github-actions

Reusable GitHub Actions for js-soft repositories.

release-dependency-updates

Checks whether commits on a branch since the latest GitHub release contain at least one dependency update commit and no blocking commits. Dependency update commits are authored by Renovate or Dependabot, or are associated with a pull request labeled dependencies. Commits associated with pull requests labeled test, chore, refactoring, or ci are allowed alongside dependency updates, but do not trigger a release by themselves. If no latest GitHub release exists, it checks all commits on the branch instead. If the checked commits pass, it creates a GitHub release with generated release notes.

jobs:
    release:
        permissions:
            contents: write
            pull-requests: read
        uses: js-soft/github-actions/.github/workflows/release-dependency-updates.yml@main
        with:
            branch: main
        secrets:
            github-token: ${{ secrets.GITHUB_TOKEN }}

The first release is created as 0.1.0. Later releases increment the latest release's patch version.

Secrets:

• github-token: token used to read commits, read associated pull request labels, and create the release. GITHUB_TOKEN is enough when the caller job grants contents: write and pull-requests: read. Use a PAT or GitHub App token instead when the created release should trigger follow-up workflows.

Fine-grained PAT permissions:

• Repository access: the caller repository.
• Repository permissions: Contents read/write and Pull requests read.

Classic PAT scopes:

• repo for private repositories.
• public_repo for public repositories.

Inputs:

• branch: branch to inspect and release from. Defaults to main.

dependency-security-maintenance

Runs better-npm-audit, applies npm audit fix, updates .nsprc with remaining vulnerability exceptions, and creates or updates a pull request with the current audit result when files changed. If no changes are needed, any open audit pull request is commented on and closed.

jobs:
    npm-audit:
        permissions:
            contents: write
            pull-requests: write
        uses: js-soft/github-actions/.github/workflows/dependency-security-maintenance.yml@main
        secrets:
            github-token: ${{ secrets.JS_SOFT_OPS_TOKEN }}

Inputs:

• enable-auto-merge: enables pull request auto-merge. Defaults to true.
• branch-name: branch name for the generated pull request. Defaults to handle-vulnerabilities.
• commit-message: commit message for audit changes. Defaults to Handle vulnerabilities.
• git-user-email: Git user.email used for the generated commit. Defaults to ci@js-soft.com.
• git-user-name: Git user.name used for the generated commit. Defaults to js-soft-ops.
• node-version: Node.js version used when node-version-file is empty or missing. Defaults to lts/*.
• node-version-file: path to a Node.js version file. Falls back to node-version when empty or missing. Defaults to .nvmrc.
• pull-request-title: title for the generated pull request. Defaults to Handle vulnerabilities.
• reviewers: comma-separated list of GitHub users or teams to request review from, for example octocat, js-soft/security. Defaults to empty.

validate-pr-label

Validates that a pull request has at least one accepted label. By default, the accepted labels are breaking-change, bug, chore, ci, dependencies, documentation, enhancement, refactoring, and test.

jobs:
    validate-pr-label:
        runs-on: ubuntu-latest
        steps:
            - uses: js-soft/github-actions/validate-pr-label@main

Inputs:

• valid-labels: comma-separated list of labels that are accepted for pull requests. Defaults to breaking-change, bug, chore, ci, dependencies, documentation, enhancement, refactoring, test.