feat: add dynamic users

.dockerignore

@@ -1 +1,2 @@
 node_modules
+dist

.github/dependabot.yml

@@ -9,14 +9,58 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+      day: "saturday"
+      time: "08:00"
+    # Only 1 PR at a time so tests pass and it merges before the next PR opens
+    open-pull-requests-limit: 1
     pull-request-branch-name:
       # Separate sections of the branch name with a hyphen because docker hub doesn't want slashes
       # for example, `dependabot-npm_and_yarn-next_js-acorn-6.4.1`
       separator: "-"
+    commit-message:
+      # Gives PR titles like "chore(deps): bump x from 1.0.0 to 1.1.0" to pass the PR title check
+      prefix: "chore"
+      include: "scope"
+    versioning-strategy: increase-if-necessary
     cooldown: # Cooldown: wait before creating PRs for newly released versions
       default-days: 1 # fallback wait for all updates
       semver-major-days: 30 # waits 30 days for major updates
       semver-minor-days: 7 # waits 7 days for minor updates
       semver-patch-days: 1 # optional; explicit patch wait (defaults to default-days)
       include:
-        - "*" # apply to all dependencies
+        - "*" # apply to all dependencies
+
+  - package-ecosystem: "github-actions"
+    directory: "/" # Checks workflows in .github/workflows
+    schedule:
+      interval: "weekly"
+      day: "saturday"
+      time: "10:00"
+    open-pull-requests-limit: 1
+    pull-request-branch-name:
+      separator: "-"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    cooldown:
+      default-days: 7 # wait a week before picking up new action releases
+
+  - package-ecosystem: "docker"
+    directory: "/" # Checks the FROM lines in the Dockerfile
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "08:00"
+    open-pull-requests-limit: 1
+    pull-request-branch-name:
+      separator: "-"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    # Skip major base image updates (e.g. a new Node major), those need code and CI changes too
+    ignore:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    cooldown:
+      default-days: 7

.github/pr-title-checker-config.json

@@ -0,0 +1,15 @@
+{
+  "LABEL": {
+    "name": ""
+  },
+  "CHECKS": {
+    "NOTE": "You can test the regex here: https://regex101.com/r/nDeps5/1",
+    "regexp": "(^(?<type>build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test|BREAKING CHANGE)(?<scope>\\([\\w\\s*-]+\\))?(?<breaking_change>!?): (?<body>([a-z]).+[^.|\\s])$)",
+    "regexpFlags": "gm"
+  },
+  "MESSAGES": {
+    "success": "All OK",
+    "failure": "PR title not following the semantic-release guidelines. See https://github.com/angular/angular.js/blob/master/DEVELOPERS.md#-git-commit-guidelines for more information.",
+    "notice": ""
+  }
+}

.github/workflows/build-image-test.yml

@@ -0,0 +1,49 @@
+name: Build image test
+
+# Builds the image on every PR and pushes it tagged with the branch name
+# (e.g. stfc-mockserver-client:46-add-dynamic-users) so it can be tested with
+# other repos before merging, the same way user-office-factory does it
+on:
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+  packages: write # push the branch image to ghcr.io
+
+jobs:
+  build-image-test:
+    name: Docker build and file validation
+    runs-on: ubuntu-latest
+    env:
+      # Dependabot and fork PRs get a read-only token, so only build for those
+      PUSH_IMAGE: ${{ github.event.pull_request.head.repo.full_name == github.repository && !startsWith(github.head_ref, 'dependabot') }}
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v7
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Validate Dockerfile
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64
+          call: check
+
+      - name: Login to GitHub Container Registry
+        if: env.PUSH_IMAGE == 'true'
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push branch image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          build-args: BUILD_VERSION=${{ github.event.pull_request.head.sha }}
+          push: ${{ env.PUSH_IMAGE == 'true' }}
+          tags: ghcr.io/userofficeproject/stfc-mockserver-client:${{ github.head_ref }}

.github/workflows/build-push.yml

@@ -1,45 +1,57 @@
 name: Build && Push
 
-# Controls when the action will run. Triggers the workflow on push or pull request
-# events but only for the develop branch
+# On every merge into master: bump the version from the conventional commit
+# messages, publish a GitHub Release, then build and push the image tagged with
+# that version
 on:
   push:
     branches: [master]
 
-# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+permissions:
+  contents: write # create tags and releases
+  packages: write # push to ghcr.io
+
+# Run one release at a time so two quick merges can't claim the same version
+concurrency:
+  group: release
+  cancel-in-progress: false
+
 jobs:
-  # This workflow contains a single job called "build"
   build:
-    # The type of runner that the job will run on
     runs-on: ubuntu-latest
 
-    # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
+
+      # feat -> minor, fix -> patch, ! or BREAKING CHANGE -> major, anything else -> patch
+      - name: Bump version and push tag
+        id: tag_version
+        uses: mathieudutour/[email protected]
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create a GitHub release
+        uses: ncipollo/release-action@v1
+        with:
+          tag: ${{ steps.tag_version.outputs.new_tag }}
+          name: Release ${{ steps.tag_version.outputs.new_tag }}
+          body: ${{ steps.tag_version.outputs.changelog }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - id: extract_branch
-        uses: swapActions/get-branch-name@v1
-
-      # For debugging capture the selected branch
-      - name: Extracted branch
-        run: echo "Extracted branch ${{ steps.extract_branch.outputs.branch }}"
-
-      # Build image
       - name: Build and push
-        id: docker_build
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
-          build-args: BUILD_VERSION=${{ github.sha }}
+          build-args: BUILD_VERSION=${{ steps.tag_version.outputs.new_tag }}
           push: true
-          tags: ghcr.io/userofficeproject/stfc-mockserver-client:${{ steps.extract_branch.outputs.branch }}
+          tags: |
+            ghcr.io/userofficeproject/stfc-mockserver-client:${{ steps.tag_version.outputs.new_tag }}
+            ghcr.io/userofficeproject/stfc-mockserver-client:latest

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,38 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: "32 11 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4

.github/workflows/lint-test.yml

@@ -0,0 +1,30 @@
+name: Lint test
+
+on:
+  pull_request:
+    branches: [master]
+
+env:
+  NODE_VERSION: 24.x
+  HUSKY: 0
+
+jobs:
+  run-linters:
+    name: Run linters
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+
+      - name: Install Node.js dependencies
+        run: npm ci
+
+      - name: Lint Action
+        run: npm run lint

.github/workflows/mock-server-test.yml

@@ -0,0 +1,30 @@
+name: Mock Server Test
+
+on:
+  pull_request:
+    branches: [master]
+
+env:
+  NODE_VERSION: 24.x
+  HUSKY: 0
+
+jobs:
+  run-tests:
+    name: Run tests
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+
+      - name: Install Node.js dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test

.github/workflows/pr-title-checker.yml

@@ -0,0 +1,18 @@
+name: PR Title Checker
+
+# PR titles become the squash-merge commit message, which drives the version
+# bump and changelog in build-push.yml, so they must follow conventional commits
+on:
+  pull_request:
+    branches: [master]
+    types: [opened, edited, synchronize, labeled, unlabeled]
+
+jobs:
+  check-pr-title:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: thehanimo/[email protected]
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          pass_on_octokit_error: false
+          configuration_path: .github/pr-title-checker-config.json

.gitignore

@@ -1,2 +1,3 @@
 node_modules
 .vscode/*
+dist

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

.lintstagedrc.json

@@ -0,0 +1,3 @@
+{
+  "src/**/*.ts": ["npm run lint", "prettier --write"]
+}

.oxlintrc.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["typescript", "unicorn", "oxc", "import", "node"],
+  "env": {
+    "node": true,
+    "es2024": true
+  },
+  "categories": {
+    "correctness": "error",
+    "suspicious": "warn"
+  },
+  "rules": {
+    "curly": ["error", "all"],
+    "typescript/no-floating-promises": [
+      "error",
+      {
+        "allowForKnownSafeCalls": [
+          {
+            "from": "package",
+            "package": "node:test",
+            "name": ["describe", "it", "test", "suite"]
+          }
+        ]
+      }
+    ]
+  },
+  "ignorePatterns": ["dist"]
+}

.prettierignore

@@ -0,0 +1,2 @@
+dist
+package-lock.json

.prettierrc.json

@@ -1,6 +1,13 @@
 {
-    "singleQuote": true,
-    "trailingComma": "es5",
-    "endOfLine": "auto"
+  "singleQuote": true,
+  "trailingComma": "es5",
+  "endOfLine": "auto",
+  "overrides": [
+    {
+      "files": ["*.yml", "*.yaml"],
+      "options": {
+        "singleQuote": false
+      }
+    }
+  ]
 }
-