Feature/pnpm trusted publisher

.github/setup-node/action.yaml

@@ -9,10 +9,6 @@ inputs:
     description: 'pnpm version to use, e.g. 10.x'
     required: false
     default: '10.x'
-  working_directory:
-    description: 'Working directory to install dependencies in.'
-    required: false
-    default: '.'
 
 runs:
   using: 'composite'
@@ -22,19 +18,26 @@ runs:
       with:
         node-version: ${{ inputs.node_version }}
 
-    - name: Clean node_modules
-      shell: bash
-      working-directory: ${{ inputs.working_directory }}
-      run: |
-        rm -rf node_modules
-
     - name: Install pnpm
+      uses: pnpm/action-setup@v4
+      with:
+        version: ${{ inputs.pnpm_version }}
+
+    - name: Get pnpm store location
       shell: bash
       run: |
-        npm install -g pnpm@${{ inputs.pnpm_version }}
+        echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+    - name: Setup pnpm cache
+      uses: actions/cache@v4
+      with:
+        path: ${{ env.STORE_PATH }}
+        key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+        restore-keys: |
+          ${{ runner.os }}-pnpm-store-
 
     - name: Install dependencies (pnpm)
       shell: bash
-      working-directory: ${{ inputs.working_directory }}
       run: |
         pnpm install --frozen-lockfile
+      # equivalent to npm ci

.github/workflows/build-libs.yaml

@@ -19,8 +19,24 @@ jobs:
       - name: Set up repo submodules
         run: git submodule update --init --recursive
 
+      - name: Ensure build folders are empty # Should already be empty
+        run: |
+          rm -rf lib/*
+          rm -rf bin/*
+
+      - name: Restore build cache
+        id: restore-build-cache
+        uses: actions/cache/restore@v4
+        with:
+          path: |
+            lib/
+            bin/
+            types/
+          key: ${{ runner.os }}-libs-artifact-${{ github.sha }}
+
       - name: Import Secrets
         uses: hashicorp/vault-action@v3
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         id: secrets
         with:
           url: https://puppet-vault.gc.onl
@@ -31,37 +47,33 @@ jobs:
 
       - name: Login to Harbor
         uses: docker/login-action@v3
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         with:
           registry: harbor.p.gc.onl
           username: ${{ steps.secrets.outputs.HARBOR_LOGIN }}
           password: ${{ steps.secrets.outputs.HARBOR_PASSWORD }}
 
-      - name: display contents of lib folder
-        run: ls -la lib
-
-      - name: Ensure build folders are empty # Should already be empty
-        run: |
-          rm -rf lib/*
-          rm -rf bin/*
-
       - name: Build docker images
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         run: docker build -t clang-monkey .
 
       - name: Build FastEdge runtime libs
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         run: docker run -v $(pwd)/lib:/usr/src/app/lib clang-monkey
 
       - name: Build Javascript libs
+        if: steps.restore-build-cache.outputs.cache-hit != 'true'
         run: npm run build:js
 
       - name: Run Integration Tests
         run: npm run test:integration
 
-      - name: Upload libs Artifact
-        uses: actions/upload-artifact@v4
+      - name: Save build cache
+        id: save-build-cache
+        uses: actions/cache/save@v4
         with:
-          name: libs-artifact
-          retention-days: 1
           path: |
-            bin/
             lib/
+            bin/
             types/
+          key: ${{ runner.os }}-libs-artifact-${{ github.sha }}

.github/workflows/deploy.yaml

@@ -18,7 +18,7 @@ on:
 jobs:
   # Gihub Actions do not allow regex validation for numbers in *.*.x branch names
   validate_branch_name:
-    runs-on: ubuntu-latest # Use a standard runner for Trusted Publishing
+    runs-on: [self-hosted, ubuntu-22-04, regular]
     steps:
       - name: Checkout code
         uses: actions/checkout@v6

.github/workflows/release.yaml

@@ -30,16 +30,23 @@ jobs:
       - name: Setup Node Environment
         uses: ./.github/setup-node
 
-      - name: Download libs Artifact
-        uses: actions/download-artifact@v4
+      - name: Restore build cache
+        id: restore-build-cache
+        uses: actions/cache/restore@v4
         with:
-          name: libs-artifact
+          path: |
+            lib/
+            bin/
+            types/
+          key: ${{ runner.os }}-libs-artifact-${{ github.sha }}
 
-      - name: display contents of lib folder
-        run: ls -la lib
-
-      - name: display contents of bin folder
-        run: ls -la bin
+      - name: Ensure build folders are valid
+        shell: bash
+        run: |
+          if [ ! -d "lib" ] || [ ! -d "bin" ] || [ ! -d "types" ]; then
+            echo "Build folders are missing. Please run the build-libs workflow before releasing."
+            exit 1
+          fi
 
       - name: Dry Run Status
         id: dry_run
@@ -57,4 +64,4 @@ jobs:
           # NPM_TOKEN is not set as we are using NPM's Trusted Publishing with OIDC
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
           CI: true # Used to bypass husky hooks
-        run: npx semantic-release@25 ${{ steps.dry_run.outputs.dry_run }}
+        run: pnpm dlx semantic-release@25 ${{ steps.dry_run.outputs.dry_run }}

docs/package.json

@@ -2,12 +2,6 @@
   "name": "docs",
   "type": "module",
   "version": "0.0.1",
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "sharp"
-    ]
-  },
   "scripts": {
     "dev": "astro dev",
     "start": "astro dev",

package.json

@@ -5,11 +5,6 @@
     "node": ">=20",
     "pnpm": ">=10"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ]
-  },
   "license": "Apache-2.0",
   "main": "lib/index.js",
   "types": "types/index.d.ts",