Merge branch 'main' into jonjanego-patch-1

.github/workflows/dependency-submission-example.yml

@@ -1,6 +1,6 @@
 name: Example Dependency Submission
-on:
-  push
+
+on: push
 
 permissions:
   contents: write
@@ -9,21 +9,15 @@ jobs:
   example-submission:
     runs-on: ubuntu-latest
     steps:
-      - name: 'Checkout Repository'
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
-      # As of 2023-02-22, the ubuntu-latest image uses npm v8.3.1. This version
-      # has a bug that prevents loading dependency-submission-toolkit in the
-      # 'example/' project. npm v8.4.1 (same version in Codespace created on
-      # same date) is known to work. Not pinned to latest to avoid
-      # reproducibility issues.
-      - run: npm install npm@8.4.1 -g
+        with:
+          node-version: 20
       - name: Install NPM dependencies
         run: npm ci
       - name: Run all NPM build/test actions
-        run: npm -w:example rebuild && npm run all -w:example
+        run: npm run --workspace example all
       - name: Run dependency submission
         uses: ./
-        id: example
         with:
           npm-package-directory: ./

.github/workflows/publish.yml

@@ -8,19 +8,16 @@ jobs:
   publish-npm:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout the project
-        uses: actions/checkout@v4
-      - name: Use Node.js 16.x (LTS)
-        uses: actions/setup-node@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
         with:
-          node-version: 16.x
-          registry-url: https://registry.npmjs.org/
-          cache: npm
+          node-version: 20
+          registry-url: https://registry.npmjs.org
       - run: npm ci
       - run: npm test
       - run: npm version ${TAG_NAME} --git-tag-version=false --allow-same-version
         env:
           TAG_NAME: ${{ github.event.release.tag_name }}
       - run: npm whoami; npm publish --access public
         env:
-          NODE_AUTH_TOKEN: ${{secrets.npm_token}}
+          NODE_AUTH_TOKEN: ${{ secrets.npm_token }}

.github/workflows/test.yml

@@ -1,7 +1,8 @@
 name: 'build-test'
+
 on: # rebuild any PRs and main branch changes
   pull_request:
-   branches:
+    branches:
       - main
       - 'releases/*'
   push:
@@ -14,14 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      # As of 2023-02-22, the ubuntu-latest image uses npm v8.3.1. This version
-      # has a bug that prevents loading dependency-submission-toolkit in the
-      # 'example/' project. npm v8.4.1 (same version in Codespace created on
-      # same date) is known to work. Not pinned to latest to avoid
-      # reproducibility issues.
-      - run: npm install npm@8.4.1 -g
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
       - name: Install NPM dependencies
         run: npm ci
-      - run: npm install
       - name: Run all NPM build/test actions
-        run: npm rebuild && npm run all
+        run: npm run all

action.yml

@@ -10,5 +10,5 @@ inputs:
     required: true
     default: './'
 runs:
-  using: 'node16'
-  main: 'example/action-dist/index.js'
+  using: 'node20'
+  main: 'example/dist/index.js'

biome.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "node_modules/@biomejs/biome/configuration_schema.json",
+  "files": {
+    "ignoreUnknown": true
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space"
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "semicolons": "asNeeded",
+      "trailingComma": "none"
+    }
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true
+    }
+  },
+  "organizeImports": {
+    "enabled": true
+  },
+  "vcs": {
+    "clientKind": "git",
+    "enabled": true,
+    "useIgnoreFile": true
+  }
+}

example/index.ts

@@ -1,3 +1,3 @@
-import { main } from './npm-detector'
+import { main } from './npm-detector.js'
 
 main()

example/npm-detector.test.ts

@@ -1,10 +1,11 @@
+import { PackageCache } from '@github/dependency-submission-toolkit'
+import { describe, expect, test } from 'vitest'
+
 import {
-  parseNameAndNamespace,
+  createBuildTarget,
   parseDependencies,
-  createBuildTarget
-} from './npm-detector'
-
-import { PackageCache } from '@github/dependency-submission-toolkit'
+  parseNameAndNamespace
+} from './npm-detector.js'
 
 describe('parseNameAndNamespace', () => {
   test('parses single name, no namespace', () => {
@@ -39,7 +40,7 @@ describe('parseDependencies', () => {
     const pkgs = parseDependencies(cache, dependencies)
 
     expect(pkgs).toHaveLength(1)
-    expect(pkgs[0].packageID()).toEqual('pkg:npm/foo@1.0')
+    expect(pkgs[0]?.packageID()).toEqual('pkg:npm/foo@1.0')
     expect(cache.countPackages()).toEqual(1)
   })
 
@@ -49,8 +50,8 @@ describe('parseDependencies', () => {
     const pkgs = parseDependencies(cache, dependencies)
 
     expect(pkgs).toHaveLength(2)
-    expect(pkgs[0].packageID()).toEqual('pkg:npm/foo@1.0')
-    expect(pkgs[1].packageID()).toEqual('pkg:npm/bar@2.0')
+    expect(pkgs[0]?.packageID()).toEqual('pkg:npm/foo@1.0')
+    expect(pkgs[1]?.packageID()).toEqual('pkg:npm/bar@2.0')
     expect(cache.countPackages()).toEqual(2)
   })
 
@@ -62,9 +63,9 @@ describe('parseDependencies', () => {
     const pkgs = parseDependencies(cache, dependencies)
 
     expect(pkgs).toHaveLength(1)
-    expect(pkgs[0].packageID()).toEqual('pkg:npm/foo@1.0')
-    expect(pkgs[0].packageDependencyIDs).toHaveLength(1)
-    expect(pkgs[0].packageDependencyIDs[0]).toEqual('pkg:npm/bar@2.0')
+    expect(pkgs[0]?.packageID()).toEqual('pkg:npm/foo@1.0')
+    expect(pkgs[0]?.packageDependencyIDs).toHaveLength(1)
+    expect(pkgs[0]?.packageDependencyIDs[0]).toEqual('pkg:npm/bar@2.0')
     expect(cache.countPackages()).toEqual(2)
   })
 })

example/npm-detector.ts

@@ -1,14 +1,13 @@
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
-import { PackageURL } from 'packageurl-js'
-
 import {
-  PackageCache,
   BuildTarget,
   Package,
+  PackageCache,
   Snapshot,
   submitSnapshot
 } from '@github/dependency-submission-toolkit'
+import { PackageURL } from 'packageurl-js'
 
 // top-level structure from the output of 'npm list'
 type NpmPackage = { name: string; version: string; dependencies: Dependencies }
@@ -30,18 +29,21 @@ type Dependencies = { [name: string]: Dependency }
 export function parseNameAndNamespace(npmDepName: string): [string, string] {
   const namespaceAndName = npmDepName.split('/')
 
-  if (namespaceAndName.length == 2) {
+  if (namespaceAndName.length === 1) {
+    // biome-ignore lint/style/noNonNullAssertion: exist because of the if statement
+    return ['', encodeURIComponent(namespaceAndName[0]!)]
+  }
+  if (namespaceAndName.length === 2) {
     return [
-      encodeURIComponent(namespaceAndName[0]),
-      encodeURIComponent(namespaceAndName[1])
+      // biome-ignore lint/style/noNonNullAssertion: exist because of the if statement
+      encodeURIComponent(namespaceAndName[0]!),
+      // biome-ignore lint/style/noNonNullAssertion: exist because of the if statement
+      encodeURIComponent(namespaceAndName[1]!)
     ]
-  } else if (namespaceAndName.length == 1) {
-    return ['', encodeURIComponent(namespaceAndName[0])]
-  } else {
-    throw new Error(
-      `expectation violated: package '${npmDepName}' has more than one slash (/) in name`
-    )
   }
+  throw new Error(
+    `expectation violated: package '${npmDepName}' has more than one slash (/) in name`
+  )
 }
 
 /**
@@ -58,9 +60,11 @@ export function parseDependencies(
     const purl = new PackageURL('npm', namespace, name, dep.version, null, null)
 
     // if the package has already been added to the cache, return the package early
-    if (cache.hasPackage(purl)) return cache.package(purl)
+    if (cache.hasPackage(purl)) {
+      return cache.package(purl)
+    }
 
-    let pkgs = []
+    const pkgs = []
     // post-order traversal of the dependency tree with recursion.
     // recursion is not expected to blow the stack as dependency trees are
     // unlikely to have significant depth
@@ -89,11 +93,10 @@ export function parseDependencies(
 export function createBuildTarget(npmPackage: NpmPackage): BuildTarget {
   const cache = new PackageCache()
   const topLevelDependencies = parseDependencies(cache, npmPackage.dependencies)
-
   const buildTarget = new BuildTarget(npmPackage.name)
-  topLevelDependencies.forEach((dep) => {
+  for (const dep of topLevelDependencies) {
     buildTarget.addBuildDependency(dep)
-  })
+  }
   return buildTarget
 }
 
@@ -107,7 +110,7 @@ export async function main() {
   const npmPackageDirectory = core.getInput('npm-package-directory')
   const prodPackages = await exec.getExecOutput(
     'npm',
-    ['list', '--prod', '--all', '--json'],
+    ['list', '--all', '--json', '--omit', 'dev'],
     { cwd: npmPackageDirectory }
   )
   if (prodPackages.exitCode !== 0) {

example/package.json

@@ -1,27 +1,23 @@
 {
   "name": "@github/npm-dependency-submission-example",
-  "version": "1.0.0",
+  "private": true,
   "description": "[UNPUBLISHED PACKAGE!] Example using the Dependency Submission Toolkit and npm list",
-  "main": "index.ts",
-  "dependencies": {
-    "@github/dependency-submission-toolkit": "file:../",
-    "packageurl-js": "^0.0.6"
-  },
+  "type": "module",
   "scripts": {
-    "build": "tsc",
-    "test": "jest",
-    "test:watch": "jest --watch",
-    "package": "ncc build --source-map --license licenses.txt --out action-dist",
-    "all": "npm run test && npm run build && npm run package"
+    "all": "npm run type-check && npm run build && npm run test",
+    "build": "ncc build index.ts --source-map --license=LICENSE.txt --out dist",
+    "test": "vitest run",
+    "test:watch": "vitest watch",
+    "type-check": "tsc"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/github/dependency-submission-toolkit.git"
-  },
-  "author": "",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/github/dependency-submission-toolkit/issues"
+  "dependencies": {
+    "@github/dependency-submission-toolkit": "file:../",
+    "packageurl-js": "^1.2.1"
   },
-  "homepage": "https://github.com/github/dependency-submission-toolkit#readme"
+  "devDependencies": {
+    "@tsconfig/strictest": "^2.0.2",
+    "@vercel/ncc": "^0.38.1",
+    "typescript": "^5.3.3",
+    "vitest": "^1.1.3"
+  }
 }

example/tsconfig.json

@@ -1,19 +1,11 @@
 {
   "compilerOptions": {
-    "target": "es6", /* Specify ECMAScript target version: 'ES3' (default), 'ES5', 'ES2015', 'ES2016', 'ES2017', 'ES2018', 'ES2019' or 'ESNEXT'. */
-    "module": "commonjs", /* Specify module code generation: 'none', 'commonjs', 'amd', 'system', 'umd', 'es2015', or 'ESNext'. */
-    "outDir": "./dist", /* Redirect output structure to the directory. */
-    "strict": true, /* Enable all strict type-checking options. */
-    "noImplicitAny": true, /* Raise error on expressions and declarations with an implied 'any' type. */
-    "esModuleInterop": true, /* Enables emit interoperability between CommonJS and ES Modules via creation of namespace objects for all imports. Implies 'allowSyntheticDefaultImports'. */
-    "skipLibCheck": true,
-    "sourceMap": true,
-    "paths": {      
-      "@github/dependency-submission-toolkit": ["../src"]
-    }
+    "isolatedModules": true,
+    "module": "ESNext",
+    "moduleDetection": "force",
+    "moduleResolution": "Bundler",
+    "noEmit": true
   },
-  "exclude": [
-    "dist",
-    "*.test.ts"
-  ]
+  "exclude": ["dist", "node_modules"],
+  "extends": "@tsconfig/strictest/tsconfig.json"
 }