Harden CI/CD

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @splunk/app-development

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      npm-minor-patch:
+        update-types: ["minor", "patch"]
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        update-types: ["major", "minor", "patch"]
+    cooldown:
+      default-days: 7

.github/workflows/release.yml

@@ -1,31 +1,46 @@
-name: Create Release
+name: Create release
 
 on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
+  cancel-in-progress: false
+
 jobs:
+  test:
+    name: Test
+    uses: $/.github/workflows/test.yml
+
   publish-npm:
+    name: Publish to npm
+    needs: test
     runs-on: ubuntu-latest
+    environment: release
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 14
+          package-manager-cache: false
           registry-url: https://registry.npmjs.org/
-      - run: npm publish
+      - name: Publish to npm
+        run: npm publish
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Package JSON Info
-        uses: myrotvorets/info-from-package-json-action@1.1.0
+      - name: Get package version
         id: pkgjson
-
+        run: echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"
       - name: Generate docs
-        run: node sdkdo docs
-
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        run: make docs
+      - name: Upload docs artifact
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: js_sdk_docs
-          path: docs-${{ steps.pkgjson.outputs.packageVersion }}/
+          path: docs-${{ steps.pkgjson.outputs.version }}/

.github/workflows/test.yml

@@ -1,60 +1,56 @@
-name: Node.js CI
+name: JS SDK CI
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [develop, master]
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
 
-jobs:
-  build:
-    runs-on: ${{ matrix.os }}
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
+jobs:
+  test:
+    name: Tests (node ${{ matrix.node }}, splunk ${{ matrix.splunk-version }})
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        os:
-          - ubuntu-latest
-        node:
-          - 14
-          - 8.17.0
-        splunk-version:
-          - "8.2"
-          - "latest"
-
-    services:
-      splunk:
-        image: splunk/splunk:${{matrix.splunk-version}}
-        env:
-          SPLUNK_START_ARGS: --accept-license
-          SPLUNK_HEC_TOKEN: 11111111-1111-1111-1111-1111111111113
-          SPLUNK_PASSWORD: changed!
-          SPLUNK_APPS_URL: https://github.com/splunk/sdk-app-collection/releases/download/v1.1.0/sdkappcollection.tgz
-        ports:
-          - 8000:8000
-          - 8088:8088
-          - 8089:8089
-
+        node: [14, 8.17.0]
+        splunk-version: ["8.2", latest]
     steps:
-      - uses: actions/checkout@v2
-
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Use node ${{ matrix.node }}
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node }}
-
+          cache: npm
       - name: Create .splunkrc file
+        env:
+          SPLUNK_VERSION: ${{ matrix.splunk-version }}
         run: |
           cd ~
           echo host=localhost > .splunkrc
           echo port=8089 >> .splunkrc
           echo username=admin >> .splunkrc
           echo password=changed! >> .splunkrc
           echo scheme=https >> .splunkrc
-          echo version=${{ matrix.splunk }} >> .splunkrc
-
-      - name: Run npm install
-        run: npm install
-
-      - name: Run make test
+          echo "version=${SPLUNK_VERSION}" >> .splunkrc
+      - name: Install dependencies
+        run: make install
+      - name: Launch Splunk Docker instance
+        env:
+          SPLUNK_IMAGE: splunk/splunk:${{ matrix.splunk-version }}
+        run: make up
+      - name: Wait for Splunk Docker instance
+        run: make wait_up
+      - name: Run tests
         run: make test
         env:
           SPLUNK_HOME: /opt/splunk
-  fossa-scan:
-    uses: splunk/oss-scanning-public/.github/workflows/oss-scan.yml@main
-    secrets: inherit

.vscode/settings.json

@@ -0,0 +1,12 @@
+{
+  "cSpell.words": [
+    "elementtree",
+    "healthcheck",
+    "mccutchen",
+    "mochawesome",
+    "newcap",
+    "pkgjson",
+    "sdkdo",
+    "splunkjs"
+  ]
+}