Feature/pnpm trusted publisher

.github/setup-node/action.yaml

@@ -0,0 +1,43 @@
+name: 'Setup Node.js'
+description: 'Sets up Node.js environment and installs dependencies.'
+inputs:
+  node_version:
+    description: 'Node.js version to use, e.g. 20.x'
+    required: false
+    default: '24.12.0'
+  pnpm_version:
+    description: 'pnpm version to use, e.g. 10.x'
+    required: false
+    default: '10.x'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Use Node.js ${{ inputs.node_version }}
+      uses: actions/setup-node@v6
+      with:
+        node-version: ${{ inputs.node_version }}
+
+    - name: Install pnpm
+      uses: pnpm/action-setup@v4
+      with:
+        version: ${{ inputs.pnpm_version }}
+
+    - name: Get pnpm store location
+      shell: bash
+      run: |
+        echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+    - name: Setup pnpm cache
+      uses: actions/cache@v4
+      with:
+        path: ${{ env.STORE_PATH }}
+        key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-pnpm-store-
+
+    - name: Install dependencies (pnpm)
+      shell: bash
+      run: |
+        pnpm install --frozen-lockfile
+      # equivalent to npm ci

.github/workflows/build-libs.yaml

@@ -10,23 +10,33 @@ jobs:
   build_fastedge_libs:
     runs-on: [self-hosted, ubuntu-22-04, regular]
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Node Environment
+        uses: ./.github/setup-node
 
       - name: Set up repo submodules
         run: git submodule update --init --recursive
 
-      - name: Setup Node.js latest
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-
-      - name: Install dependencies
+      - name: Ensure build folders are empty # Should already be empty
         run: |
-          npm ci
+          rm -rf lib/*
+          rm -rf bin/*
+
+      - name: Restore build cache
+        id: restore-build-cache
+        uses: actions/cache/restore@v4
+        with:
+          path: |
+            lib/
+            bin/
+            types/
+          key: ${{ runner.os }}-libs-artifact-${{ github.sha }}
 
       - name: Import Secrets
         uses: hashicorp/vault-action@v3
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         id: secrets
         with:
           url: https://puppet-vault.gc.onl
@@ -37,37 +47,33 @@ jobs:
 
       - name: Login to Harbor
         uses: docker/login-action@v3
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         with:
           registry: harbor.p.gc.onl
           username: ${{ steps.secrets.outputs.HARBOR_LOGIN }}
           password: ${{ steps.secrets.outputs.HARBOR_PASSWORD }}
 
-      - name: display contents of lib folder
-        run: ls -la lib
-
-      - name: Ensure build folders are empty # Should already be empty
-        run: |
-          rm -rf lib/*
-          rm -rf bin/*
-
       - name: Build docker images
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         run: docker build -t clang-monkey .
 
       - name: Build FastEdge runtime libs
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         run: docker run -v $(pwd)/lib:/usr/src/app/lib clang-monkey
 
       - name: Build Javascript libs
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         run: npm run build:js
 
       - name: Run Integration Tests
         run: npm run test:integration
 
-      - name: Upload libs Artifact
-        uses: actions/upload-artifact@v4
+      - name: Save build cache
+        id: save-build-cache
+        uses: actions/cache/save@v4
         with:
-          name: libs-artifact
-          retention-days: 1
           path: |
-            bin/
             lib/
+            bin/
             types/
+          key: ${{ runner.os }}-libs-artifact-${{ github.sha }}

.github/workflows/code-validation.yaml

@@ -7,17 +7,11 @@ jobs:
   code_validation:
     runs-on: [self-hosted, ubuntu-22-04, regular]
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js latest
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-
-      - name: Install dependencies
-        run: |
-          npm ci
+      - name: Setup Node Environment
+        uses: ./.github/setup-node
 
       - name: ESlint
         run: |

.github/workflows/deploy.yaml

@@ -21,7 +21,7 @@ jobs:
     runs-on: [self-hosted, ubuntu-22-04, regular]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Validate branch name
         run: |
@@ -36,6 +36,8 @@ jobs:
   fossa:
     needs: [validate_branch_name]
     uses: ./.github/workflows/fossa.yaml
+    secrets:
+      FOSSA_PUB_API_KEY: ${{ secrets.FOSSA_PUB_API_KEY }}
 
   code_validation:
     needs: [validate_branch_name]
@@ -46,7 +48,7 @@ jobs:
     uses: ./.github/workflows/unit-tests.yaml
 
   build_fastedge_artifacts:
-    needs: [code_validation, unit_tests]
+    needs: [code_validation, unit_tests, fossa]
     uses: ./.github/workflows/build-libs.yaml
     secrets:
       VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
@@ -58,4 +60,3 @@ jobs:
       dry_run: ${{ github.event.inputs.dry_run || 'true' }}
     secrets:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/docs.yaml

@@ -25,22 +25,18 @@ jobs:
     name: Build Static Docs
     runs-on: [self-hosted, ubuntu-22-04, regular]
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v6
 
-      - name: Setup Node
-        uses: actions/setup-node@v4
+      - name: Setup Node Environment
+        uses: ./.github/setup-node
         with:
-          node-version: 20.x
+          working-directory: ${{ env.BUILD_PATH }}
 
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@v5
 
-      - name: Install dependencies
-        run: npm ci
-        working-directory: ${{ env.BUILD_PATH }}
-
       - name: Vars
         run: |
           echo "astro origin=${{ steps.pages.outputs.origin }}"

.github/workflows/fossa.yaml

@@ -1,28 +1,33 @@
 name: Fossa Compliance Check
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
+    secrets:
+      FOSSA_PUB_API_KEY:
+        required: true
 
 jobs:
   fossa:
-    runs-on: [self-hosted, ubuntu-22-04, regular]
+    runs-on: ubuntu-latest
 
-    if: github.actor != 'dependabot[bot]'
+    if: github.actor != 'dependabot[bot]' && github.repository == 'G-Core/FastEdge-sdk-js'
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Install FOSSA CLI
         run: |
           curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash
 
+      - name: Set FOSSA API Key
+        run: echo "FOSSA_API_KEY=${{ secrets.FOSSA_PUB_API_KEY }}" >> $GITHUB_ENV
+
       - name: Run FOSSA Analysis
-        env:
-          FOSSA_API_KEY: ${{ secrets.FOSSA_PUB_API_KEY }}
         run: fossa analyze
 
       - name: Run FOSSA Test
-        env:
-          FOSSA_API_KEY: ${{ secrets.FOSSA_PUB_API_KEY }}
         run: fossa test

.github/workflows/release.yaml

@@ -9,38 +9,44 @@ on:
     secrets:
       GH_TOKEN:
         required: true
-      NPM_TOKEN:
-        required: true
 
 jobs:
   release:
     name: NPM Release
-    runs-on: [self-hosted, ubuntu-22-04, regular]
+    runs-on: ubuntu-latest # Use a standard runner for Trusted Publishing
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write # For npm provenance ( Trusted publishing )
+
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20.x
-
-      - name: Install dependencies
-        run: npm ci
+      - name: Setup Node Environment
+        uses: ./.github/setup-node
 
-      - name: Download libs Artifact
-        uses: actions/download-artifact@v4
+      - name: Restore build cache
+        id: restore-build-cache
+        uses: actions/cache/restore@v4
         with:
-          name: libs-artifact
+          path: |
+            lib/
+            bin/
+            types/
+          key: ${{ runner.os }}-libs-artifact-${{ github.sha }}
 
-      - name: display contents of lib folder
-        run: ls -la lib
-
-      - name: display contents of bin folder
-        run: ls -la bin
+      - name: Ensure build folders are valid
+        shell: bash
+        run: |
+          if [ ! -d "lib" ] || [ ! -d "bin" ] || [ ! -d "types" ]; then
+            echo "Build folders are missing. Please run the build-libs workflow before releasing."
+            exit 1
+          fi
 
       - name: Dry Run Status
         id: dry_run
@@ -55,7 +61,7 @@ jobs:
 
       - name: Semantic Release
         env:
+          # NPM_TOKEN is not set as we are using NPM's Trusted Publishing with OIDC
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
           CI: true # Used to bypass husky hooks
-        run: npx semantic-release ${{ steps.dry_run.outputs.dry_run }}
+        run: pnpm dlx semantic-release@25 ${{ steps.dry_run.outputs.dry_run }}

.github/workflows/unit-tests.yaml

@@ -9,20 +9,16 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [18.x, 20.x]
+        node-version: [20.x, 22.x, 24.x]
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@v6
 
-      - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+      - name: Setup Node Environment
+        uses: ./.github/setup-node
         with:
-          node-version: ${{ matrix.node-version }}
-
-      - name: Install dependencies
-        run: |
-          npm ci
+          node_version: ${{ matrix.node-version }}
 
       - name: Unit Tests
         run: |

.gitignore

@@ -17,3 +17,6 @@ integration-tests/test-files/output.wasm
 yarn-error.log
 
 .vscode/
+
+# Using pnpm
+package-lock.json

.node-version

@@ -0,0 +1 @@
+24.12.0

README.md

@@ -21,7 +21,7 @@ Please read through the documentation provided by Gcore.
 
 Required:
 
-- Node v18 or higher
+- Node v20 or higher
 
 Setup:
 

docs/.gitignore

@@ -6,6 +6,9 @@ dist/
 # dependencies
 node_modules/
 
+# Using pnpm
+package-lock.json
+
 # logs
 npm-debug.log*
 yarn-debug.log*

docs/.node-version

@@ -0,0 +1 @@
+24.12.0