test.yml

name: Test
on: [ push, pull_request, workflow_dispatch ]
jobs:
  Coverage:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
    - run: npm install --no-audit
    - run: npm audit --audit-level=low
    - run: npx c8 -r lcovonly -r text --check-coverage --100 npm test
    - run: node --import=@litejs/cli/test.js test/load.mjs
    - run: npm run lint
    - uses: coverallsapp/github-action@v2
      name: Upload to coveralls.io
      with:
        github-token: ${{ github.token }}
  Test:
    strategy:
      matrix:
        include:
        - { node: 8,  os: windows-latest, arch: x86 }
        - { node: 12, os: macos-latest,   arch: x64 }
        - { node: 16, os: ubuntu-latest,  arch: x64 }
    runs-on: ${{ matrix.os }}
    name: Node ${{matrix.node}} (${{matrix.os}} ${{matrix.arch}})
    steps:
    - run: git config --global core.autocrlf false
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with:
        node-version: ${{ matrix.node }}
        architecture: ${{ matrix.arch }}
    - run: npm install --no-audit
    - run: npm test
  Analyze:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: github/codeql-action/init@v3
      with:
        languages: javascript
    - uses: github/codeql-action/analyze@v3
      with:
        category: /language:javascript
  Release:
    if: startsWith(github.ref, 'refs/tags/v')
    needs: [Analyze, Coverage, Test]
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        ref: ${{ github.ref }}
    - run: |
        echo '${{ vars.RELEASE_SIGNERS }}' > ./allowed_signers
        git config gpg.ssh.allowedSignersFile ./allowed_signers
        git verify-tag -v ${{ github.ref_name }}
      name: Verify release tag signature
    - uses: actions/setup-node@v4
      with:
        registry-url: https://registry.npmjs.org/
    - run: |
        gh release create $TAG --title $TAG --notes "$(git tag -l --format='%(subject)%0a%0a%(contents:body)' $TAG)"
        gh run list --json databaseId  -q '.[20:]|.[].databaseId' --limit 100 | xargs -I{} gh run delete "{}"
        [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] && echo "PUBLISH=latest" >> $GITHUB_ENV || echo "PUBLISH=next" >> $GITHUB_ENV
      env:
        GH_TOKEN: ${{ github.token }}
        TAG: ${{ github.ref_name }}
    - run: npm publish --access public --tag $PUBLISH
      env:
        NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}