ci(action): update workflows

.github/workflows/release.yml

@@ -1,17 +1,18 @@
-name: Test & Release
+name: Release
 
 on:
   push:
     branches:
       - main
 
 jobs:
-  lint-and-test:
+  test:
     uses: ./.github/workflows/test.yml
-    secrets: inherit
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   release:
-    needs: lint-and-test
+    needs: test
 
     runs-on: ubuntu-latest
 
@@ -20,14 +21,21 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           persist-credentials: false
-      - name: Use Node.js
+
+      - name: Use Node.js LTS
         uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4
         with:
           node-version: 'lts/*'
+          cache: npm
+
       - name: Install packages
         run: npm ci
+
+      - name: Audit npm signatures
+        run: npm audit signatures
+
       - name: Run Semantic Release
-        run: npm run release
+        run: npx semantic-release
         env:
           GITHUB_TOKEN: ${{ secrets.CI_GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/test.yml

@@ -1,39 +1,72 @@
-name: Lint & Test
+name: Test
 
 on:
-  workflow_call:
+  push:
+    branches:
+      - isn-renovate/** # branches generated by https://github.com/apps/isn-renovate
   pull_request:
     branches:
       - main
+  workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: true
 
 jobs:
-  lint-and-test:
-    runs-on: ${{ matrix.os }}
+  test_matrix:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
+        node-version: [18, 20, 21]
+
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 5
 
     steps:
       - name: Checkout project
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-      - name: Use Node.js
+
+      - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4
         with:
-          node-version: 'lts/*'
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
       - name: Install packages
         run: npm ci
+
+      - name: Audit npm signatures
+        run: npm audit signatures
+
       - name: Check codestyle compliance
         run: npm run lint
+
       - name: Setup Git for tests
         run: |
-          git config --global user.email "user@test.com"
-          git config --global user.name "Test User"
+          git config --global user.name "github-actions"
+          git config --global user.email "github-actions@github.com"
+
       - name: Run tests
         run: npm run test
+
       - name: Upload coverage reports to Codecov
-        if: ${{ matrix.os == 'ubuntu-latest' }}
+        if: strategy.job-index == 0
         uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage/coverage-final.json
           fail_ci_if_error: true
+
+  # separate job to set as required status check in branch protection
+  required_check:
+    runs-on: ubuntu-latest
+    needs:
+      - test_matrix
+    if: always()
+    steps:
+      - name: All required jobs and matrix versions passed
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: exit 0
+      - name: Some required jobs or matrix versions failed
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: exit 1

package.json

@@ -13,7 +13,6 @@
     "lint:prettier": "prettier ./**/*.{json,md,yml} --check",
     "lint": "npm run lint:eslint && npm run lint:prettier",
     "lint:fix": "npm run lint:eslint -- --fix && npm run lint:prettier -- --write",
-    "release": "semantic-release",
     "test": "nyc ava --no-worker-threads -v"
   },
   "engines": {