Skip to content

Commit 72134a0

Browse files
marksaasmarksaas
authored
Add npm Trusted Publisher workflow and update documentation (#249)
* Add npm Trusted Publisher workflow and update documentation * Add CODEOWNERS file requiring Maintainers team review * Add Dependabot config and Security policy - Configure Dependabot for automated dependency updates - Add security policy for vulnerability reporting - Update README with Security & Maintenance documentation - Fix publish workflow to use master branch only
1 parent 7b96917 commit 72134a0

6 files changed

Lines changed: 264 additions & 1 deletion

File tree

‎.github/CODEOWNERS‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Global code owners
2+
# All files in the repository require review from the Maintainers team
3+
* @prerender/maintainers

‎.github/dependabot.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
version: 2
2+
updates:
3+
# Enable version updates for npm
4+
- package-ecosystem: "npm"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
open-pull-requests-limit: 10
10+
reviewers:
11+
- "@prerender/maintainers"
12+
commit-message:
13+
prefix: "deps"
14+
include: "scope"
15+
16+
# Enable version updates for Express 3 test app
17+
- package-ecosystem: "npm"
18+
directory: "/test/support/express3"
19+
schedule:
20+
interval: "weekly"
21+
day: "monday"
22+
open-pull-requests-limit: 5
23+
reviewers:
24+
- "@prerender/maintainers"
25+
commit-message:
26+
prefix: "deps(express3-test)"
27+
28+
# Enable version updates for Express 4 test app
29+
- package-ecosystem: "npm"
30+
directory: "/test/support/express4"
31+
schedule:
32+
interval: "weekly"
33+
day: "monday"
34+
open-pull-requests-limit: 5
35+
reviewers:
36+
- "@prerender/maintainers"
37+
commit-message:
38+
prefix: "deps(express4-test)"
39+
40+
# Enable version updates for GitHub Actions
41+
- package-ecosystem: "github-actions"
42+
directory: "/"
43+
schedule:
44+
interval: "monthly"
45+
reviewers:
46+
- "@prerender/maintainers"
47+
commit-message:
48+
prefix: "ci"

‎.github/workflows/publish.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Publish to npm
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
workflow_dispatch:
8+
9+
concurrency:
10+
group: npm-publish
11+
cancel-in-progress: false
12+
13+
permissions:
14+
contents: read
15+
id-token: write
16+
17+
jobs:
18+
publish:
19+
runs-on: ubuntu-latest
20+
environment: npm-publish
21+
steps:
22+
- name: Checkout repository
23+
uses: actions/checkout@v4
24+
25+
- name: Setup Node.js
26+
uses: actions/setup-node@v4
27+
with:
28+
node-version: '18'
29+
registry-url: 'https://registry.npmjs.org'
30+
31+
- name: Install dependencies
32+
run: npm ci
33+
34+
- name: Setup test dependencies
35+
run: |
36+
cd test/support/express3 && npm install
37+
cd ../express4 && npm install
38+
39+
- name: Run tests
40+
run: npm test
41+
42+
- name: Get current version
43+
id: current-version
44+
run: echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
45+
46+
- name: Get published version
47+
id: published-version
48+
run: |
49+
PUBLISHED_VERSION=$(npm view prerender-node version 2>/dev/null || echo "0.0.0")
50+
echo "version=$PUBLISHED_VERSION" >> $GITHUB_OUTPUT
51+
52+
- name: Compare versions
53+
id: version-check
54+
run: |
55+
CURRENT="${{ steps.current-version.outputs.version }}"
56+
PUBLISHED="${{ steps.published-version.outputs.version }}"
57+
58+
echo "Current version: $CURRENT"
59+
echo "Published version: $PUBLISHED"
60+
61+
62+
SHOULD_PUBLISH=$(node -e "
63+
const current = '$CURRENT'.split('.').map(Number);
64+
const published = '$PUBLISHED'.split('.').map(Number);
65+
66+
for (let i = 0; i < 3; i++) {
67+
if (current[i] > published[i]) {
68+
console.log('true');
69+
process.exit(0);
70+
}
71+
if (current[i] < published[i]) {
72+
console.log('false');
73+
process.exit(0);
74+
}
75+
}
76+
console.log('false');
77+
")
78+
79+
echo "should-publish=$SHOULD_PUBLISH" >> $GITHUB_OUTPUT
80+
echo "Should publish: $SHOULD_PUBLISH"
81+
82+
- name: Publish to npm
83+
if: steps.version-check.outputs.should-publish == 'true'
84+
run: npm publish --access public --provenance
85+
env:
86+
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
87+
88+
- name: Output result
89+
run: |
90+
if [ "${{ steps.version-check.outputs.should-publish }}" == "true" ]; then
91+
echo "Published version ${{ steps.current-version.outputs.version }} to npm"
92+
else
93+
echo "⏭Version ${{ steps.current-version.outputs.version }} already exists-not publishing"
94+
fi

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
node_modules
2-
.DS_Store
2+
.DS_Store
3+
WARP.md

‎README.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,67 @@ As an alternative, you can pass `prerenderServiceUrl` in the options object duri
183183
app.use(require('prerender-node').set('prerenderServiceUrl', '<new url>'));
184184
```
185185

186+
## Publishing
187+
188+
This package uses npm Trusted Publisher with GitHub Actions for secure, automated publishing.
189+
190+
### Setup
191+
192+
1. **npm Trusted Publisher**: Configured with OpenID Connect (OIDC) for secure publishing without storing npm tokens
193+
- Publisher: GitHub Actions
194+
- Organization: prerender
195+
- Repository: prerender-node
196+
- Workflow: `publish.yml`
197+
- Environment: `npm-publish`
198+
199+
2. **GitHub Environment**: The `npm-publish` environment is configured with required reviewers for additional security
200+
201+
### Publishing Process
202+
203+
**Automatic Publishing**: The workflow automatically publishes to npm when:
204+
- Code is pushed to `main` or `master` branch
205+
- The version in `package.json` is higher than the current published version
206+
- All tests pass
207+
208+
**Manual Publishing**: Trigger via GitHub Actions "Run workflow" button
209+
210+
### Workflow Steps
211+
212+
1. **Setup**: Checkout code, install Node.js and dependencies
213+
2. **Test**: Run full test suite including Express 3/4 integration tests
214+
3. **Version Check**: Compare `package.json` version with npm registry
215+
4. **Publish**: If version is higher, publish with `--provenance` flag for supply chain security
216+
217+
To publish a new version:
218+
1. Update version in `package.json` using `npm version [major|minor|patch]`
219+
2. Push to master branch
220+
3. GitHub Actions will automatically publish if tests pass
221+
222+
## Security & Maintenance
223+
224+
### Automated Dependency Updates
225+
This repository uses **Dependabot** to automatically create pull requests for:
226+
- Security vulnerability fixes
227+
- Dependency updates for the main package
228+
- Test dependencies for Express 3 and Express 4 integration tests
229+
- GitHub Actions workflow updates
230+
231+
Dependabot runs weekly and creates PRs with conventional commit messages:
232+
- `deps: update package-name from x.x.x to y.y.y` - Main dependencies
233+
- `deps(express3-test): update package-name` - Express 3 test app dependencies
234+
- `deps(express4-test): update package-name` - Express 4 test app dependencies
235+
- `ci: update actions/checkout from v4 to v5` - GitHub Actions updates
236+
237+
### Express Version Support
238+
This middleware is tested against **Express 3 and Express 4** to ensure compatibility:
239+
- `test/support/express3/` - Express 3.x integration tests
240+
- `test/support/express4/` - Express 4.x integration tests
241+
242+
Both test apps have separate `package.json` files with their respective Express versions to verify the middleware works correctly across different Express major versions.
243+
244+
### Security Policy
245+
For security vulnerabilities, please see our [Security Policy](SECURITY.md). Do not report security issues through public GitHub issues.
246+
186247
## Contributing
187248

188249
We love any contributions! Feel free to create issues, pull requests, or middleware for other languages/frameworks!

‎SECURITY.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
We actively support the following versions of prerender-node with security updates:
6+
7+
| Version | Supported |
8+
| ------- | ------------------ |
9+
| 3.8.x | :white_check_mark: |
10+
| 3.7.x | :white_check_mark: |
11+
| < 3.7 | :x: |
12+
13+
## Reporting a Vulnerability
14+
15+
We take security vulnerabilities seriously. If you discover a security vulnerability in prerender-node, please report it privately.
16+
17+
### How to Report
18+
19+
**Please do not report security vulnerabilities through public GitHub issues.**
20+
21+
Instead, please report vulnerabilities by:
22+
23+
1. **Email**: Send details to [security@prerender.io](mailto:security@prerender.io)
24+
2. **GitHub Security**: Use GitHub's private vulnerability reporting feature
25+
26+
### What to Include
27+
28+
Please include the following information in your report:
29+
30+
- Description of the vulnerability
31+
- Steps to reproduce the issue
32+
- Affected versions
33+
- Potential impact
34+
- Any suggested fixes (if available)
35+
36+
### Response Timeline
37+
38+
- **Initial Response**: We aim to acknowledge receipt within 24-48 hours
39+
- **Status Update**: We will provide regular updates on our investigation
40+
- **Resolution**: We will work to resolve confirmed vulnerabilities as quickly as possible
41+
42+
### Responsible Disclosure
43+
44+
We kindly ask that you:
45+
- Give us reasonable time to investigate and fix the vulnerability
46+
- Do not publicly disclose the vulnerability until we have released a fix
47+
- Do not exploit the vulnerability or access data beyond what is necessary to demonstrate the issue
48+
49+
## Security Updates
50+
51+
Security updates are released as patch versions and announced through:
52+
- GitHub releases
53+
- npm advisory database
54+
- Security advisories on this repository
55+
56+
Thank you for helping keep prerender-node secure!

0 commit comments

Comments
 (0)