👷 ASL-4247: Publish to GitHub repo instead of private HomeOffice repo. (

#86)

* ASL-4247: Boyscout: Remove contributors

* ASL-4247: Boyscout: Remove travis config

* ASL-4247: Boyscout: Import eslint from https://github.com/UKHomeOffice/hocs-frontend

* ASL-4247: Add Dependabot

* ASL-4247: Add Codeql

* ASL-4247: Add sas test workflow

* ASL-4247: Publish to GitHub repo.
This allows us to simplify CI pipelines and let developers access with credentials they already have.

* ASL-4247 - Corrected env var reference in .npmrc

---------

Co-authored-by: Tom Rowsell <[email protected]>

.eslintrc.js

@@ -0,0 +1,75 @@
+module.exports = {
+    'env': {
+        'node': true,
+        'browser': true,
+        'commonjs': true,
+        'es6': true
+    },
+    'extends': [
+        'eslint:recommended',
+        'plugin:react/recommended'
+    ],
+    'parserOptions': {
+        'ecmaVersion': 2020,
+        'sourceType': 'module'
+    },
+    'settings': {
+        'react': {
+            'version': 'detect'
+        }
+    },
+    'rules': {
+        'react/prop-types': 'off',
+        'indent': [
+            'error',
+            4
+            , { 'SwitchCase': 1 }
+        ],
+        'linebreak-style': [
+            'error',
+            'unix'
+        ],
+        'no-unused-vars': [
+            'error',
+            { 'argsIgnorePattern': '^_$'  }
+        ],
+        'quotes': [
+            'error',
+            'single'
+        ],
+        'semi': [
+            'error',
+            'always'
+        ],
+        'object-curly-spacing': [
+            'error', 'always'
+        ],
+        'no-trailing-spaces': [
+            'error'
+        ]
+    },
+    'overrides': [
+        {
+            'files': [ '**/__tests__/**' ],
+            'env': {
+                'jest': true
+            },
+            'globals': {
+                'render': false,
+                'shallow': false,
+                'wrapper': false,
+                'mount': false
+            }
+        },
+        {
+            'files': [ '**/__snapshots__/**' ],
+            'excludedFiles': '*.js.snap'
+        },
+        {
+            'files': [ 'src/**' ],
+            'env': {
+                'commonjs': true
+            }
+        }
+    ]
+};

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "⬆️ "
+    pull-request-branch-name:
+      separator: "-"
+    reviewers:
+      - "UKHomeOffice/asl-devs"
+    labels:
+      - "skip-release"
+      - "dependencies"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: "⬆️ "
+    pull-request-branch-name:
+      separator: "-"
+    reviewers:
+      - "UKHomeOffice/asl-devs"
+    labels:
+      - "patch"
+      - "dependencies"

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,39 @@
+name: "CodeQL Scan"
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '45 12 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/publish-npm.yml

@@ -0,0 +1,9 @@
+name: 'Publish - npm'
+on:
+  pull_request:
+    types: [ closed ]
+
+jobs:
+  publish:
+    uses: UKHomeOffice/sas-github-workflows/.github/workflows/publish-npm.yml@v1
+    secrets: inherit

.github/workflows/semver-check-increment.yml

@@ -0,0 +1,8 @@
+name: 'Increment Version - npm'
+on:
+  pull_request:
+    types: [ labeled, unlabeled, opened, reopened, synchronize ]
+
+jobs:
+  version:
+    uses: UKHomeOffice/sas-github-workflows/.github/workflows/semver-check-increment-npm.yml@v1

.github/workflows/test.yml

@@ -0,0 +1,9 @@
+name: 'Test'
+on:
+  pull_request:
+    types: [ opened, reopened, synchronize ]
+
+jobs:
+  test:
+    uses: UKHomeOffice/sas-github-workflows/.github/workflows/test-npm.yml@v1
+    secrets: inherit

.npmrc

@@ -0,0 +1,2 @@
+@ukhomeoffice:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

README.md

@@ -1,7 +1,6 @@
 # @ukhomeoffice/react-components
-[![All Contributors](https://img.shields.io/badge/all_contributors-3-orange.svg?style=flat-square)](#contributors)
 
-A set of react components to build the basic elements descibed in [GOV.UK Design System](https://design-system.service.gov.uk/).
+A set of react components to build the basic elements described in [GOV.UK Design System](https://design-system.service.gov.uk/).
 
 ## Details
 
@@ -11,6 +10,9 @@ the older [govuk_frontend_toolkit](https://github.com/alphagov/govuk_frontend_to
 additional Home Office specific components.
 
 ## Using components
+
+[Authenticate with GitHub packages](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-npm-registry#authenticating-with-a-personal-access-token)
+
 Install the package and any dependencies you have:
 ```bash
 # Install @ukhomeoffice/react-components
@@ -49,3 +51,11 @@ $ cd example
 $ npm start
 $ open http://localhost:8080
 ```
+
+## Publishing
+
+This is automatically published to the GitHub packages npm repository using GitHub Actions.
+
+When opening a pull request add a label `major`, `minor` or `patch` (or `skip-release`) and the version field in package.json will be updated by the pipeline using `npm version`.
+
+It is published once the pull request is merged if there is no `skip-release` label on the pull request, the SHA is also tagged with the SemVer value at that point.