSWORD }}
           mvn_settings_filepath: ".github/maven.settings.xml"
           slack-webhook-qa: ${{ secrets.SLACK_WEBHOOK_URL_RC_FOR_QA }}
-          npmjs_publish_token: ${{ secrets.NPMJS_PUBLISH_TOKEN }}
 
       - uses: jahia/jahia-modules-action/update-signature@v2
         with:
@@ -69,9 +68,25 @@ jobs:
       # keep running until it reaches the timeout
       - name: Setup tmate session
         if: ${{ failure() }}
-        uses: mxschmitt/action-tmate@v3
+        uses: mxschmitt/action-tmate@35b54afac29c97fb54faba5b513f8fbd1882f113 # v3.24
         timeout-minutes: 15
 
+  publish-npm:
+    name: Publish packages to npmjs.com
+    needs: on-release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+      - run: yarn install
+      - run: yarn workspaces foreach -A --topological-dev --include '@jahia/{create-module,javascript-modules-library,vite-plugin}' run build
+      - run: yarn workspaces foreach -Avv --include '@jahia/{create-module,javascript-modules-library,vite-plugin}' npm publish --access public --tolerate-republish --provenance
+
   sbom:
     name: SBOM processing
     needs: on-release

.github/workflows/pkg-pr-new.yml

@@ -0,0 +1,17 @@
+name: Publish Any Commit
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Publish preview packages
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+      - run: yarn install
+      - run: yarn workspaces foreach -A --topological-dev --include '@jahia/{create-module,javascript-modules-library,vite-plugin}' run build
+      - run: yarn pkg-pr-new publish './javascript-create-module' './javascript-modules-library' './vite-plugin' --packageManager=yarn

.gitignore

@@ -12,8 +12,8 @@ dist/
 internal-dist/
 node/
 node_modules/
-**/.yarn/install-state.gz
-**/.yarn/cache/
+**/.yarn/*
+!**/.yarn/patches
 javascript-modules-engine/src/main/resources/javascript/
 javascript-modules-engine/src/main/resources/META-INF/js/
 tests/artifacts/