Skip to content

ci: add built-artifact release gate (#765) #766

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tyler-reitz wants to merge 11 commits into
base: main
Choose a base branch
from
+2,165 −19
Open

ci: add built-artifact release gate (#765) #766

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
1bc91c5
ci: add built-artifact release gate (#765, #749)
tyler-reitz Jul 27, 2026
f62e6a3
test: pin release gate behavior, fix two detection gaps
tyler-reitz Jul 27, 2026
68fb6a0
fix: close five gaps in the release gate found in review
tyler-reitz Jul 27, 2026
36087a7
ci: pin actions to commit SHAs in test.yaml
tyler-reitz Jul 27, 2026
f19b59b
ci: least-privilege permissions and non-persisted checkout credentials
tyler-reitz Jul 28, 2026
5839636
fix: diff the release gate against npm, not a committed baseline
tyler-reitz Jul 28, 2026
b9b12a8
fix: fail the release gate when the published package cannot be fetched
tyler-reitz Jul 28, 2026
21492b4
fix: do not read CI's version stamp as a release bump
tyler-reitz Jul 28, 2026
47e3f96
feat: add an entry-point load test (#765 item 3)
tyler-reitz Jul 28, 2026
3ac02bd
fix: compare against the candidate's own major, not the latest dist-tag
tyler-reitz Jul 29, 2026
b50ede7
refactor: move the type-surface check out of the runtime gate
tyler-reitz Jul 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .eslintrc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,22 @@
"@typescript-eslint",
"no-only-tests"
],
"overrides": [
{
"files": ["**/*.mjs"],
"env": {
"browser": false,
"node": true
},
"globals": {
"describe": "readonly",
"it": "readonly",
"expect": "readonly",
"beforeEach": "readonly",
"afterEach": "readonly"
}
}
],
"rules": {
"no-only-tests/no-only-tests": "error",
"@typescript-eslint/no-explicit-any": "warn",
Expand Down
83 changes: 70 additions & 13 deletions .github/workflows/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,22 @@ on:
types:
- published

# Least privilege by default. No job writes to the repo through GITHUB_TOKEN;
# the publish job authenticates to npm with NODE_AUTH_TOKEN.
permissions:
contents: read

jobs:
build:
runs-on: ubuntu-latest
name: Build
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

@jhuleatt jhuleatt Jul 29, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the Zizmor changes, but please pull them out into their own PR and also change the docs workflow. That will keep this PR more focused

@tyler-reitz tyler-reitz Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, split out as #767, with docs.yaml included. test.yaml goes from 8 medium to 0, and docs.yaml clears entirely. 32 lines, no functional change to any job.

Worth flagging one thing: I applied the hardening to main directly rather than cherry-picking the two commits from here, because they were authored on top of the gate and carry the verify-package job with them. So this PR will still show the workflow changes until #767 lands and I rebase.

These commits will come out of this PR as part of the rework.

with:
persist-credentials: false
- name: Setup node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '24'
cache: 'npm'
Expand All @@ -31,14 +38,60 @@ jobs:
id: pack-dir
run: ./build.sh
- name: 'Upload Artifact'
uses: actions/upload-artifact@v4
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
with:
name: reactfire-${{ github.run_id }}
path: |
reactfire.tgz
publish.sh
unpack.sh
retention-days: 1
verify-package:
runs-on: ubuntu-latest
needs: build
name: Verify built artifact
steps:
- name: Checkout
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false
- name: Setup node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '24'
- name: 'Download Artifacts'
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
# Checks the packed tarball the publish job uploads verbatim, so this
# verifies the exact bytes that ship. No `npm ci` needed: the gate uses
# node builtins plus `tar`, and downloads the release to compare against
# with `npm pack` (see release-gate/README.md).
- name: Release gate
run: node scripts/release-gate.mjs reactfire-${{ github.run_id }}/reactfire.tgz
verify-loads:
runs-on: ubuntu-latest
needs: build
name: Verify package loads (React ${{ matrix.react }})
strategy:
matrix:
react: ['18', '19']
fail-fast: false
steps:
- name: Checkout
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false
- name: Setup node
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '24'
- name: 'Download Artifacts'
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
# Installs the packed tarball into a throwaway project with real react and
# firebase, then actually loads both entry points. Deliberately a separate
# job from the release gate: this one needs a dependency tree, and keeping
# it here is what lets the gate itself stay dependency-free.
- name: Entry-point load test
run: node scripts/entry-load.mjs reactfire-${{ github.run_id }}/reactfire.tgz --react ${{ matrix.react }}
test:
runs-on: ubuntu-latest
needs: build
Expand All @@ -49,30 +102,32 @@ jobs:
name: Test Node.js ${{ matrix.node }} (Ubuntu)
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false
- name: Setup node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: ${{ matrix.node }}
check-latest: true
cache: 'npm'
- name: Install deps
run: npm ci
- name: Setup Java
uses: actions/setup-java@v4
uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
with:
distribution: 'temurin'
java-version: '21'
- name: Install deps for functions
run: npm install
working-directory: ./functions
- name: Firebase emulator cache
uses: actions/cache@v4
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
with:
path: ~/.cache/firebase/emulators
key: firebase_emulators
- name: 'Download Artifacts'
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
- name: Expand Artifact
run: |
chmod +x reactfire-${{ github.run_id }}/unpack.sh
Expand All @@ -88,9 +143,11 @@ jobs:
name: Type check (React ${{ matrix.react }})
steps:
- name: Checkout
uses: actions/checkout@v4
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
with:
persist-credentials: false
- name: Setup node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '24'
cache: 'npm'
Expand All @@ -105,16 +162,16 @@ jobs:
publish:
runs-on: ubuntu-latest
name: Publish (NPM)
needs: test
needs: [test, verify-package, verify-loads]
if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'release' }}
steps:
- name: Setup node
uses: actions/setup-node@v4
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
node-version: '24'
registry-url: 'https://registry.npmjs.org'
- name: 'Download Artifacts'
uses: actions/download-artifact@v4
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
- name: Publish
run: |
cd ./reactfire-${{ github.run_id }}/
Expand Down
17 changes: 11 additions & 6 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,15 @@
"test:storage": "firebase emulators:exec --only storage --project=rxfire-525a3 \"vitest storage\"",
"test:useObservable": "vitest useObservable",
"test:firebaseApp": "vitest firebaseApp",
"format": "prettier src test vite.config.ts -w",
"lint": "eslint src/* test/* vite.config.ts",
"test:gate": "vitest release-gate",
"test:loads": "vitest entry-load",
"format": "prettier src test scripts vite.config.ts -w",
"lint": "eslint src/* test/* scripts/* vite.config.ts",
"size": "size-limit",
"analyze": "size-limit --why",
"gate": "node scripts/release-gate.mjs",
"loads": "node scripts/entry-load.mjs",
"gate:accept": "node scripts/release-gate.mjs --accept",
"docs": "typedoc --options typedoc.json && markdown-toc -i docs/use.md",
"docs:fork": "typedoc --options typedoc.json --gitRemote upstream && markdown-toc -i docs/use.md"
},
Expand Down Expand Up @@ -62,12 +67,12 @@
"module": "./dist/index.js",
"size-limit": [
{
"path": "dist/reactfire.cjs.production.min.js",
"limit": "10 KB"
"path": "dist/index.js",
"limit": "18 KB"
},
{
"path": "dist/reactfire.esm.js",
"limit": "10 KB"
"path": "dist/index.umd.cjs",
"limit": "16 KB"
}
],
"devDependencies": {
Expand Down
Loading
Loading